3819 matches found
Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
The IonMonkey just-in-time JIT compiler can leak an internal JSOPTIMIZEDOUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird...
Magic AirMusic Insufficient Access Control Vulnerability
Various products of multiple vendors using the Magic AirMusic web interface for the control of the device are prone to an insufficient access control vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...
file/magic_fuzzer: Use-of-uninitialized-value in mprint
Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=5634761748381696 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzermsanfile Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...
TROMMEL - Sift Through Embedded Device Files To Identify Potential Vulnerable Indicators
TROMMEL sifts through embedded device files to identify potential vulnerable indicators. TROMMEL identifies the following indicators related to: Secure Shell SSH key files Secure Socket Layer SSL key files Internet Protocol IP addresses Uniform Resource Locator URL email addresses shell scripts w...
PHP 7.0.x < 7.0.5 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.5. It is, therefore, affected by multiple vulnerabilities : - A buffer over-write condition exists in the finfoopen function due to improper validation of magic files. An unauthenticated, remote...
LIM OpenEXR Buffer Overflow Vulnerability
LIM OpenEXR is an image file format developed by Industrial Light and Magic LIM in the United States for high dynamic range HDR images. A security vulnerability exists in the makeMultiView.cpp file for exrmultiview in LIM OpenEXR version 2.3.0. An attacker can exploit this vulnerability to cause ...
Shopify: H1514 Server Side Template Injection in Return Magic email templates?
Summary: Possible template injection in return magic email templates. Description: I've been playing with return magic workflow email templates and there seems to be some kinda of template injection but I am not sure if it's exploitable or even valid. Here is why I think it could be vulnerable: I...
Shopify: H1514 Stored XSS in Return Magic App portal content
Summary: Stored XSS vulnerability was found in return magic app portal content which executes in the application domain in https://services.alveo.io/dashboard-shopify/settings/portal/content Description: It's been found that Return Magic app allows users to add HTML content to their return portal...
2018 Flare-On Challenge Solutions
We are pleased to announce the conclusion of the fifth annual Flare-On Challenge. The numbers are in and we can safely say that this was by far the most difficult challenge we’ve ever hosted. We plan to reduce the difficulty next year, so it may be that the 114 people who solved this year’s...
Malwoverview - Tool To Perform An Initial And Quick Triage On Either A Directory Containing Malware Samples Or A Specific Malware Sample
Malwoverview.py is a simple tool to perform an initial and quick triage on a directory containing malware samples not zipped. This tool aims to : 1. Determining similar executable malware samples PE/PE+ according to the import table imphash and group them by different colors pay attention to the...
h1-5411-CTF: H1-5411 CTF Write-up by erbbysam and ziot
@erbbysam and I recently set out to beat the latest CTF challenge hosted by HackerOne. Here is a write-up with the process we took from start to finish. The h1-5411 CTF begins with a tweet from HackerOne: https://twitter.com/Hacker0x01/status/1044974142150373378 F351665 This leads to a website...
Memory Corruption Vulnerability in Softmedia Icon Master, Softmedia Magic, Qingdao (CNVD-2018-19757)
Softmedia Icon Master is an icon management software with functions such as icon extraction, icon replacement, icon format conversion and icon cache repair. There is a memory corruption vulnerability in Softmedia Icon Master, which allows an attacker to cause the program to crash by constructing...
Microsoft Edge Chakra JIT InlineArrayPush Type Confusion
Microsoft Edge: Chakra: JIT: Type confusion with InlineArrayPush This is similar to issue 1531 . The patch seems to prevent type confusion triggered from StElemIA instructions. But the SetItem method can also be invoked through the Array.prototype.push method which can be inlineed. We can achieve...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
magic-duels.gamerch.com XSS vulnerability
Open Bug Bounty ID: OBB-647172 Description| Value ---|--- Affected Website:| magic-duels.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
USN-3686-1 file vulnerabilities
Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2014-9620 Alexander Cherepanov discovered that file incorrectly handled certain long strings. An...
Microsoft Edge Chakra JIT - Magic Value Type Confusion Exploit
Exploit for windows platform in category dos / poc / BOOL JavascriptNativeFloatArray::SetItemuint32 index, double dValue if uint64&dValue == uint64&JavascriptNativeFloatArray::MissingItem JavascriptArray varArr = JavascriptNativeFloatArray::ToVarArraythis; varArr-DirectSetItemAtindex,...
Microsoft Edge Chakra JIT - Magic Value Type Confusion
/ BOOL JavascriptNativeFloatArray::SetItemuint32 index, double dValue if uint64&dValue == uint64&JavascriptNativeFloatArray::MissingItem JavascriptArray varArr = JavascriptNativeFloatArray::ToVarArraythis; varArr-DirectSetItemAtindex, JavascriptNumber::ToVarNoCheckdValue, GetScriptContext; return...