CVE-2019-2389

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11;...

WordPress Plugin Soliloquy Lite 2.5.6 - Persistent Cross-Site Scripting

Exploit Title: Wordpress Soliloquy Lite 2.5.6 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\soliloquy-lite" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://soliloquywp.com/ Software Link: https://wordpress.org/plugins/soliloquy-lite/ Version: 2.5.6...

Unspecified Vulnerability in Oracle Java SE and Java SE Embedded (CNVD-2019-37220)

Java SE is short for Java Platform Standard Edition, for the development and deployment of desktop, server, and embedded devices and real-time environment of Java applications. Java SE Embedded is based on Java SE, and provides specific features and support for embedded systems. An unspecified...

How to Scale Addressable Advertising with Low Latency for Live Streaming

Written by: David Springfall, Founder and CTO of Yospace Under David's technical and strategic leadership, Yospace pioneered server-side ad insertion and established itself as the global leader in OTT stream monetisation. The Yospace technology supports full one-to-one personalisation and provide...

X (Formerly Twitter): Periscope-all Firebase database takeover

Hello, I found one public Firebase database of periscope.tv and I can able to insert data to this database and i only used it once for the testing purposes, so other database queries also possible. Please follow the below link to check the inserted test data. Periscope-all Firebase URL :-...

CVE-2019-1923

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...

Cross-site Scripting (XSS)

mantisbt is vulnerable to cross-site scripting XSS. The attack exists because the function stringinserthrefs does not check the protocol, allowing an attacker to inject 'javascript://' to execute arbitrary code...

CVE-2019-11872

The Hustle aka wordpress-popup plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the...

Linux kernel memory leak vulnerability

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory disclosure vulnerability exists in coninsertunipair in drivers/tty/vt/consolemap.c in Linux kernel 5.1.5 and...

Broadcast Operations Control Center (BOCC): Enabling OTT Broadcast Operations

So, what is the BOCC? Simply put, Akamai runs a state-of-the-art Broadcast Operations Control Centre, the BOCC, to help ensure smooth and seamless end-user play-back experience for live OTT Over the Top and linear video delivered through Akamai Media Delivery Solutions. To phrase it more...

CVE-2017-18275

CVE-2017-18275 is a local, command-injection style vulnerability affecting the simContacts service on Snapdragon-based devices (Automobile, Mobile, Wear) across numerous SD/SoC revisions. Exploitation would enable a new account insertion via the Android command line, with attack vector LOCAL, low...

Function Call with Incorrectly Specified Arguments

Overview Affected versions of this package are vulnerable to Function Call with Incorrectly Specified Arguments. A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were...

CVE-2019-7303

A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl2 commands on a 64-bit platform; however, the Linux kernel only uses the lower 32...

[SECURITY] Fedora 30 Update: containers-0.8.0-8.alpha.9.fc30

Efficient library to use collection in D. Value insertion can be up to 200 time faster than method provided by the standard library Phobos...

Oracle E-Business Suite CRM Technical Foundation Component Access Control Error Vulnerability

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. CRM Technical Foundation is one ...

Akamai's Adaptive Media Player Advances for NAB 2019, Adding Header Bidding and Ultra Low Latency

Introduction Akamai Adaptive Media Player AMP helps publishers insert quality media playback experiences into web, mobile, and connected-TV applications. Publishers can leverage Akamai AMP for a single, modular SDK that pre-integrates playback, delivery, monetization, and measurement to ensure a...

TCPDF 6.2.19 Deserialization / Remote Code Execution

CVE-2018-17057: phar deserialization in TCPDF might lead to RCE --------------------------------------------------------------- Affected products ================= TCPDF While it is a nice feature to have for the developer, it may cause problems in case the PDF creation script is vulnerable to...

SQL Injection Vulnerability in Website Building System of Guangzhou Ju Teng Information Technology Co.

Guangzhou Ju Teng Information Technology Co., Ltd. specializes in website planning, production, promotion and network system development. Guangzhou Ju Teng Information Technology Co., Ltd. station building system there are SQL injection vulnerabilities, the attacker to take advantage of the...

Linux/x86 - INSERTION Encoder / Decoder execve(/bin/sh) Shellcode (88 bytes)

/ ''' ; Date: 07/03/2019 ; Insertion-Encoder.asm ; Author: Daniele Votta ; Description: This program encode shellcode with insertion technique 0xAA. ; Tested on: i686 GNU/Linux ''' !/usr/bin/python Python Insertion Encoder import random Execve /bin/sh 25 bytes shellcode...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-06339)

Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in the header insertion field in Craft CMS version 3.1.12 Pro. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...