SAP BusinessObjects Financial Consolidation 10.0.0.1933 Cross Site Scripting

Description Cross-site scripting XSS vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. ------------------------------------------ Additional Information The help pages of...

Jenkins Information Disclosure Vulnerability (CNVD-2017-01346)

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

Mobile Application Security Training Platform: Security Shepherd

The OWASP Security Shepherd project is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen...

CVE-2016-3177

Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors...

Double free

Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors...

CVE-2016-3177

Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors...

CVE-2016-3177

Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors...

CVE-2016-3177

CVE-2016-3177 concerns GIFLIB 5.1.2 and affects the gifcolor.c component, with multiple use-after-free and double-free vulnerabilities described as having unspecified impact and attack vectors. The provided documents do not specify affected product variants beyond GIFLIB 5.1.2, nor provide remedi...

CVE-2016-3177

Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors...

Multiple Cross-Site Scripting Vulnerabilities in Zimbra Collaboration

Zimbra can provide open source email server software and shared calendars. Multiple cross-site scripting vulnerabilities in versions prior to Zimbra Collaboration 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors also known as bugs 104552 and 104703...

CVE-2017-5196

Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service out-of-bounds read and crash via vectors involving strings that are not UTF8...

Microsoft Edge - CMarkup::Ensure­Delete­CFState Use-After-Free (MS15-125)

Microsoft Edge - CMarkup::Ensure­Delete­CFState Use-After-Free MS15-125 Source: http://blog.skylined.nl/20161201001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Edge. I did not investigate this vulnerability thoroughly, so I cannot speculat...

Microsoft Edge - CMarkup::Ensure­Delete­CFState Use-After-Free (MS15-125) Vulnerability

Exploit for windows platform in category dos / poc Source: http://blog.skylined.nl/20161201001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Edge. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to escalate their privileges

The vulnerabilities of Microsoft Edge and Internet Explorer are related to errors in access control of namespace resources. Exploiting these vulnerabilities can allow a malicious actor to enhance their privileges using undefined vectors...

Solaris 8/9 passwd(1) - circ() Stack-Based Buffer Overflow Privilege Escalation Exploit

Exploit for linux platform in category local exploits / $Id: raptorpasswd.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorpasswd.c - passwd circ local, Solaris/SPARC 8/9 Copyright c 2004 Marco Ivaldi Unknown vulnerability in passwd1 in Solaris 8.0 and 9.0 allows local users to gain privileges via...

CVE-2016-3929

Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices has unknown impact and attack vectors, aka internal bug 28823675...

CVE-2016-3927

Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices has unknown impact and attack vectors, aka internal bug 28823244...

CVE-2016-3926

Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5, 5X, 6, and 6P devices has unknown impact and attack vectors, aka internal bug 28823953...

Internet Bug Bounty: Malicious Server can force read any file on clients system with default configuration in MySQL Clients

Although it is documented that the default binary distributions of MySQL/MariaDB/Percona all seem to be compiled with allow local infile enabled, the warning is misleading. The transfer of the file from the client host to the server host is initiated by the MySQL server. In theory, a patched serv...

Hancitor (AKA Chanitor) observed using multiple attack approaches

Many threat actors use multiple attack vectors to ensure success. The individuals using Hancitor malware also known by the name Chanitor are no exception and have taken three approaches to deliver the malware in order to ultimately steal data from their victims. These techniques include uncommon...