CVE-2010-1163

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a...

Windows XP Home Edition SP3 English calc.exe 37 bytes

Windows XP Home Edition SP3 English calc.exe 37 bytes. Shellcode exploit for win32 platform / Windows Xp Home edition SP3 english calc.exe 37 bytes shellcode by: Hazem mofeed The Shellcode: http://www.exploit-db.com/exploits/11598 Modified to working In SP3, Home: www.pentestlabs.com greetz:...

TLS Renegotiation Vulnerability: Proof of Concept Code (Python)

No description provided by source. I created a Camtasia Movie some time ago "exploiting" the vulnerability by injecting "/user/profile/E1/" into the first ssl request to "/" http://www.hacking-lab.com/download/ This can help others to understand the vulnerability. Regards Ivan -----Original...

CVE-2009-4358

freebsd-update in FreeBSD 8.0, 7.2, 7.1, 6.4, and 6.3 uses insecure permissions in its working directory /var/db/freebsd-update by default, which allows local users to read copies of sensitive files after a 1 freebsd-update fetch fetch or 2 freebsd-update upgrade upgrade operation...

CVE-2009-3894

Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in 1 the current working directory or 2 a certain subdirectory of the current working directory...

dstat privilege escalation

share libraries are searched in the working directory...

TCP may keep its offered receive window closed indefinitely (RFC 1122)

Overview Part of the Transmission Control Protocol TCP specification RFC 1122 allows a receiver to advertise a zero byte window, instructing the sender to maintain the connection but not send additional TCP payload data. The sender should then probe the receiver to check if the receiver is ready ...

Geany 0.18 Local File Overwrite

!/bin/sh redbull.sh AKA Geany 0.18 Local File Overwrite Exploit Jeremy Brown [email protected]//jbrownsec.blogspot.com//krakowlabs.com 10.06.2009 I was checking out some IDEs and decided on Geany. Nice interface, good features, but it doesn't defend against symbolic links when writing the run...

Geany .18 - Local File Overwrite

!/bin/sh redbull.sh AKA Geany 0.18 Local File Overwrite Exploit Jeremy Brown [email protected]//jbrownsec.blogspot.com//krakowlabs.com 10.06.2009 I was checking out some IDEs and decided on Geany. Nice interface, good features, but it doesn't defend against symbolic links when writing the run...

Report: Phishing and Scareware on The Rise

According to a report by the Anti-Phishing Working Group APWG, the number of phishing incidents and rogue anti-malware programs also known as scareware are rising at an “unprecedented rate”. The APWG says that around four fifths of the phishing attack websites claim to offer payment and financial...

Cross-Site Scripting vulnerability in eCaptcha

Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in eCaptcha plugin for E107. I found this hole in July 2008 and disclosed it at 25.09.2008. XSS: POST query at page http://site/path/ecaptcha/?key=b7c9bf99e763252105f047a5ca5681d0 scriptalertdocument.cookie/script in field...

Epiri Professional Web Browser 3.0 - Remote Crash

Epiri Professional Web Browser 3.0 - Remote Crash ' Title: Epiri Professional Web Browser 3.0 Remote Crash Exploit ' Vendor: Horizon ' Product Web Page: http://www.horizonum.com/ ' Current Version: 3.0.0.00 ' Notiz: Microsoft Silverlight ' Vulnerable Mode: Browse Internet ' Tested On Microsoft...

Ubuntu 6.06 LTS : blender vulnerabilities (USN-699-1)

It was discovered that Blender did not correctly handle certain malformed Radiance RGBE images. If a user were tricked into opening a .blend file containing a specially crafted Radiance RGBE image, an attacker could execute arbitrary code with the user's privileges. CVE-2008-1102 It was discovere...

GLSA-200904-07 : Xpdf: Untrusted search path

The remote host is affected by the vulnerability described in GLSA-200904-07 Xpdf: Untrusted search path Erik Wallin reported that Gentoo's Xpdf attempts to read the 'xpdfrc' file from the current working directory if it cannot find a '.xpdfrc' file in the user's home directory. This is caused by...

Inside the Conficker Working Group

From the Internet Storm Center The mere existence of the Conficker Working Group also known as the Conficker Cabal is something of a minor miracle. Security vendors do not have a long history of cooperating with each other, aside from the perhaps the antivirus companies sharing samples. But, as a...

GLSA-200903-41 : gedit: Untrusted search path

The remote host is affected by the vulnerability described in GLSA-200903-41 gedit: Untrusted search path James Vega reported that gedit uses the current working directory when searching for python modules, a vulnerability related to CVE-2008-5983. Impact : A local attacker could entice a user to...

Honeynet Project finds way to fingerprint Conficker infections

Just days ahead of an April 1st activation date for the Conficker worm, a pair of security researchers from the Honeynet Project have scored a major breakthrough, finding a way to remotely and anonymously fingerprint the malware on infected networks. Now, with the help of Dan Kaminsky and Rich...

BS.Player <= 2.34 Build 980 (.bsl) Local Buffer Overflow Exploit (SEH)

Exploit for unknown platform in category local exploits ====================================================================== BS.Player = 2.34 Build 980 .bsl Local Buffer Overflow Exploit SEH ====================================================================== ?php / Bs.Player = 2.34 Build 980...

BS.Player 2.34 Build 980 - '.bsl' Local Buffer Overflow (SEH)

?php / Bs.Player = 2.34 Build 980 .bsl local buffer overflow 0day exploit seh by Nine:Situations:Group::pyrokinesis Overlong hostnames in bsplayer playlist files causes eax and seh handlers to be overwritten. Cannot reliably debug with olly because of code compression, just used...

Google launching members-only security forum

internetnews.com’s Kenneth Corbin has the scoop on plans by Google to launch a members-only security forum for businesses, law enforcement, government agencies and others to combat malware and fraud on the Web. In addition to Google, the Internet Security Community will draw participation from...