1072 matches found
CVE-2018-8823: Improper Control of Generation of Code
modules/bamegamenu/ajaxphpcode.php in the Responsive Mega Menu Horizontal+Vertical+Dropdown Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter...
mega-torrenty.pl Open Redirect vulnerability
Open Bug Bounty ID: OBB-413520 Description| Value ---|--- Affected Website:| mega-torrenty.pl Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...
USN-3414-1 qemu vulnerabilities
Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use this issue to elevate privileges inside the guest. CVE-2017-7493 Li Qiang discovered that QEMU incorrectly handled VMWare PVSCSI emulation. A privileged attacker inside the guest could use this...
A week in security (September 4 – September 10)
Last week, we looked into expired domain names being used for malvertising, delved into dubious Facebook apps, and checked out Chinese seminar scams. We also explained the whys and wherefores of false positives, explained what Google is doing with HTTPs, warned you away from a fake DHS email, and...
MEGA - Exported components, External URLs, Native code usage vulnerabilities
HackApp vulnerability scanner discovered that application MEGA published at the 'play' market has multiple vulnerabilities...
Mega-Like - External URLs, SD-card access, Unsafe deleting vulnerabilities
HackApp vulnerability scanner discovered that application Mega-Like published at the 'play' market has multiple vulnerabilities...
mega-soft.ru XSS vulnerability
Vulnerable URL: http://www.mega-soft.ru/goto.php?url=javascript:alert%28/OPENBUGBOUNTY/%29 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 602189 VIP website status:| No Check...
The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure
The vulnerability of the !megasashandledcmd function in the hw/scsi/megasas.c file of the QEMU hardware emulation software is related to a memory leak. Exploiting this vulnerability could allow an attacker, operating locally, to trigger a service failure memory consumption through specially craft...
UBUNTU-CVE-2017-5856
Memory leak in the megasashandledcmd function in hw/scsi/megasas.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service host memory consumption via MegaRAID Firmware Interface MFI commands with the sglist size set to a value over 2 Gb...
Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055
This module enables users to create menu items that render views instead of links. This is useful for creating "mega-menus". The module doesn't sufficiently filter title and breadcrumb fields for possible cross-site scripting. This vulnerability is mitigated by the fact that an attacker must have...
DEBIAN-CVE-2016-5107
The megasaslookupframe function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service out-of-bounds read and crash via unspecified vectors...
DEBIAN-CVE-2016-5105
The megasasdcmdcfgread function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface MFI command...
Hey, Music Lovers! Last.Fm Hack Leaks 43 Million Account Passwords
Another Day, Another Data Breach! If you love to listen to music online and have an account on Last.fm website, your account details may have compromised in a data breach that leaked more than 43 Million user personal data online. Last.fm was hacked in March of 2012 and three months after the...
Yahoo Investigates 200 Million Alleged Accounts For Sale On Dark Web
Yahoo says it is investigating reports of 200 million user credentials advertised for sale on the Dark Web by a hacker that goes by the handle “peaceofmind”. The Yahoo credentials, according to the site listing the database for sale, includes usernames, passwords hashed using the MD5 algorithm,...
mega-show.cn XSS vulnerability
Vulnerable URL: http://www.mega-show.cn/part1-en-exh-SME-Export-Marketing-Fund.php?cat=packaging" Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 23:03 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 12669059...
Pokémon GO Creator's Twitter Account Hacked — Pika, Pikaaaa!
Twitter account of another high-profile CEO has been hacked! This time, it's Niantic CEO John Hanke, the developer behind the world's most popular game Pokémon GO. And it seems like Hanke is so busy with its newly launched game Pokémon GO that he hasn't noticed or took any measures against it eve...
UBUNTU-CVE-2016-5107
The megasaslookupframe function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service out-of-bounds read and crash via unspecified vectors...
Mega Quiz ~ Pop Culture Game - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Mega Quiz Pop Culture Game published at the 'play' market has multiple vulnerabilities...
Mega Quiz - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities
HackApp vulnerability scanner discovered that application Mega Quiz published at the 'play' market has multiple vulnerabilities...