Authorization

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other...

CVE-2017-5622

CVE-2017-5622 (OnePlus 3/3T, OxygenOS prior to 4.0.3) describes a vulnerability where a charger connected to a powered‑off device enables adbd, allowing an attacker to open an ADB session without user authorization. The linked sources explain that OnePlus customized adbd to bypass ADB authorizati...

Design/Logic Flaw

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning...

Design/Logic Flaw

In Moodle 3.x, XSS can occur via evidence of prior learning...

CVE-2017-2644

In Moodle 3.x, XSS can occur via evidence of prior learning...

CVE-2017-2645

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning...

CVE-2017-2641

In Moodle 2.x and 3.x, SQL injection can occur via user preferences...

CVE-2017-2645

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning...

CVE-2017-2645

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning...

CVE-2017-2644

In Moodle 3.x, XSS can occur via evidence of prior learning...

CVE-2017-2644

In Moodle 3.x, XSS can occur via evidence of prior learning...

CVE-2017-2644

In Moodle 3.x, XSS can occur via evidence of prior learning...

CVE-2017-2641

In Moodle 2.x and 3.x, SQL injection can occur via user preferences...

CVE-2017-2644

CVE-2017-2644 affects Moodle 3.x and enables cross-site scripting via evidence of prior learning. It is a network‑based XSS with no authentication, requiring user interaction per CVSS, and results in partial integrity impact and low confidentiality impact. Public details indicate multiple advisor...

Microsoft Visual Studio 2015 update 3 - Denial of Service

/ Exploit Title: Microsoft Visual Studio 2015 update 3 – Stack overflow Date: 2017-03-26 Exploit Author: Peter Baris Vendor Homepage: http://www.saptech-erp.com.au Software Link: https://www.visualstudio.com/thank-you-downloading-visual-studio/?sku=Community&rel=15 Version: Visual Studio 2015...

CVE-2016-3178

The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service out-of-bounds memory access and daemon crash via vectors involving a negative length value...

EON 5.0 SQL Injection

CVE-2017-6088 EON 5.0 Multiple SQL Injection Description EyesOfNetwork "EON" is an OpenSource network monitoring solution. SQL injection authenticated The Eonweb code does not correctly filter arguments, allowing authenticated users to inject arbitrary SQL requests. CVE ID: CVE-2017-6088 Access...

CVE-2017-5623

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...

Command injection

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...

CVE-2017-5623

An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem bootmode rf/wlan/ftm/normal command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any...