3101 matches found
CVE-2017-6074
The dccprcvstateprocess function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCPPKTREQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service double free via an application that makes an IPV6RECVPKTINF...
Command injection
The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI /cgi-bin/diagnostics component responsible for emailing out information about the...
Dell SonicWall Secure Remote Access Multiple Command Injection Vulnerabilities
The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI /cgi-bin/extensionsettings component responsible for handling some of the server's...
CVE-2016-9682
The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI /cgi-bin/diagnostics component responsible for emailing out information about the...
CVE-2016-9682
The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI /cgi-bin/diagnostics component responsible for emailing out information about the...
Linux/x86 - SELinux Permissive Mode Switcher Shellcode (45 bytes)
Title: x86 SELinux change between permissive and enforcing modes shellcode Date: 20-02-2017 Author: Krzysztof Przybylski Platform: Linx86 Tested on: CentOS 6.8 i686 Shellcode Size: 45 bytes ID: SLAE - 871 / 1. Description: SELinux mode switcher. Permissive = "\x30"; Enforcing = "\x31" gcc...
kernel: Use-after-free in the recvmmsg exit path
A use-after-free vulnerability was found in the kernel's socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within sysrecvmmsg function...
Linux/x86 - Reverse TCP Alphanumeric Staged Shellcode (103 bytes)
Reverse TCP Staged Alphanumeric Shellcode Linux x86 Execve /bin/sh Author: Snir Levi, Applitects 103 Bytes date: 9.2.17 Automatic python shellcode handler with stage preset send will be ready soon: https://github.com/snir-levi/ReverseTCPAlphanumericStagedShellcodeExecve-bin-bash/ IP - 127.0.0.1...
CVE-2016-10044
The aiomount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an iosetup system call...
CVE-2016-10044
The aiomount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an iosetup system call...
Design/Logic Flaw
An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploited this will resul...
CVE-2016-9039
An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploited this will resul...
Linux - Multi/Dual mode execve("/bin/sh", NULL, 0) Shellcode (37 bytes)
Linux - Multi/Dual mode execve"/bin/sh", NULL, 0 Shellcode 37 bytes. Shellcode exploit for Linux platform / Copyright © 2017 Odzhan. All Rights Reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:...
ALPINE-CVE-2016-10013
Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation...
kernel: Use-after-free in the recvmmsg exit path
A use-after-free vulnerability was found in the kernel's socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within sysrecvmmsg function...
CVE-2016-8440
Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite. Product: Android. Versions: Kernel 3.18. Android ID: A-31625306. References: QC-CR1036747...
Buffer overflow
Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite. Product: Android. Versions: Kernel 3.18. Android ID: A-31625306. References: QC-CR1036747...
CVE-2016-8440
Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite. Product: Android. Versions: Kernel 3.18. Android ID: A-31625306. References: QC-CR1036747...
CVE-2016-8440: Improper Restriction of Operations within the Bounds of a Memory Buffer
Possible buffer overflow in SMMU system call. Improper input validation in ADSP SID2CB system call may result in hypervisor memory overwrite. Product: Android. Versions: Kernel 3.18. Android ID: A-31625306. References: QC-CR1036747...
USN-3169-3: Linux kernel (Raspberry Pi 2) vulnerabilities
Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture ALSA subsystem of the Linux kernel. A local attacker could use this to cause a denial of service system crash. CVE-2016-9794 Andrey Konovalov discovered that signed integer...