CVE-2018-14731

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

@dailybruin/lux (>=1.0.0, <=1.0.4), @dsbn/slate (0.0.1) +18 more potentially affected by CVE-2018-14731 via parcel-bundler (>=1.2.0, <=1.9.7)

parcel-bundler NPM version =1.2.0, =1.0.0, =1.1.0, =0.2.5, =1.0.0-alpha.2, =1.0.0-alpha.2, =0.0.12, =1.2.1, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2018-14731 Source advisory: MEND:CVE-2018-14731...

CVE-2018-14731: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

PT-2018-12688

Name of the Vulnerable Software and Affected Versions parcel-bundler versions prior to 1.10.0 Description An issue in HMRServer.js allows attackers to steal a developer's code due to the lack of origin validation on the WebSocket server used for Hot Module Replacement HMR. This enables anyone to...

hermesparcelreturn.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-635789 Description| Value ---|--- Affected Website:| hermesparcelreturn.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-13289

In writeToParcel and createFromParcel of RttManager.java, there is a permission bypass due to a write size mismatch. This could lead to a local escalation of privileges where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is...

CVE-2017-13287

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed f...

Input validation

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed f...

CVE-2017-13287

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed f...

CVE-2017-13287

CVE-2017-13287 is an Elevation of Privilege vulnerability in Android’s VerifyCredentialResponse.java. In createFromParcel, there is a possible invalid parcel read caused by insufficient input validation. If mPayload in writeToParcel is null, this could allow a local attacker to escalate privilege...

CVE-2017-13287

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed f...

Google Android System Elevation of Privilege Vulnerability (CNVD-2018-07452)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation vulnerability exists in the writeToParcel and readFromParcel of the PeriodicAdvertisingReport.java file in Android versions 8.0 and 8.1. A local attacker can exploit...

Google Android Local Elevation of Privilege Vulnerability (CNVD-2018-07851)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation vulnerability exists in the writeToParcel and readFromParcel of the OutputConfiguration.java file in Android versions 8.0 and 8.1. A local attacker can exploit this...

CVE-2017-13287: Improper Input Validation

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed f...

Threat Outbreak Alert RuleID29835: Email Messages Distributing Malicious Software on July 17, 2017

Medium Alert ID: 54505 First Published: 2017 July 17 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29835 may contain the following files: Name | Siz...

Android: Ashmem race conditions in android.util.MemoryIntArray (CVE-2017-0412)

The MemoryIntArray class allows processes to share an in-memory array of integers by transferring an ashmem file descriptor. As the class implements the Parcelable interface, it can be passed within a Parcel or a Bundle and transferred via binder to remote processes. Instead of directly tracking...

Threat Outbreak Alert RuleID28606: Email Messages Distributing Malicious Software on April 4, 2017

Medium Alert ID: 53332 First Published: 2017 April 4 17:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28606 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID28590: Email Messages Distributing Malicious Software on April 3, 2017

Medium Alert ID: 53309 First Published: 2017 April 3 19:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28590 may contain the following files: Name | Siz...

Parcel Delivery Booking Script 1.0 - SQL Injection

Parcel Delivery Booking Script 1.0 - SQL Injection Exploit Title: Parcel Delivery Booking Script v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: http://www.eaglescripts.com/parcel-delivery-booking-script Demo:...

Parcel Delivery Booking Script 1.0 - SQL Injection

Exploit Title: Parcel Delivery Booking Script v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: http://www.eaglescripts.com/parcel-delivery-booking-script Demo: http://parceldelivery.phpscriptsdemo.com/ Version: 1.0 Tested on: Win7 x64,...