QEMU 'b/nbd/server.c' stack buffer overflow vulnerability

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. QEMU 'b/nbd/server.c' suffers from a stack buffer overflow vulnerability, which originates from the program failing to properly perform bounds...

MGASA-2017-0429 Updated mediawiki packages fix security vulnerabilities

XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping CVE-2017-8808. Reflected File Download from api.php CVE-2017-8809. On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password CVE-2017-8810. It's possible to...

HackerOne: Query parameter reordering causes redirect page to render unsafe URL

Hello hackerone team I want to report I bypass w/c lead to XSS but limited only for IE due to CSP block on chrome Here is the POC ------------------ https://hackerone.com/redirect?signature=c9304cadaeabca0bfb7b92503c0318da5c42a86b&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09document.domain...

Ground Ops - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Ground Ops published at the 'play' market has multiple vulnerabilities...

EasySNS Minimalist Community loginHandle method suffers from SQL injection vulnerability

EasySNS Minimalist Community is for the new database architecture and program structure, to the group as the basic unit to form an interactive community. A SQL injection vulnerability exists in the loginHandle method of the EasySNS community. The vulnerability is due to the failure of the system ...

Command execution vulnerability in the pelco Sarix Pro network camera set_param program (CNVD-2017-36490)

pelco Sarix Professional is a video camera. A command execution vulnerability exists in the pelco Sarix Pro network camera setparam program. The vulnerability is caused due to the program failing to perform security checks on user-submitted parameters, allowing an attacker to take full control of...

Unsafe Deserialization

redis-store is vulnerable to unsafe deserialization. The marshalling ability of redis-store allows attackers to load unsafe objects from redis. In order to be vulnerable to this, the options:marshalling needs to be used...

Design/Logic Flaw

Redis-store =v1.3.0 allows unsafe objects to be loaded from redis...

CVE-2017-1000248

Redis-store =v1.3.0 allows unsafe objects to be loaded from redis...

UBUNTU-CVE-2017-1000248

Redis-store =v1.3.0 allows unsafe objects to be loaded from redis...

CVE-2017-1000248

Redis-store =v1.3.0 allows unsafe objects to be loaded from redis...

DEBIAN-CVE-2017-1000248

Redis-store =v1.3.0 allows unsafe objects to be loaded from redis...

CVE-2017-1000248

Redis-store =v1.3.0 allows unsafe objects to be loaded from redis...

MGASA-2017-0408 Updated jackson-databind packages fix security vulnerability

An unsafe deserialization vulnerability was found due to incomplete blacklisting of the unsafe elements, due to an incomplete fix for CVE-2017-7525 CVE-2017-15095...

Unsafe objects can be loaded from Redis

Redis-store =v1.3.0 allows unsafe objects to be loaded from Redis via the use of the Marshal serializer...

mediawiki -- multiple vulnerabilities

mediawiki reports: security fixes: T128209: Reflected File Download from api.php. Reported by Abdullah Hussam. T165846: BotPasswords doesn't throttle login attempts. T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password. T178451: XS...

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes...

CVE-2017-16663

In sam2p 0.49.4, there are integer overflows with resultant heap-based buffer overflows in input-bmp.ci in the function ReadImage, because "width height" multiplications occur unsafely...

CVE-2017-16615

An exploitable vulnerability exists in the YAML parsing functionality in the parseyamlquery method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where...

PYSEC-2017-23

An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1. A YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safeload should have been used. An attacker can...