My Video Converter 1.5.24 Buffer Overflow

!/usr/bin/env python Exploit Title : My Video Converter 1.5.24 - Remote Buffer Overflow Discovery by : Shubham Singh Known As : Spirited Wolf Twitter: @Pwsecspirit Email : [email protected] Youtube Channel : www.youtube.com/c/Pentestingwithspirit Discovey Date : 29/07/2018 Software Link...

Facebook Removes 17 Profiles Involved in Political Meddling

Facebook Tuesday said that it has removed 32 pages from its platform involved in “coordinated inauthentic behavior.” The action comes months before the November midterm elections – and at a time when all eyes are on Facebook to see how it protects against potential campaigns attempting to sway...

chromium-browser: Bad cast in DevTools

Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension...

CVE-2018-14681

An issue was discovered in kwajdreadheaders in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite...

Staying Safe in the Era of Browser-based Cryptocurrency Mining

Qualys Malware Research Labs is announcing the release of Qualys BrowserCheck CoinBlocker Chrome extension to detect and block browser-based cryptocurrency mining, aka cryptojacking. Cryptojacking Cryptojacking attacks leverage the victim system’s resources via malicious JavaScript to mine certai...

CVE-2018-6151

Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension...

freetype2/glyphs-outlines: Bad-free in ft_smooth_render_generic

Detailed report: https://oss-fuzz.com/testcase?key=4776853456814080 Project: freetype2 Fuzzer: aflfreetype2glyphs-outlines Fuzz target binary: glyphs-outlines Job Type: aflasanfreetype2 Platform Id: linux Crash Type: Bad-free Crash Address: 0x7f0ad9d8fc1a Crash State: ftsmoothrendergeneric...

The danger of third parties: ads, pipelines, and plugins

It may or may not be comforting to know that, ultimately, bulletproof security is out of your hands. You can have the most locked down PC on Earth, have two-factor authentication 2FA set up across the board, take sensible actions to protect your personal information, and read all the EULAs under...

BST (Binary String Toolkit) - Quickly And Easily Convert Binary Strings For All Your Exploit Development Needs

The Binary String Toolkit or BST for short is a rather simple utility to convert binary strings to various formats suitable for later inclusions in source codes, such as those used to develop exploits in the security field. Features Dump files content to standard output in a binary string format...

CVE-2018-12536

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

CVE-2018-12536

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

Design/Logic Flaw

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

HTTP Request Smuggling

jetty-http is vulnerable to http request smuggling. The application uses a parser that is too tolerant with deviations from the HTTP header specifications, allowing a malicious user cause a http request smuggling attack through the bad length parsing...

freetype2/ftfuzzer: Bad-free in tt_face_vary_cvt

Project: https://github.com/freetype/freetype2-testing.git Detailed report: https://oss-fuzz.com/testcase?key=5877951005458432 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Bad-free Crash Address:...

Fedora 27 : 1:rubygem-sinatra (2018-0b17e1e529)

Fix XSS in the 400 Bad Request page CVE-2018-11627, rhbz1585218. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

When It Comes To IoT Security, Liability Is Muddled

BOSTON—From hacked connected cars to power grids, the implications of IoT security issues seem to be getting graver – yet when it comes to pointing fingers for security troubles, many times victims don’t even know where to start. IoT experts said at the Security of Things Forum today said that a...

bad-mergentheim.de XSS vulnerability

Open Bug Bounty ID: OBB-631867 Description| Value ---|--- Affected Website:| bad-mergentheim.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP Exploit

Exploit for multiple platform in category dos / poc mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINET: if...

GHSA-MQ35-WQVF-R23C Sinatra Cross-site Scripting vulnerability

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception...

gdal/ers_fuzzer: Bad-cast to ERSDatasetERSRasterBand::GetNoDataValue in gdal_fuzzer.cpp

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4850369325694976 Project: gdal Fuzzer: libFuzzergdalersfuzzer Fuzz target binary: ersfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000007fdad20 Crash State:...