PHP MySQLi Database Class 2.9.2 SQL Injection

https://packagist.org/packages/joshcam/mysqli-database-class aka https://github.com/ThingEngineer/PHP-MySQLi-Database-Class v2.9.2 is vulnerable to SQL injection in functon Where because of special "forkaround" at line 971 If $whereValue happens to be an array, key value is used as $operator to...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in BEInt<unsigned char, 1>::set

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5760768497156096 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflo...

tidy-html5/tidy_fuzzer: Crash in GetSurrogatePair

Project: https://github.com/htacg/tidy-html5.git Detailed report: https://oss-fuzz.com/testcase?key=5741081738608640 Project: tidy-html5 Fuzzer: libFuzzertidy-html5tidyfuzzer Fuzz target binary: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: UNKNOWN READ Crash Address...

Process Hacker - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. System requirements Windows 7 or higher, 32-bit or 64-bit. Features A detailed overview of system activity with highlighting. Graphs and statistics allow you quickly to track down...

imagemagick/ping_dng_fuzzer: Use-of-uninitialized-value in std::__1::basic_streambuf<char, std::__1::char_traits<char> >::xsgetn

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5662852382195712 Project: imagemagick Fuzzer: libFuzzerimagemagickpingdngfuzzer Fuzz target binary: pingdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

libxls/fuzz_xls: Heap-buffer-overflow in xls_isCellTooSmall

Project: https://github.com/libxls/libxls.git Detailed report: https://oss-fuzz.com/testcase?key=5085850579238912 Project: libxls Fuzzer: afllibxlsfuzzxls Fuzz target binary: fuzzxls Job Type: aflasanlibxls Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x603000002008...

Cross-Site Scripting

Overview Versions of bootstrap-vue prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the options variable. This may lead to the execution of malicious JavaScript on the user's browser...

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/domainmod/domainmod Version: v4.09.03 to v4.11.01 CVE :...

DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting

Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/domainmod/domainmod Version: v4.09.03 to v4.11.01 CVE : CVE-2018-19750 A Stored Cross-site...

DomainMOD 4.11.01 - Custom SSL Fields Cross-Site Scripting

Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting Date: 2018-11-22 Exploit Author: Mohammed Abdul Raheem Vendor Homepage: domainmod https://domainmod.org/ Software Link: domainmod https://github.com/DomainMod/DomainMod Version: v4.09.03 to v4.11.01 CVE : CVE-2018-19751 A Stored Cross-site...

Denial of Service

Overview All versions of ircdkit are vulnerable to remote denial of service. Recommendation As no current fix is available if you rely on ircdkit in production it might be best to consider another module. References - GitHub Issue - GitHub Advisory...

Loofah -- XSS vulnerability

GitHub issue: This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported independently by Shubham Pathak and @yasinS Yasin Soliman. In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is...

CVE-2018-18025

In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file...

Gantry package 5.4.26 ,Other

Gantry package containing "Twig" library creates folders with improper folder permissions. On some servers this may lead to world writeable folders. see https://github.com/gantry/gantry5/issues/2363 https://github.com/twigphp/Twig/issues/2353 developer states not a security issue within their...

CVE-2018-16413

ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function...

CVE-2018-15161

The libesedbkeyappenddata function in libesedbkey.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments...

CVE-2018-15160

The libesedbcatalogdefinitionread function in libesedbcatalogdefinition.c in libesedb through 2018-04-01 allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. NOTE: the vendor has disputed this as described in the GitHub issue comments...

Universal Media Server XXE Vulnerability

In Universal Media Server UMS, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML external entity XXE processing attack. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

Oracle GlassFish 5.0 Demo Feature Default Credentials Vulnerability

Oracle GlassFish Server is using default credentials for the demo feature. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

skia/api_mock_gpu_canvas: Container-overflow in SkFindAndPlaceGlyph::ArbitraryPositions::nextPoint

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5097160457584640 Project: skia Fuzzer: aflskiaapimockgpucanvas Fuzz target binary: apimockgpucanvas Job Type: aflasanskia Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address:...