PayPal (Notify) - Bypass & Persistent Web Vulnerability

Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-21 Vulnerability...

Synology Drive File Sharing Notify Toast Cross-Site Scripting Vulnerability

Synology Drive is a collaboration suite from Synology that includes document management, collaboration and file synchronization and backup features.File Sharing Notify Toast is one of the file sharing components. A cross-site scripting vulnerability exists in File Sharing Notify Toast in Synology...

CVE-2018-8921

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

CVE-2018-8921

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

Cross site scripting

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

CVE-2018-8921

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

CVE-2018-8921

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

CVE-2018-8921

CVE-2018-8921 describes a cross-site scripting (XSS) vulnerability in Synology Drive’s File Sharing Notify Toast. Affected component: File Sharing Notify Toast within Synology Drive. The root cause is improper handling/sanitization of the file name, allowing remote authenticated users to inject a...

PT-2018-18719 · Synology · Synology Drive

Name of the Vulnerable Software and Affected Versions: Synology Drive versions prior to 1.0.2-10275 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via a malicious file name, exploiting a cross-site scripting XSS vulnerability in the File Sharing...

CVE-2017-13278

In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1...

CVE-2017-13278

CVE-2017-13278 affects Android’s MediaPlayerService::Client::notify in MediaPlayerService.cpp, with a use-after-free that can allow local elevation of privilege without extra execution privileges. Impacted Android versions: 6.0–8.1 (6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1). Description notes no u...

Google Android Local Elevation of Privilege Vulnerability (CNVD-2018-07863)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in MediaPlayerService::Client::notify in the MediaPlayerService.cpp file in Android. A local attacker can exploit this vulnerability...

Quagga BGP Backend Program NOTIFY Denial of Service Vulnerability

Quagga is an open source routing software. Quagga BGP backend program handling NOTIFY has a security vulnerability that allows remote attackers to exploit the vulnerability to submit special requests for denial-of-service attacks...

CVE-2018-5378

The Quagga BGP daemon bgpd prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash...

libreoffice/pptfuzzer: Bad-cast to SdrObject from invalid vptr in SdrEdgeObj::Notify

Detailed report: https://oss-fuzz.com/testcase?key=5651645263249408 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000103c9cb0 Crash State: Bad-cast to SdrObject...

PT-2018-16934 · Quagga +3 · Quagga +3

Name of the Vulnerable Software and Affected Versions: Quagga versions prior to 1.2.3 Description: The issue arises from improper bounds checking of data sent with a NOTIFY to a peer when an attribute length is invalid. This can lead to arbitrary data from the bgpd process being sent over the...

libreoffice/pptfuzzer: Heap-use-after-free in SdrObject::GetBroadcaster

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5695662168473600 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

libreoffice/pptfuzzer: Bad-cast to SdrObjectSdrEdgeObj::Notify in SfxBroadcaster::Broadcast

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=4773718837428224 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

libreoffice/pptfuzzer: Heap-use-after-free in SdrObject::GetBroadcaster

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5182633748201472 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-fre...

The vulnerability of the `nsImageLoadingContent::Notify` function in the Mozilla Firefox ESR browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nsImageLoadingContent::Notify function in Mozilla Firefox ESR is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...