5 ways to find and fix open source vulnerabilities

Guest post by Limor Wainstein A recent discovery of surreptitious execution of cryptomining code by a sandboxed app, riding piggyback on the open source software OSS ecosystem, raises pertinent questions about the security of open source code and its dependencies. Programmers often use OSS as a...

CVE-2014-5337

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wpmobilepackinfodisclosure.rb 2025-02-06 03:13:41+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:09:30+00:00...

CVE-1999-0554

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/nfs/nfsmount.rb 2025-02-06 03:13:37+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:08:01+00:00| seen|...

CVE-2017-11907

creationtimestamp| type| source ---|---|--- 2017-12-13 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=248 2017-12-19 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43370 2025-06-06 11:08:23+00:00| seen|...

CVE-2017-11120

creationtimestamp| type| source ---|---|--- 2017-09-25 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42784 2018-02-12 08:43:55+00:00| seen| https://t.me/SecLabNews/1509 2018-02-13 13:20:43+00:00| seen| https://t.me/informationsecuritychannel/13126 2026-07-26 07:02:00+00:00| seen|...

openSUSE: Security Advisory for qemu (openSUSE-SU-2017:2513-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2016-3652

creationtimestamp| type| source ---|---|--- 2016-06-29 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40041...

CVE-2015-2545

creationtimestamp| type| source ---|---|--- 2016-03-26 12:41:40+00:00| seen| MISP/56f569a9-314c-44a0-bab6-20cc95ca48b7 2016-04-22 20:23:26+00:00| seen| MISP/571a87f2-13e0-4396-83e5-4780950d210f 2016-04-28 15:27:58+00:00| seen| MISP/57221ede-4084-4c2b-9463-4e1e950d210f 2016-05-09 13:58:53+00:00|...

CVE-2015-4902

creationtimestamp| type| source ---|---|--- 2015-10-28 15:34:58+00:00| seen| MISP/5630e8bc-eaf0-4130-a4d6-4609950d210b 2017-04-26 06:44:05+00:00| seen| MISP/59003521-ebbc-4b0b-92ed-3a25bce2ab96 2020-10-09 14:23:52+00:00| seen| MISP/ac986ebb-348a-4ad8-a64f-0afcac8f9b9b 2020-10-09 17:20:22+00:00|...

[fuzzdb] Attack and Discovery Pattern Database for Application Fuzz Testing

fuzzdb aggregates known attack patterns, predictable resource names, server response messages, and other resources like web shells into the most comprehensive Open Source database of malicious and malformed input test cases. What's in fuzzdb? Predictable Resource Locations - Because of the...

Remote file inclusion

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow...

CVE-2009-3660

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow...

CVE-2008-7023

Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in...

CVE-2008-6736

Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to 1 add new events via calAdd.php, as reachable from admin/add.php, or 2 delete events via admin/deleteEvent.php. NOTE: this is only a vulnerability when the administrator does not foll...

Design/Logic Flaw

Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to 1 add new events via calAdd.php, as reachable from admin/add.php, or 2 delete events via admin/deleteEvent.php. NOTE: this is only a vulnerability when the administrator does not foll...

WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= IN THE NAME OF ALLAH -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Multi Languages WebShop Online...

RealVNC Windows Client 4.1.2 - Remote Denial of Service Crash (PoC)

RealVNC Windows Client 4.1.2 - Remote Denial of Service Crash PoC !/usr/bin/php ?php RealVNC Windows Client DoS AppName: vncviewer.exe AppVer: 4.1.2.0 ModName: vncviewer.exe ModVer: 4.1.2.0 Offset: 000229e0 function vncear $port = "5900"; $ser = socketcreateAFINET, SOCKSTREAM, SOLTCP;...

Potential Remote Denial of Service

Summary: A remote attacker could cause and smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters. Patch Availability A patch for Samba 3.0.7 samba-3.0.7-CAN-2004-0930.patch is available from...

FreeBSD : moinmoin -- ACL group bypass (115)

The following package needs to be updated: moinmoin %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg1ecf4ca1f7ad11d896c900061bc2ad93.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

FreeBSD : mpg123 vulnerabilities (118)

The following package needs to be updated: mpg123-esound %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg9fccad5a709611d8873f0020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...