Directory Traversal Vulnerability in GxlcmsQY System

GxlcmsQY system is a simple program tailored for business users. A directory traversal vulnerability exists in GxlcmsQY System\Lib\Lib\Action\Admin\PicAction.class.php. An attacker can exploit this vulnerability to obtain sensitive information...

Design/Logic Flaw

In M3UParser::parse of M3UParser.cpp, there is a memory resource exhaustion due to a large loop of pushing items into a vector. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0,...

gdal/gdal_vector_translate_fuzzer: Bad-cast to OGRMultiPolygon from OGRGeometryCollection in OGRMultiPolygon* cpl::down_cast<OGRMultiPolygon*, OGRGeometry>

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4755222246195200 Project: gdal Fuzzer: libFuzzergdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Bad-cast Crash Address:...

Drupal core Remote Code Execution(CVE-2018-7600) (Drupalgeddon2)

Two weeks ago, a highly critical 21/25 NIST rank vulnerability, nicknamed Drupalgeddon 2 SA-CORE-2018-002 / CVE-2018-7600, was disclosed by the Drupal security team. This vulnerability allowed an unauthenticated attacker to perform remote code execution on default or common Drupal installations...

osCommerce 2.3.4.1 - Remote Code Execution

Exploit Title: osCommerce 2.3.4.1 Remote Code Execution Date: 29.0.3.2018 Exploit Author: Simon Scannell - https://scannell-infosec.net Version: 2.3.4.1, 2.3.4 - Other versions have not been tested but are likely to be vulnerable Tested on: Linux, Windows If an Admin has not removed the /install/...

Open-AuditIT Professional 2.1 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Open-AuditIT Professional 2.1 - Stored Cross site scripting XSS Exploit Author: Nilesh Sapariya Contact: https://twitter.com/nileshloganx Website: https://nileshsapariya.blogspot.com Vendor Homepage: https://www.open-audit.org/...

GoScanSSH Malware Targets SSH Servers, But Avoids Military and .GOV Systems

Researchers have identified a new malware family, dubbed GoScanSSH, that targets public facing SSH servers, but avoids those linked to government and military IP addresses. The malware has been in the wild since June 2017 and exhibits a number of unique characteristics, such as being written in t...

Siemens TIM 1531 IRC

CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: Siemens Equipment: TIM 1531 IRC Vulnerability: Missing Authentication for Critical Function AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following TIM 1531 IRC communications modules: TIM 1531...

Stellar.org: Exploitable vulnerability in SDEX

Hi, Last Thursday I discovered the exploitable vulnerability in SDEX. I immediately reported the bug directly to Jed by email and he confirmed it. It's all about rounding during trades. You see, I found that orders are always executed if the price matches market, even if the amount is as small as...

ModSecurity For Nginx Use-After-Free

Hey, TL;DR: UAF in a "non-release" version of ModSecurity for Nginx. !RCE|DoS, no need to panic. Plus some old and even older exploitation vectors. / 1. Use-After-Free UAF / During one of the engagements my team tested a WAF running in production Nginx + ModSecurity + OWASP Core Rule Set 123. In...

Alkacon OpenCMS gallery feature cross-site scripting vulnerability

Alkacon OpenCms is the German Alkacon Software's set of open source Java and XML-based content management system CMS. The system supports template engine , WYSIWYG editor and so on. A cross-site scripting vulnerability exists in the gallery feature in Alkacon OpenCMS version 10.5.3. A remote...

CVE-2018-8815

Cross-site scripting XSS vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image...

gdal/gdal_vector_translate_fuzzer: Heap-buffer-overflow in _escapeString_GCIO

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5667643664105472 Project: gdal Fuzzer: aflgdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...

gdal/gdal_vector_translate_fuzzer: Heap-buffer-overflow in SHPCreateLL

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4684654431961088 Project: gdal Fuzzer: aflgdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07)

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.7, Firefox ESR 52.7, and Firefox 59...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-06800)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. Windows kernel is one of the operating system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel, which arises from a program's failure to properly filter objects in...

Shimmie cross-site scripting vulnerability (CNVD-2018-06088)

Shimmie is a set of image panels for installing and configuring Web sites. A cross-site scripting vulnerability exists in Shimmie 2 version 2.6.0, which stems from the program failing to properly handle uploaded SVG files. A remote attacker can exploit the vulnerability by uploading a specially...

Solaris 10 (x86) : 120665-01

SunOS 5.10x86: tl driver patch. Date this patch was last updated by Sun : Sep/15/05 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Red Hat Releases Security Guidance for Memcached

Red Hat has released security recommendations to address potential Distributed Denial of Service attacks using Memcached. This misconfiguration could allow an attacker to exploit Memcached services as a reflection and amplification vector, causing unexpected volumes of traffic to be sent to...

Code injection

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the XPS...