PT-2020-18751

Name of the Vulnerable Software and Affected Versions Codoforum version 4.8.3 Description The issue allows for XSS in the user registration page, specifically through the username field when accessing the "index.php?u=/user/register" API endpoint. The payload can be executed on the...

Office Product Key Finder 1.5.4 - Denial of Service (PoC)

Office Product Key Finder 1.5.4 - Denial of Service PoC Exploit Title: Office Product Key Finder 1.5.4 - Denial of Service PoC Date: 2020-01-06 Vendor Homepage: http://www.nsauditor.com/ Software Link: http://www.nsauditor.com/downloads/officeproductkeyfindersetup.exe Exploit Author: Gokkul Teste...

UBUNTU-CVE-2019-20096

In the Linux kernel before 5.1, there is a memory leak in featregistersp in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b...

Linux kernel '__feat_register_sp()' function memory leak vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A memory leak vulnerability exists in the 'featregistersp' function in the net/dccp/feat.c file in versions of Linux kernel prior to 5.1. An attacker could exploit thi...

WordPress bbPress Login Register Links On Forum Topic Pages plugin <= 2.7.5 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability

CSRF to Stored XSS vulnerability found in WordPress bbPress Login Register Links On Forum Topic Pages plugin versions = 2.7.5. Solution Update the WordPress bbPress Login Register Links On Forum Topic Pages plugin to the latest available version at least 2.8.5...

CVE-2019-19602

A flaw was found in the Linux kernel. When compiled with GCC 9, a vector register corruption occurs on return from a signal handler where the top page of the signal stack had not yet been paged in which can allow a local attacker with special user privilege or root to leak kernel internal...

DEBIAN-CVE-2019-19583

An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service guest OS crash because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for DB...

Microsoft OAuth Flaw Opens Azure Accounts to Takeover

A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the app...

Modicon control devices REST API Information Disclosure

The vulnerability of Modicon microprogrammed controllers relates to the use of read commands from the REST API registers. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

UBUNTU-CVE-2019-19227

In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because registersnapclient may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregistersnapclient, aka CID-9804501fa122...

waterregister.vic.gov.au Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1020598 Security Researcher devl00p Helped patch 2703 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting waterregister.vic.gov.au...

DEBIAN-CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

UBUNTU-CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

Linux kernel information disclosure vulnerability (CNVD-2019-42534)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. An information disclosure vulnerability exists in Linux kernel 5.3.12 and earlier versions. The vulnerability stems...

PT-2019-4253

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.3.12 Description The issue in the Linux kernel's btrfs free extent function allows local users to obtain potentially sensitive information about register values via the dmesg program in a certain ENOENT case. Th...

CVE-2019-15803

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

UBUNTU-CVE-2007-3732

In Linux 2.6 before 2.6.23, the TRACEIRQSON function in iretexc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRACEIRQSON and before enabling interrupts, so that "current" references work. Without this, "current"...

kernel: memory leak in genl_register_family() in net/netlink/genetlink.c

A flaw was found in the genlregisterfamily function in the Linux kernel. An attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability...

CVE-2018-12386

A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR 60.2.2 and Firefox 62.0.3...