Arbitrary Code Execution

icedtea-web is vulnerable to arbitrary code execution. The vulnerability exists as a flaw was discovered in the JNLP Java Network Launching Protocol implementation in IcedTea-Web. An unsigned Java Web Start application could use this flaw to manipulate the content of a Security Warning dialog box...

Spoofing Attack

ibm java is vulnerable to spoofing attack. A remote attacker is able to trick a user into trusting a signed applet by misrepresenting the security warning dialog...

Photon OS 2.0: Libpcap PHSA-2019-2.0-0187

An update of the libpcap package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Python2 PHSA-2019-1.0-0257

An update of the python2 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0257. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2019-17605

A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account by also exploiting CVE-2019-17604 via a modified candidate id and an additional password parameter. The outcome is that the password of this other candidate is chang...

Google Chrome < 77.0.3865.120 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 77.0.3865.120. It is, therefore, affected by multiple vulnerabilities as referenced in the 201910stable-channel-update-for-desktop advisory. - Use after free in JavaScript in Google Chrome prior to 77.0.3865.120 allowed a...

CVE-2019-12204

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...

graphicsmagick:coder_SFW_fuzzer: Heap-buffer-overflow in GenerateEXIFAttribute

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5711632855990272 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderSFWfuzzer Job Type: libfuzzerasani386graphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ...

IBM WebSphere Portal XSS Vulnerability (CVE-2018-1673)

The version of IBM WebSphere Portal installed on the remote Windows host is affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a...

Thousands of Google Calendars Possibly Leaking Private Information Online

"Warning — Making your calendar public will make all events visible to the world, including via Google search. Are you sure?" Remember this security warning? No? If you have ever shared your Google Calendars, or maybe inadvertently, with someone that should not be publicly accessible anymore, you...

CVE-2019-12105

CVE-2019-12105 – Summary (supported by provided docs) In Supervisor up to 4.0.2, an unauthenticated user can read log files or restart a service. The inet_http_server component is not enabled by default, but if a user enables it and does not set a password, Supervisor logs a warning. The open-ser...

Google Chrome < 76.0.3809.100 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 76.0.3809.100. It is, therefore, affected by multiple vulnerabilities as referenced in the 201908stable-channel-update-for-desktop advisory. - Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allow...

Microsoft Word (2016) Deceptive File Reference

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt + ISR: ApparitionSec + Zero Day Initiative Program Vendor www.microsoft.com Product Microsoft Word 2016 Vulnerability Type...

Win 10 arbitrary file deletion 0day warning-vulnerability warning-the black bar safety net

! 0x00 vulnerability details 2019 5 May 21, sandboxescaper in the github upload a copy of win10 arbitrary file deletion 0Day code: https://github.com/SandboxEscaper/polarbearrepo this is from the 2018 Year 8 months sandboxescaper release of the fifth 0Day the. The vulnerability principle and the...

Microsoft Internet Explorer 11 - XML External Entity Injection

Microsoft Internet Explorer 11 - XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-v11-XML-EXTERNAL-ENTITY-INJECTION-0DAY.txt + ISR: ApparitionSec Vendor...

TP-Link SR20 router 0 day vulnerability-a vulnerability warning-the black bar safety net

Google security developer Matthew Garrett found the TP-Link SR20 smart home router There 0 day arbitrary code execution vulnerability in the same network an attacker can exploit the vulnerability to root access to execute arbitrary commands. Garrett said public vulnerability is due from him to th...

Atlassian JIRA < 7.6.5 / 7.7.x < 7.7.3 / 7.8.x < 7.8.3 Limited Authentication Bypass

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an authentication bypass on certain administrative resources, which could allow an attacker to run import operations or reveal sensitive information...

PhpSpreadsheet 1.5.0 XXE vulnerability reproduction and analysis-vulnerability warning-the black bar safety net

0x01 introduction PhpSpreadsheet is a very popular pure PHP class library that allows you to easily read and write Excel, LibreOffic Calc and other spreadsheet file formats, is PHPExcel alternative. 2018 11 October 13, PhpSpreadsheet was broke presence of the XXE vulnerability, CVE-2018-19277, in...

Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie

A group of hackers has hijacked tens of thousands of Google's Chromecast streaming dongles, Google Home smart speakers and smart TVs with built-in Chromecast technology in recent weeks by exploiting a bug that's allegedly been ignored by Google for almost five years. The attackers, who go by...

MacOS again appeared vulnerability, known as unbreakable system also has weaknesses-vulnerability warning-the black bar safety net

For convenience of expression, this article will use the first-person manner described. This article describes my in Apple's macOS system kernel found several stack and buffer overflow vulnerabilities, Apple will this several vulnerabilities categorized as the kernel of remote code execution...