gnutls: Heap-buffer-overflow in read_attribute

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6667435805507584 Project: gnutls Fuzzer: libFuzzergnutlsopenpgpcertparserfuzzer Fuzz target binary: gnutlsopenpgpcertparserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux...

shopify-scripts: Integer Overflow in mrb_ary_set

Hi, I found a crash in mruby. I frankly couldn't reproduce it in mruby-engine. I think it is because of memory limitation, but I'm not sure. Here is a PoC when the size of MRBINT is 32. ruby ary = Array.new0 ary0x7fffffff = 1 $ gdb -q --args ./bin/mruby ./test.rb Reading symbols from...

Ubuntu’s Crash Report Tool Allows Remote Code Execution

No software is immune to being Hacked! Not even Linux. A security researcher has discovered a critical vulnerability in Ubuntu Linux operating system that would allow an attacker to remotely compromise a target computer using a malicious file. The vulnerability affects all default Ubuntu Linux...

Internet Bug Bounty: Invalid parameter in memcpy function trough openssl_pbkdf2

Upstream: https://bugs.php.net/bug.php?id=72776 Summary: ------------ When keylength parameter is greater than 0x7fffffff, size parameter is interpreted as negative in memcpy, inside PKCS5PBKDF2HMAC function libcrypto.so. This issue happens only in PHP 5.6 branch. PHP 7.0 avoids this issue trough...

Code injection

The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service GPS signal-acquisition delay via an incorrect xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 31470303 and external bug 211602 and...

Android system_server Code Loading Bypass Vulnerability

Exploit for Android platform in category local exploits Android: Code loading bypasses in systemserver As of Android Nougat, a new set of SELinux rules have been added which are designed to prevent systemserver from loading arbitrary code into its address-space. This has been enforced by adding t...

CVE-2016-9479

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request...

waikatobiodiversity.org.nz XSS vulnerability

Vulnerable URL: http://www.waikatobiodiversity.org.nz/viewimage.php?i=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Null pointer dereference

A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause ...

Internet Bug Bounty: Invalid memory access in zend_strtod() function

https://bugs.php.net/bug.php?id=73382...

Paragon Initiative Enterprises: BAD Code !

Hi sir, My name is Ahmed Kohly and I'm the biggest hacker on EGYPT, I'm also who hacked ISIS pages with my friend Ahmed Samara we are so dangerous. so don't trust me Please . Anyway, I've found that your code here https://github.com/paragonie/airship/blob/master/tools/audithelper.php , is startin...

Memcached 1.4.33 - PoC (1)

Exploit for linux platform in category dos / poc Source: http://paper.seebug.org/95/ import struct import socket import sys MEMCACHEDREQUESTMAGIC = "\x80" OPCODEPREPENDQ = "\x1a" keylen = struct.pack"!H",0xfa extralen = "\x00" datatype = "\x00" vbucket = "\x00\x00" bodylen = struct.pack"!I",0...

NVIDIA Driver - Escape Code Leaks Uninitialised ExAllocatePoolWithTag Memory to Userspace

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=892 The handler for the DxgkDdiEscape escape code 0x70000D4 has the following pseudocode: void fastcall escape70000D4NvMiniportDeviceContext a1, NvEscapeData a2 Escape70000D4 escapedata; // rbx@1 PVOID allocbuf; // rsi@1 unsigned i...

178.79.155.64 XSS vulnerability

Vulnerable URL: http://178.79.155.64/search/?searchType=all=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E&submit.x;=0&submit.y;=0 Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 12:10 GMT Vulnerability type:| XSS Vulnerability...

Boonex Dolphin 7.3 Authentication Bypass

Exploit Title : Boonex Dolphin all versoin array This will allow the attacker to bypass the authentication and can also enter in admin panel. Already communicated to dolphin developers. https://www.boonex.com/forums/topic/Security-Bug-High-Authentication-bypass.htm Independent Pakistani Security...

sherlock.scribblelive.com Open Redirect vulnerability

Vulnerable URL: https://sherlock.scribblelive.com/r?u=https://www.openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

CVE-2016-7042

The prockeysshow function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection gcc stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service stack memory corruption and panic by...

Internet Bug Bounty: crash in openssl_random_pseudo_bytes function

https://bugs.php.net/bug.php?id=73276...

Code injection

The NVIDIA MMC test driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28760138...

CVE-2016-3936

CVE-2016-3936 concerns the MediaTek video driver in Android prior to the 2016-10-05 patch level. A crafted application could exploit an elevation-of-privilege flaw in the MediaTek video driver (Android internal bug 30019037; MediaTek ALPS02829568) to gain privileges within the kernel. The issue i...