CVE-2014-1419

Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors...

.NET Runtime Optimization Service Privilege Escalation Exploit 0day

No description provided by source. / Exploit Title: .NET Runtime Optimization Service Privilege Escalation Date: 03-07-2011 Author: XenoMuta [email protected] Version: v2.0.50727 Tested on: Windows XP sp3, 2003 R2, 7 CVE : n/a | |/ / / |/ / / / | / / / / /|/ / / / / / / / / / / / / // / / /...

Darxite 0.4 Login Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1598/info Darxite 0.4 does not do proper bounds checking on user-supplied data during the login process, relying on sprintf to deliver the data into a 256 character buffer. Therefore, it is possible for an attacker to...

Juergen Weigert screen 3.9 User Supplied Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1641/info Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to alter the contents of the...

LifeType 1.2.10 HTTP Referer stored XSS

No description provided by source. Exploit Title: lifetype 1.2.10 http referer XSS Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.php results in a cross site...

University of Washington Pico 3.x/4.x File Overwrite Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2097/info A vulnerability exists in several versions of University of Washington's Pico, a widely-distributed text editor shipped with most versions of Linux / Unix. Under very specific circumstances, it is possible to...

Linux Kernel 2.4/2.6 - sock_sendpage() ring0 Root Exploit (Simple Version)

No description provided by source. / 0x82-CVE-2009-2692 Linux kernel 2.4/2.6 32bit socksendpage local ring0 root exploit simple ver Tested RedHat Linux 9.0, Fedora core 411, Whitebox 4, CentOS 4.x. -- Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team. spender and venglin's...

openSUSE Security Update : sudo (openSUSE-SU-2010:0591-1)

sudo's handling of the -g command line option allowed to also specify -u in some cases, therefore allowing users to actually run commands as root CVE-2010-2956. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

CVE-2014-1737

The rawcmdcopyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device...

ThinkSAAS多处越权CSRF包含漏洞

简要描述： ThinkSAAS的SQL注入差不多了，剩下的就是很多越权，很多CSRF，还有几处包含漏洞了。 详细说明： ThinkSAAS的SQL注入差不多了，剩下的就是很多越权，很多CSRF，还有几处包含漏洞了，也一起发了吧，求给力哦，来个大厂商吧！ 第一处越权： Thinksaas在编辑文章内容时，没有判断此文章的发表用户，造成任意用户可修改任意用户文章内容。 来看看编辑文章的代码，/app/article/action/edit.php case "do" : $articleid = intval $POST 'articleid' ; $cateid = intval $POS...

Dahan-pass version of the jis Unified identity authentication system vulnerabilities package-vulnerability warning-the black bar safety net

For the system part of the function of the capture when found: POST: http://10.11.5.201:9080/jis/front/upduserdo.jsp CONTENT: cid=0 0 0 0 0&vcloginid=admin&vcpassword=1 2 3 4 5 6&vcpwd=1 2 3 4 5 6&vcusername=system...

WEBCrafted Cross Site Scripting

WEBCrafted Exploit Exploit By G4eL Exploit Title: WEBCrafted - Persistent XSS Google Dork: inurl:"/templates/webcrafted/" Date: 04/01/2014 Exploit Author: G4eL Software Link: http://www.bukkit.fr/index.php?/files/file/24-webcrafted-le-cms-minecraft/ Persistent XSS in users accounts Users...

VMSA-2013-0016:VMware ESXi and ESX unauthorized file access through vCenter Server and ESX

VMSA-2013-0016 VMware ESXi and ESX unauthorized file access through vCenter Server and ESX VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0016 VMware Security Advisory Synopsis: VMware ESXi and ESX unauthorized file access through vCenter Server and ESX VMware Security...

Cythosia 2.x Botnet (C2 Web Panel) - SQL Injection

Cythosia 2.x Botnet C2 Web Panel - SQL Injection Exploit Title: Cythosia Botnet SQL-Injection Vulnerability Date: 11.12.2013 Exploit Author: GalaxyAndroid Vendor Homepage: unkn0wn Application Screenshots http://www.xylibox.com/2012/08/cythosia-botnet-vnloader.html Version: 2.x Tested on: Windows ...

PT-2013-6044 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.11.5 Description: The issue is related to the fib6 add function in the Linux kernel, which does not properly implement error-code encoding. This allows local users with the CAP NET ADMIN capability to cause a...

CVE-2013-4288

Race condition in PolicyKit aka polkit allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to 1 the polkitunixprocessnew API function, 2 the dbus API, or 3 the --process...

Microsoft Internet Explorer CVE-2013-3205 Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a memory-corruption vulnerability due to a use-after-free error. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions. Microsoft Interne...

Command injection

The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to gain privileges via an unspecified sequence of commands, aka Bug ID CSCuc31764...

CVE-2013-0268

The msropen function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c...

CVE-2013-1276

Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kerne...