CVE-2017-1002016

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

CVE-2017-1002016

CVE-2017-1002016 affects the WordPress plugin flickr-picture-backup (v0.7). The vulnerability arises in flickr-picture-download.php, which does not verify user authentication or permissions before handling file uploads, enabling unauthenticated arbitrary file upload. Public sources (NVD, Red Hat,...

CVE-2017-1002016

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

CVE-2017-1002016: Unrestricted Upload of File with Dangerous Type

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files...

Login-Reg Members Management PHP 1.0 - Arbitrary File Upload

Login-Reg Members Management PHP 1.0 - Arbitrary File Upload Exploit Title: Login-Reg Members Management PHP 1.0 - Arbitrary File Upload Dork: N/A Date: 28.08.2017 Vendor Homepage : https://www.codester.com/user/mostalo Software Link:...

Android 8.0 Oreo Released – 11 New Features That Make Android Even Better

While the moon was eclipsing the sun, Google announced the launch of its new mobile operating system called Android 8.0 Oreo in an Eclipse-themed launch event in New York City. Yes, the next version of sugary snack-themed Android and the successor to Android Nougat will now be known as Android...

EggShell - iOS/macOS Remote Administration Tool

EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python. This tool creates 1 line multi stage payloads that give you a command line session with extra functionality. EggShell gives you the power and convenience of uploading/downloading files, taking pictures,...

DeWorkshop 1.0 Arbitrary File Upload

Exploit Title: DeWorkshop 1.0 - Arbitrary File Upload Dork: N/A Date: 18.08.2017 Vendor Homepage : https://sarutech.com/ Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737 Demo: https://demo.sarutech.com/deworkshop/ Version: 1.0 Category: Webapps Tested on:...

Legal Robot: Unable to change profile picture

Unable to change profile picture.Functionality issue...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. These attacks can be performed if a web service with the file upload function is available. Attackers can perform XSS attacks through the upload of a profile picture...

ImageMagick Denial of Service Vulnerability (CNVD-2017-15116)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A denial of service vulnerability exists in the 'ReadDPXImage' function of the coders\dpx.c file in ImageMagick versio...

Song Song picture management system backstage exists universal password login vulnerability

Song Song picture management system using ASP + ACCESS + DIV + CSS + AJAX development, can be configured in support of ASP environment of any host. Song Song picture management system V8 version of the /admin/adminlogincheck.asp page there is a universal password login vulnerability. Attackers ca...

From PhantomJS picture rendering of XSS vulnerabilities to the SSRF/local file read vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently I was invited to study a vulnerability reward project, this project can be based on user input to generate a picture, in order for users to download. After a period time of exploring, I found a way to exploit the path, you can use the picture inside theXSSthe vulnerability ...

Exif-Remove - Command Line Tool- Remove Exif Data from all Digital Pictures

This tool is made in Python 2.7 compiled using pyinstaller for Windows OS. Nothing is special about this tool it just eases the work for me, maybe will for you too. For what reason? Exif is Metadata stored in hidden in your pictures. Many well-intentioned people unwittingly expose personal...

The vulnerability of the MPEG-4 AVC software platform, Flash Player, allows attackers to execute arbitrary code.

The vulnerability of the MPEG-4 AVC software platform, Flash Player, arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code memory corruption remotely...

GraphicsMagick 'ReadDPXImage()' Denial of Service Vulnerability

GraphicsMagick has been called the Swiss Army Knife of image processing. The short and compact code provides a robust and efficient collection of tools and libraries to handle reading, writing and manipulating images, supporting over 88 image formats, including the important DPX, GIF, JPEG,...

CVE-2017-10794

When GraphicsMagick 1.3.25 processes an RGB TIFF picture with metadata indicating a single sample per pixel in coders/tiff.c, a buffer overflow occurs, related to QuantumTransferMode...

CVE-2017-10794

When GraphicsMagick 1.3.25 processes an RGB TIFF picture with metadata indicating a single sample per pixel in coders/tiff.c, a buffer overflow occurs, related to QuantumTransferMode...

eurodragster.com XSS vulnerability

Vulnerable URL: http://eurodragster.com/news/features/websterraceengineering/picture.asp?picture=1/-///'/"//--...

Facebook’s new feature to prevent misuse of profile pics

By Waqas The social media giant Facebook is introducing a new feature for users in India which will help them protect their online privacy by preventing others from misusing their profile picture. The feature is called Profile Picture Guard and is being rolled out after security and privacy...