CVE-2018-4387

A lock screen issue allowed access to photos via Reply With Message on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1...

XooGallery - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: XooGallery - Multiple SQL Injections Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://xooscripts.com/product/html5-php-photo-gallery.html Demo Site: http://xooscripts.com/demos/xoogallery/ Version: Lastest Tested on:...

XooGallery - Multiple SQL Injection

XooGallery - Multiple SQL Injection Exploit Title: XooGallery - Multiple SQL Injections Date: 26.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://xooscripts.com/product/html5-php-photo-gallery.html Demo Site: http://xooscripts.com/demos/xoogallery/ Version: Lastest Tested on: Ka...

Memory Corruption Vulnerability in Photo Lab Processing of phl Images

Photo Lab is a foreign photo viewing tool. A memory corruption vulnerability exists in Photo Lab's handling of phl images. An attacker can cause the program to crash by constructing a malformed phl image, which if successfully exploited can lead to arbitrary code execution...

Memory Corruption Vulnerability in Photo Lab Processing of psd Images

Photo Lab is a foreign photo viewing tool. A memory corruption vulnerability exists in Photo Lab's handling of psd images. An attacker can cause the program to crash by constructing a malformed psd image, which if successfully exploited can lead to arbitrary code execution...

Memory Corruption Vulnerability in Photo Lab's Processing of BMP Images

Photo Lab is a foreign photo viewing tool. Photo Lab suffers from a memory corruption vulnerability in the handling of BMP images, which can be exploited by an attacker to cause a program crash and execute arbitrary code by constructing a malformed BMP image...

Memory Corruption Vulnerability in Photo Lab's Processing of GIF Images

Photo Lab is a foreign photo viewing tool. Photo Lab suffers from a memory corruption vulnerability in the handling of GIF images, which can be exploited by an attacker to cause the program to crash and execute arbitrary code by constructing a malformed GIF image...

Memory Corruption Vulnerability in Photo Lab's Processing of png Images

Photo Lab is a foreign photo viewing tool. Photo Lab suffers from a memory corruption vulnerability in the handling of png images, which can be exploited by an attacker to cause the program to crash and execute arbitrary code by constructing a malformed png image...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.3.52 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Image Photo Gallery Final Tiles Grid plugin versions = 3.3.52. Solution Update the WordPress Image Photo Gallery Final Tiles Grid plugin to the latest available version at least 3.3.57...

Friday Squid Blogging: Sharp-Eared Enope Squid

Beautiful photo of a three-inch-long squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Cross-site Scripting (XSS)

modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...

CVE-2018-20755

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20755

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

Design/Logic Flaw

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20755

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20755

MODX Revolution (through v2.7.0-pl) is vulnerable to Cross-site Scripting (XSS) via the User Photo field. The root cause is improper handling of input in the user photo workflow (e.g., getProfilePhoto-related path) that allows injected scripts to be rendered in a user’s browser context. Exploitat...

Several Popular Beauty Camera Apps Caught Stealing Users' Photos

Just because an app is available on Google Play Store doesn't mean that it is a legitimate app. Despite so many efforts by Google, some fake and malicious apps do sneak in and land millions of unaware users on the hunting ground of scammers and hackers. Cybersecurity firm Trend Micro uncovered at...

Several Popular Beauty Camera Apps Caught Stealing Users' Photos

Just because an app is available on Google Play Store doesn't mean that it is a legitimate app. Despite so many efforts by Google, some fake and malicious apps do sneak in and land millions of unaware users on the hunting ground of scammers and hackers. Cybersecurity firm Trend Micro uncovered at...

Instagram Feed <= 1.11.3 - Unspecified Issues

The Smash Balloon Social Photo Feed WordPress plugin was affected by an Unspecified Issues security vulnerability...

CVE-2018-0722

Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device...