kernel: unfiltered netdev rio_ioctl access by users

The rioioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call...

CVE-2012-3500

scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary 1 standard output or 2 standard error output file...

CVE-2012-3426

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by 1 creating new tokens through token chaining, 2 leveraging...

CVE-2012-2337

sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address...

DocuWiki 2012/01/25 CSRF / XSS

Exploit for php platform in category web applications DokuWiki Ver.2012/01/25 Latest Version CSRF Add User Exploit Discovered by : Khashayar Fereidani Team Website : HTTP://IRCRASH.COM IRCRASH Security Community Facebook : http://facebook.com/fereidani Twitter : https://twitter.com/!/IRCRASH...

DocuWiki 2012/01/25 Cross Site Request Forgery / Cross Site Scripting

DokuWiki Ver.2012/01/25 Latest Version CSRF Add User Exploit Discovered by : Khashayar Fereidani Team Website : HTTP://IRCRASH.COM IRCRASH Security Community Facebook : http://facebook.com/fereidani Twitter : https://twitter.com/!/IRCRASH Facebook Page :...

VMware多个产品本地权限提升漏洞

BUGTRAQ ID: 53006 CVE ID: CVE-2012-1518 VMware是一个“虚拟PC”软件，它使你可以在一台机器上同时运行二个或更多Windows、DOS、LINUX系统。 多个VMware产品在实现中存在本地权限提升漏洞，可被恶意用户利用以提升的权限在Windows客户端操作系统上执行任意代码。 0 VMWare VMWare Workstation 8.0.1 VMWare Player 4.0.1 VMWare Fusion 4.1.1 VMWare ESX 4.1 VMWare ESX 4.0 VMWare ESX 3.5 VMWare ESXi 5.0...

PYSEC-2012-31

libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat...

CVE-2011-4339

ipmievd aka the IPMI event daemon in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux RHEL 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this fil...

CVE-2011-0541

fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack...

DEBIAN-CVE-2011-1769

SystemTap 1.4 and earlier, when unprivileged aka stapusr mode is enabled, allows local users to cause a denial of service divide-by-zero error and OOPS via a crafted ELF program with DWARF expressions that are not properly handled by a stap script that performs context variable access...

sysstat insecure temporary file usage

The init script sysstat.in in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code...

CVE-2011-2200

The dbusheaderbyteswap function in dbus-marshal-header.c in D-Bus aka DBus 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service connection loss, obtain potentially sensitive...

Fedora 14 : mediawiki-1.16.5-59.fc14 (2011-6774)

MediaWiki 1.16.5 was released to correct two security flaws : The first issue is yet another recurrence of the Internet Explorer 6 XSS vulnerability that caused the release of 1.16.4. It was pointed out that there are dangerous extensions with more than four characters, so the regular expressions...

PT-2011-2964 · Microsoft · Windows Kernel-Mode Driver +6

Name of the Vulnerable Software and Affected Versions: Windows XP versions SP2 through SP3 Windows Server 2003 version SP2 Windows Vista versions SP1 through SP2 Windows Server 2008 versions Gold through R2 SP1 Windows 7 versions Gold through SP1 Description: The issue allows local users to gain...

CVE-2011-1548

The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated...

CVE-2011-0721

Multiple CRLF injection vulnerabilities in 1 chfn and 2 chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field...

PT-2011-2010 · Sudo · Sudo

Name of the Vulnerable Software and Affected Versions: sudo versions prior to 1.7.4p5-1.fc14 Description: The issue arises from improper interpretation of a system group in the sudoers file, allowing local users to gain root privileges via a sudo command. This is a result of a regression related ...

CVE-2010-2539

Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files...

CVE-2010-1958

Cross-site scripting XSS vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name...