5153 matches found
GitHub Security Lab: Initial websocket support for Javascript (SockJS)
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Go/CWE-643: XPath Injection Query in Go
This bug was reported directly to GitHub Security Lab...
AirDisk Pro 5.5.3 Persistent Cross Site Scripting
Document Title: =============== AirDisk Pro v5.5.3 iOS - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2203 Release Date: ============= 2020-04-15 Vulnerability Laboratory ID VL-ID:...
AirDisk Pro v5.5.3 iOS - Multiple Persistent Vulnerabilities
Document Title: =============== AirDisk Pro v5.5.3 iOS - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2203 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12129...
GitHub Security Lab: CPP: Out of order Linux permission dropping without checking return codes
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Java/CWE-036: Calling openStream on URLs created from remote source can lead to file disclosure
This bug was reported directly to GitHub Security Lab...
Command Injection
Overview adb-driver is a Universal Android USB Driver. Affected versions of this package are vulnerable to Command Injection. The argument command can be controlled by users without any sanitization. PoC var root = require"adb-driver"; root.execADBCommand' & touch Song'; the injection point is...
TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln
Posted by Maddie Stone, Project Zero INTRODUCTION I’m really interested in 0-days exploited in the wild and what we, the security community, can learn about them to make 0-day hard. I explained some of Project Zero’s ideas and goals around in-the-wild 0-days in a November blog post. On December’s...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2019-19911 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2019-19911 Source advisory: OSV:GHSA-5GM3-PX64-RW72...
django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-5313 via pillow (2.4.0)
pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-5313 Source advisory: OSV:GHSA-HJ69-C76V-86WR...
ImageMagick: excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c
ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions coders/tiff.c, which results in a hang tens of minutes with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file...
FIBARO System Home Center v5.021 Remote File Include XSS
Summary Imagine that you live in a house where everything happens by itself. FIBARO Smart Home takes care of your everyday comfort and safety of all family members and in the meantime, saves energy on every single occasion. All this is possible thanks to Home Center 2 smart home HUB. Home Center ...
GitHub Security Lab: CWE-094 ScriptEngine in java
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: XPath Injection query in java
This bug was reported directly to GitHub Security Lab...
[slackware-security] mozilla-firefox
New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.6.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...
GitHub Security Lab: Java (Maven): Actually fix the use of insecure protocol to download/upload artifacts
This bug was reported directly to GitHub Security Lab...
PHP-Fusion CMS 9.03 Cross Site Scripting
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-site Scripting XSS Vulnerabilities product: PHP-Fusion CMS vulnerable version: 9 - 9.03 fixed version: 9.03.30 CVE number: - impact: Medium homepage:...
[slackware-security] proftpd
New proftpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/proftpd-1.3.6c-i586-1slack14.2.txz: Upgraded. No CVEs assigned, but this sure looks like a security issue: Use-after-fr...