CVE-2018-15761

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their...

Homebrew: GitHub API Key for BrewTestBot is publicly exposed

Hello! While browsing through some old reports, I found that https://jenkins.brew.sh was publicly accessible. I got curious when I saw one of the brew bottle builds doing a git push to BrewTestBot/homebrew-core, and wondered if the credentials to make authenticated pushes were accessible. Sure...

DEBIAN-CVE-2018-11693

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skipoverscopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

CVE-2018-10550

In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to...

CVE-2018-10550

In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to...

CVE-2018-10550

In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to...

CVE-2018-7996

Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)

Exploit for windows platform in category dos / poc / Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: / // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; +...

Microsoft Edge Chakra Deferred Parsing

Microsoft Edge: Chakra: Deferred parsing makes wrong scopes 2 CVE-2018-0775 Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: // Enable the flag using '\n'.repeat0x1000 evalfunction f with function...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes 2 / Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: / // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; +...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)

/ Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to issue 1310 . PoC: / // Enable the flag using '\n'.repeat0x1000 evalfunction f with function printf; ; ; + '\n'.repeat0x1000; PoC 2: // ./ch poc.js -ForceDeferParse...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes GetFuncExprNameReference || funcInfo-funcExprScope && funcInfo-funcExprScope-GetIsObject ... Js::RegSlot ldFuncExprDst = sym-GetLocation; this-mwriter.Reg1Js::OpCode::LdFuncExpr, ldFuncExprDst; if sym-IsInSlotfuncInfo Js::RegSlot...

CVE-2016-5172

The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...

CVE-2016-5172

CVE-2016-5172 : The V8 parser used in Google Chrome/Chromium mishandles scopes, enabling a remote attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript. Affected product scope includes Google Chrome and Chromium builds prior to 53.0.2785.113. Remediation ...

CVE-2016-5172

The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...

Google Chrome < 49.0.2623.75 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 201603stable-channel-update advisory. - Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers...

Shopify: Apps can access 'channels' beta api

Hello, As documented here, an app can access to the following scopes : https://docs.shopify.com/api/authentication/oauthscopes. But an app can request/get access to a lots more scopes, and some of those scope shouldn't be accessible. PoC...

CVE-2014-7922

CVE-2014-7922 involves the GoogleAuthUtil.getToken method in the Google Play services SDK prior to 2015. The vulnerability arises when the code sets parameters in OAuth token requests after detecting a corresponding opt parameter in the Bundle extras argument, enabling a crafted application to by...

CVE-2014-7922

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

Gnupg2 Information Disclosure Vulnerability

GnuPG is a Python module that allows, from a Python program, to conveniently use the key management, encryption and signing features of GnuPG. GnuPG memcpy uses overlapping scopes, allowing attackers to exploit vulnerabilities to obtain sensitive information...