PT-2018-4564 · Php +3 · Php +3

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 7.3.0alpha3 PHP versions prior to 7.2.8 PHP versions prior to 7.1.20 Description: An issue was discovered where the php-fpm master process restarts a child process in an endless loop when using program execution function...

EPIC MyChart - X-Path Injection

Exploit Title: Epic Systems Corporation MyChart X-Path Injection Google Dork: MyChart® licensed from Epic Systems Corporation Date: 8/19/16 Exploit Author: Shayan Sadigh http://threat.tevora.com/author/shayan/ Vendor Homepage: https://www.epic.com/software Software Link: N/A Version: N/A Tested o...

CVE-2018-6910

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...

Authentication flaw

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to...

CVE-2018-1163

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to...

Netgear WNR1000v3 Cross Site Request Forgery

Exploit Title: NETGEAR WNR1000v3 Router Cross-Site Request Forgery CSRF Date: 03/02/2018 Exploit Author: Sajibe Kanti Author Contact: https://twitter.com/@sajibekantibd Vendor Homepage: http://netgear.com/ Version: WNR1000v3 , Firmware Version V1.0.2.7260.0.96 Tested on Windows 10 Technical Detai...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4020)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4020 advisory. - x86: Use PREDCMD MSR when ibpb is enabled Konrad Rzeszutek Wilk Orabug: 27369777 CVE-2017-5715 CVE-2017-5753 - x86/spec: Dont print the Missing...

Unbreakable Enterprise kernel security update

2.6.39-400.298.2 - x86: Use PREDCMD MSR when ibpb is enabled Konrad Rzeszutek Wilk Orabug: 27369777 CVE-2017-5715 CVE-2017-5753 - x86/spec: Dont print the Missing arguments for option spectrev2 Konrad Rzeszutek Wilk Orabug: 27369777 CVE-2017-5715 CVE-2017-5753 - x86: Move ENABLEIBRS in the...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0012) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert 'kernel.spec: Require the new microcodectl.' Brian Maly - xen-blkback: add pendingreq allocation stats Ankur Arora Orabug: 27386890 - xen-blkback: move indirect req allocation out-of-line Ankur...

Yelp: ClickJacking on IMPORTANT Functions of Yelp

SUMMARY: Few Important function of yelp.com are vulnerable to ClickJacking Attack. DESCRIPTION: Please have an Introduction about the vulnerability Type: https://en.wikipedia.org/wiki/Clickjacking ClikcJacking is similar to CSRF with just an extra involvement of the victim to click somewhere on t...

(0Day) Quest NetVault Backup Server checksession Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to critical...

CVE-2018-5697

Icy Phoenix 2.2.0.105 allows SQL injection via an unapprove request to adminkbart.php or the order parameter to adminjradmin.php, related to functionskb.php...

Microsoft Edge Chakra JIT Op_MaxInAnArray / Op_MinInAnArray Misuse

Microsoft Edge: Chakra: JIT: OpMaxInAnArray and OpMinInAnArray can explicitly call user defined JavaScript functions CVE-2017-11893 1. Call patterns like "Math.max.applyMath, 1, 2, 3, 4, 5" and "Math.max.applyMath, arr" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" i...

Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions

Microsoft Edge Chakra JIT - OpMaxInAnArray and OpMinInAnArray can Explicitly call User-Defined JavaScript Functions / 1. Call patterns like "Math.max.applyMath, 1, 2, 3, 4, 5" and "Math.max.applyMath, arr" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" in the Inline...

Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions

/ 1. Call patterns like "Math.max.applyMath, 1, 2, 3, 4, 5" and "Math.max.applyMath, arr" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" in the Inline Phase. 2. The method takes the original method "Math.max" as the first parameter and the arguments object as the seco...

Buffer overflow

rust-base64 version = 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the 'encodeconfigbuf' and 'encodeconfig' functions...

WordPress Payment Form for PayPal Pro Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Payment Form for PayPal Pro plugin is used in one of the payment plugin. WordPress Payment Form for PayPal Pro...

CVE-2017-13098

Bouncy Castle TLS prior to 1.0.3, when configured to use the JCE for cryptographic operations, is vulnerable to a Bleichenbacher/ROBOT oracle when RSA key exchange is negotiated. An attacker could use this to recover the private key from a vulnerable application. Affected: Bouncy Castle TLS (Java...

Microsoft Office Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special...

Internet Bug Bounty: Exim use-after-free vulnerability while reading mail header involving BDAT commands

Original article is here Use-after-free in receivemsg leads to RCE Vulnerability Analysis To explain this bug, we need to start with the memory management of exim. There is a series of functions starts with store such as storeget, storerelease, storereset. These functions are used to manage...