Apple Mac OSX Regex Engine (TRE) - Integer Signedness Overflow

Apple Mac OSX Regex Engine TRE - Integer Signedness Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=429 The OS X regex engine function tretnfarunparallel contains the following code: int tbytes; ... if !matchtags numtags = 0; else numtags = tnfa-numtags; ... i...

The vulnerability of the Oracle E-Business Suite system for automating business activities allows a perpetrator to breach the confidentiality of protected information.

The vulnerability of the Oracle Applications component in the Oracle E-Business Suite system’s automation activities is related to errors in the code of the AD Utilities sub-component. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality...

WordPress History Collection Plugin 1.1.1 download.php 任意文件下载

eLouai's Download ScriptERROR: download file NOT SPECIFIED. USE force-download.php?file=filepath"; exit; elseif ! fileexists $filename echo "eLouai's Download ScriptERROR: File not found. USE force-download.php?file=filepath"; exit; ; switch $fileextension case "pdf": $ctype="application/pdf";...

Adobe Flash - scale9Grid Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=380&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free issue if the scale9Grid setting is called on an object with a member that then frees display item. This issue occurs for...

CVE-2015-5523

The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service crash via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation...

RollJam — $30 Device That Unlocks Almost Any Car And Garage Door

We have talked a lot about car hacking. Recently researchers even demonstrated how hackers can remotely hijack Jeep Cherokee to control its steering, brakes and transmission. Now, researchers have discovered another type of car hack that can be used to unlock almost every car or garage door. You...

Newsletter 4.3 SQL Injection

------------------------ Exploit Title : Newsletter 4.3 SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage: www.conpresso.de - www.conpresso4.de Google Dork ONE: intext:Module Newsletter 4.3 Google Dork TWO: Module Newsletter 4.3 by www.conpresso4.de Date ...

mobiles4everyone.com XSS vulnerability

Open Bug Bounty ID: OBB-57103 Description| Value ---|--- Affected Website:| mobiles4everyone.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Security Update for Microsoft SharePoint Enterprise Server 2013 (KB2881078)

A security vulnerability exists in Microsoft SharePoint Enterprise Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

[SECURITY] [DLA 156-1] samba security update

Package : samba Version : 2:3.5.6dfsg-3squeeze12 CVE ID : CVE-2015-0240 Debian Bug : 779033 Richard van Eeden of Microsoft Vulnerability Research discovered that Samba, a SMB/CIFS file, print, and login server for Unix, contains a flaw in the netlogon server code which allows remote code executio...

kesionV8.0升9.0工具中被修改过加入后门

简要描述： 要是用到V8.0升9.0工具就会被入侵 详细说明： 直接从官方下载来的 KesionCMS V8.0升9.0工具 。 漏洞证明： 代码inc/include.asp和index.asp最后面的代码 这代码可干的事很多吧。 " Response.End End If StrLogText=StrLogText& sender Set Lzwudi=Server.CreateObject"Scripting.FileSystemObject" Set Lenovo=Lzwudi.OpenTextFileServer.MapPath"."&""&StrLogFile,8,True,...

ThinkPHP 3.0~3.2 SQL injection vulnerability in detail and use-vulnerability and early warning-the black bar safety net

! ThinkPHP 3.03.2 a target=SQL injection vulnerability in detail with the use of" style="border: 0px;" onload="return imgzoomthis,5 5 0;" onclick="javascript:window. openthis. src;" style="cursor:pointer;"/ 0x00 background thinkphp recent vulnerability frequency, this exploit belongs to the...

freakshare.com XSS vulnerability

Open Bug Bounty ID: OBB-52687 Description| Value ---|--- Affected Website:| freakshare.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

74cms(20141020)全局SQL注入过滤绕过

简要描述： 74cmsv3.5.120141020 绕过全局SQL注入过滤。 详细说明： WooYun: 74cms 最新版 注入8-9 报道过74cms转换编码导致的SQL注入的问题，是由于使用了iconv函数导致的，74cms做了修正，转而使用了自定义的函数utf8togbk来转换编码，代码如下： function utf8togbk$utfstr global $UC2GBTABLE; $okstr = ''; ifempty$UC2GBTABLE define'CODETABLEDIR',...

ncssa.info Open Redirect vulnerability

Open Bug Bounty ID: OBB-50496 Description| Value ---|--- Affected Website:| ncssa.info Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerable...

crazymatures.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-49904 Description| Value ---|--- Affected Website:| crazymatures.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

Cisco Prime Data Center Network Manager 6.x XSS (uncredentialed check)

According to its self-reported version number, the version of Cisco Prime Data Center Network Manager DCNM installed on the remote host is affected by a cross-site scripting vulnerability due to insufficient validation of input parameters by its web server component. Using a specially crafted URL...

zoombucks.com XSS vulnerability

Open Bug Bounty ID: OBB-48839 Description| Value ---|--- Affected Website:| zoombucks.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

CVE-2014-5194

Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the wordupperbound parameter...

Code injection

Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the wordupperbound parameter...