9405 matches found
curl/curl_fuzzer_http: Index-out-of-bounds in fuzz_handle_transfer
Detailed report: https://oss-fuzz.com/testcase?key=5049873339514880 Project: curl Fuzzer: libFuzzercurlfuzzerhttp Fuzz target binary: curlfuzzerhttp Job Type: libfuzzerubsancurl Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: fuzzhandletransfer curlfuzzer.cc...
open62541/fuzz_binary_message: Heap-use-after-free in UA_SecureChannel_deleteMembersCleanup
Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5921003369660416 Project: open62541 Fuzzer: aflopen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-use-after-free READ...
Fedora 27 : libidn2 (2017-09b1c3f099)
Libidn2 2.0.4 released 2017-08-30 =================================== - Fix integer overflow in bidi.c/isBidi - Fix integer overflow in punydecode.c/decodedigit - Improve docs - Fix idnafree to idnfree - Update fuzzer corpora Note that Tenable Network Security has extracted the preceding...
PyroBatchFTP < 3.19 - Buffer Overflow
============================================= MGC ALERT 2018-001 - Original release date: December 22, 2017 - Last revised: January 12, 2018 - Discovered by: Manuel García Cárdenas - Severity: 7,5/10 CVSS Base Score ============================================= I. VULNERABILITY...
January 2018 security update release
Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...
January 2018 security update release
Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...
January 2018 security update release
Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...
Description of the security update for the ATMFD.dll information disclosure vulnerability in Windows Server 2008: January 3, 2018
Description of the security update for the ATMFD.dll information disclosure vulnerability in Windows Server 2008: January 3, 2018 Summary An information disclosure vulnerability exists in Adobe Type Manager Font Driver ATMFD.dll when it fails to properly handle objects in memory. An attacker who...
GitLab: GitHub import allows user to create child group under existing namespace
When importing a GitHub repository on GitLab, a request is made to /import/github. The user is allowed to pass along a target namespace where they want to add the repository. In this process, the code will create the namespace if it doesn't exist already. However, this can be used to create a...
Sendroid < 6.5.0 - SQL Injection
Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script 5.0.0 - 6.5.0 - SQL Injection Google Dork: "welcome to SMS portal" Date: 22/12/2017 Exploit Author: Onwuka Gideon Contact: http://twitter.com/@gideononwuka Vendor Homepage: http://ynetinteractive.com/ Software Buy:...
Genexis Automatic Provisioning System Access Control Vulnerability
The Genexis Automatic Provisioning System GAPS is a system for automatic configuration of routers and networks from the Dutch company GENEXIS. An access control vulnerability exists in GAPS 7.2 and earlier versions. An attacker can exploit this vulnerability to obtain configured setup information...
Patch Tuesday, December 2017 Edition
The final Patch Tuesday of the year is upon us, with Adobe and Microsoft each issuing security updates for their software once again. Redmond fixed problems with various flavors of Windows, Microsoft Edge, Office, Exchange and its Malware Protection Engine. And of course Adobe's got another...
December 2017 security update release
Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...
December 2017 security update release
Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...
December 2017 security update release
Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...
llvm/clang-fuzzer: Stack-buffer-overflow in clang::expandUCNs
Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=5041559499177984 Project: llvm Fuzzer: libFuzzerllvmclang-fuzzer Fuzz target binary: clang-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash...
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSyste...
The vulnerability of the Smart Network Configuration Manager’s automatic network configuration management system, related to authentication mechanisms that lack sufficient protection, allows attackers to circumvent network firewall restrictions.
The vulnerability of the Smart Network Configuration Manager’s automatic network configuration management system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass network firewalls by using a Zebedee client that connects t...
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSyste...
Description of the security update for the information disclosure vulnerability in Windows Server 2008: December 12, 2017
Description of the security update for the information disclosure vulnerability in Windows Server 2008: December 12, 2017 Summary An information disclosure vulnerability exists when the Windows its:// protocol handler unnecessarily sends traffic to a remote site to determine the zone of a provide...