Apache Log4Shell RCE detection via callback correlation (Direct Check Telnet)

Binary data apachelog4jjdnildapgenerictelnet.nbin...

Apache Log4Shell RCE detection via callback correlation (Direct Check IMAP)

Binary data apachelog4shellimap.nbin...

Apache Log4Shell RCE detection via callback correlation (Direct Check POP3)

Binary data apachelog4shellpop3.nbin...

Apache Log4Shell RCE detection via callback correlation (Direct Check SMTP)

Binary data apachelog4shellsmtp.nbin...

Apache Log4Shell RCE detection via callback correlation (Direct Check SSH)

Binary data apachelog4shellssh.nbin...

pcl:ply_reader_fuzzer: Heap-buffer-overflow in void pcl::PLYReader::vertexListPropertyContentCallback<unsigned short>

Detailed Report: https://oss-fuzz.com/testcase?key=5756458652794880 Project: pcl Fuzzing Engine: afl Fuzz Target: plyreaderfuzzer Job Type: aflasanpcl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address: 0x61500569fe8c Crash State: void...

Apache Log4Shell RCE detection via callback correlation (Direct Check FTP)

Binary data log4jlog4shellftp.nbin...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

LogMePwn LogMePwn is a fully automated, multi-protocol, reliab...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

PoC exploit for CVE-2021-44228, a vulnerability in the Log4j Java library. The target product/service is Log4j, a Java logging library, and the vulnerability class/vector is a Remote Code Execution RCE vulnerability. The probable entry point is the "sendDetectionRequest" function in the...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228: Log4j / Log4Shell Security Research Summary...

Apache Log4Shell RCE detection via callback correlation (Direct Check HTTP)

Binary data apachelog4jjdnildapgenerichttpheaders.nbin...

CVE-2021-36760

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...

RUSTSEC-2021-0128 Incorrect Lifetime Bounds on Closures in `rusqlite`

The lifetime bound on several closure-accepting rusqlite functions specifically, functions which register a callback to be later invoked by SQLite was too relaxed. If a closure referencing borrowed values on the stack is was passed to one of these functions, it could allow Rust code to access...

CVE-2021-36760: Improper Neutralization of Input During Web Page Generation

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...

PT-2021-21342

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server version 5.7.0 Description A DOM-Based XSS attack is possible in the account recovery endpoint, affecting the callback parameter by modifying the URL that precedes it. Once the username or password reset procedure is...

WSO2 Identity Server 跨站脚本漏洞

WSO2 Identity Server IS is an identity server from WSO2, Inc. A security vulnerability exists in WSO2 Identity Server, which stems from the fact that in WSO2 Identity Server 5.7.0, a dom-based XSS attack can be executed that affects the callback parameter modifying the callback parameter before t...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . The WordPress plugin suffers from a cross-site scripting...

CVE-2021-24927: Improper Neutralization of Input During Web Page Generation

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mcpostlookup AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue...

ERC1155Supply vulnerability in OpenZeppelin Contracts

Handle defsec Vulnerability details Impact When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the ERC1155Supply extension, total supply is not updated until after the callback, thus during the callback the reported total...

UBUNTU-CVE-2021-3939

Ubuntu-specific modifications to accountsservice in patch file debian/patches/0010-set-language.patch caused the fallbacklocale variable, pointing to static storage, to be freed, in the userchangelanguageauthorizedcb function. This is reachable via the SetLanguage dbus function. This is fixed in...