CVE-2018-4006

An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality. A non-root user is able to write a file anywhere on the system. A user with local access can use this vulnerability to raise their privileges to root. An attacker wou...

CVE-2018-20449

The hidmachanstats function in drivers/dma/qcom/hidmadbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading "callback=" lines in a debugfs file...

CVE-2019-7524

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components...

CVE-2019-7524

In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components...

Directory traversal

log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session that can result in User to root privilege escalation. This attack appear to be exploitable via Malicious unprivileged user executes the vulnerable binary/remot...

Design/Logic Flaw

If HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root...

CVE-2017-16777

If HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root...

CVE-2017-15884

In HashiCorp Vagrant VMware Fusion plugin aka vagrant-vmware-fusion 5.0.0, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges...

Yet Another Linux Kernel Privilege-Escalation Bug Discovered

Security researchers have discovered a new privilege-escalation vulnerability in Linux kernel that could allow a local attacker to execute code on the affected systems with elevated privileges. Discovered by Venustech ADLab Active-Defense Lab researchers, the Linux kernel vulnerability...

Immunity Canvas: BRIGHTMAIL_RESTORE

Name| brightmailrestore ---|--- CVE| CVE-2017-6327 Exploit Pack| CANVAS Description| Symantec Brightmail Pre-Auth Command Injection Notes| CVE Name: CVE-2017-6327 VENDOR: http://symantec.com Notes: Tested on: Symantec Messaging Gateway 10.6.3 Appliance SPECIAL: on SMG versions = 10.6.3, our...

PT-2017-17288

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions prior to 10.1.1-234 Cisco Web Security Appliance WSA versions prior to 10.5.1-270 Description A vulnerability in the CLI parser could allow an authenticated, local attacker to perform command injection...

CVE-2017-9525

In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...

CVE-2017-9525

In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...

CVE-2017-9525: Improper Link Resolution Before File Access

In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...

QEMU: user-to-root privesc inside VM via bad translation caching

This is a security issue in the QEMU's system emulation for X86. The issue permits an attacker who can execute code in the guest ring 3 with normal user privileges to inject code into other processes that are running in guest ring 3, in particular root-owned processes. == reproduction steps ==...

PT-2017-17126

Name of the Vulnerable Software and Affected Versions MagniComp's Sysinfo versions prior to 10-H64 Description A local issue could allow an attacker to gain elevated privileges. Parts of the software require setuid-to-root access to access restricted system files and make restricted kernel calls,...

PT-2015-4210

Name of the Vulnerable Software and Affected Versions elfutils versions 0.152 through 0.161 Description The issue allows remote attackers to write to arbitrary files in the root directory via a crafted archive. This is achieved by exploiting a directory traversal vulnerability in the read long...

ContentKeeper Web Appliance < 125.10 Command Execution

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

frontaccounting 1.12 build 31 - Remote File Inclusion Vulnerability

0x01漏洞简介 FrontAccounting 1.12 Build 31的config.php中存在PHP远程文件包含漏洞。远程攻击者可以借助pathtoroot参数中的一个URL，执行任意PHP代码。 0x02漏洞分析 漏洞代码位于config.php文件中，如下所示： includeonce$pathtoroot . "/configdb.php"; includeonce$pathtoroot . "/includes/lang/language.php"; 参数$pathtoroot没有进行正确的处理，导致了文件包含漏洞的产生。 0x03漏洞利用...

PineApp Mail-Secure Command Execution

pineapp makes an anti-spam product, which can be downloaded for vmware, etc. the security of the product is a fucking joke, containing everything from authentication bypass to root exploits. there is really no hope, the developers didnt even try. they can patch those specific vulnerabilities, but...