Mozilla: Buffer overflow in WebGL bufferdata on Linux

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.. This...

Mozilla: Buffer overflow in WebGL bufferdata on Linux

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.. This...

Mozilla: Buffer overflow in WebGL bufferdata on Linux

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.. This...

Mozilla: Buffer overflow in WebGL bufferdata on Linux

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.. This...

Graffiti - A Tool To Generate Obfuscated One Liners To Aid In Penetration Testing

NOTE : Never upload payloads to online checkers Graffiti is a tool to generate obfuscated oneliners to aid in penetration testing situations. Graffiti accepts the following languages for encoding: Python Perl Batch Powershell PHP Bash Graffiti will also accept a language that is not currently on...

Kentico Design Vulnerability

Kentico is the United States Kentico company's set of ASP.NET-based content management system CMS. Kentico versions 11 through 12 allow attackers to upload and browse files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabsmedia.aspx URI...

Security Management Center XSS

The vulnerability of the “Security Management Center” component of the Dr.Web Enterprise Security Suite antivirus tool exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code into the user’s...

Moderate: Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.3.5-3 - Container

Red Hat Ansible Tower 3.3.5-3 - Container - Fixed an issue to no longer expose Tower service credentials to playbook runs via environment variables when running in OpenShift CVE-2019-3869 - Fixed the Notifications tab to properly appear when viewing a Job Template...

CVE-2019-10008

Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...

idreamsoft iCMS Cross-Site Scripting Vulnerability (CNVD-2019-12120)

iCMS is an efficient and simple content management system built with PHP and MySQL. A cross-site scripting vulnerability exists in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14, which can be exploited by an attacker via the admincp.php?app=config tab parameter...

PT-2019-12305

Name of the Vulnerable Software and Affected Versions iCMS version 7.0.14 Description A cross-site scripting XSS issue was found in the idreamsoft iCMS software. The issue is related to the admincp.php?app=config tab parameter. Recommendations For iCMS version 7.0.14, consider restricting access ...

CVE-2019-11426: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

Open-Xchange: Another window.opener issue

Vulnerability Details: Appointment titles are rendered as hyperlink but were missing a protection against "tab nabbing". Risk: When following a hyperlink to a malicious website, the original tab location OX App Suite could be replaced with a URL chosen by the attacker. This can be exploited to...

Ubuntu: Security Advisory (USN-3935-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3935-1 busybox vulnerabilities

Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could overwrite arbitrary files outside of the current directory. This issue only affected Ubuntu 14....

USN-3935-1: BusyBox vulnerabilities

Tyler Hicks discovered that BusyBox incorrectly handled symlinks inside tar archives. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could overwrite arbitrary files outside of the current directory. This issue only affected Ubuntu 14....

Copying and pasting Status Macro (or TOC Macro) over https triggers mixed content and breaks certificate trust

h3. Issue Summary Copying and pasting a status macro or TOC over https in the browser will trigger mix content action, it will break the certificate trust on request of: Status macro plugins/servlet/status-macro/placeholder?title=titlehere&colour=Yellow TOC macro...

Loco Translate < 2.2.2 - Authenticated LFI

WordPress plugin Loco Translate version appears to have an Authenticated LFI Vulnerability under the 'Edit Template' Functionality. The following vulnerability can be exploited by any user with access to the plugin access can range from Admin to Subscriber WPScanTeam Note: Was not able to reprodu...

Oracle GoldenGate Manager Command Tab Parsing Denial of Service (CVE-2018-2912)

A denial of service vulnerability exists in Oracle GoldenGate Manager. The vulnerability is due to an input validation error when parsing a command which is not correctly separated by TAB characters. Successful exploitation could lead to a crash of the Manager service, causing a denial-of-service...

dnSpy - .NET Debugger And Assembly Editor

dnSpy is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available. Want to say thanks? Click the star at the top of the page. Or fork dnSpy and send a PR! The following pictures show dnSpy in action. It shows dnSpy editing a...