libreoffice:xlsfuzzer: Heap-buffer-overflow in std::__1::unique_ptr<ScColumn, o3tl::default_delete<ScColumn> >::operator*

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5638823755382784 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: xlsfuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

Comtrend VR-3033 Command Injection

Timeline : Bug sent to vendor : 17-02-2020 No Response after 10 days Public disclosure: 27-02-020 The Comtrend VR-3033 is prone to Multiple Authenticated Command Injection vulnerability via ping and traceroute diagnostic page. Remote attackers are able to get full control and compromise the netwo...

radiologyinfo.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1101981 Security Researcher Gh05tPT Helped patch 6878 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting radiologyinfo.org websit...

mirp.pnzreg.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1099594 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting mirp.pnzreg.ru website an...

arrow:parquet-arrow-fuzz: Crash in arrow::BufferBuilder::Append

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5671667462569984 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x009a00000097 Crash...

arrow:parquet-arrow-fuzz: Negative-size-param in parquet::PlainByteArrayDecoder::DecodeArrowDense

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5685456455073792 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

imagemagick:encoder_ttf_fuzzer: Heap-buffer-overflow in RenderFreetype

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5736942228733952 Project: imagemagick Fuzzing Engine: honggfuzz Fuzz Target: encoderttffuzzer Job Type: honggfuzzasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

rome2rio.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1080895 Security Researcher rahul83636534 Helped patch 39 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting rome2rio.com website and its users. Following...

CVE-2020-1931

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian...

imagemagick:encoder_plasma_fuzzer: Use-of-uninitialized-value in RoundToUnity

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5734463269240832 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderplasmafuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

Webtareas 2.0 - (id) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Webtareas 2.0 - 'id' SQL Injection Exploit Author: Greg.Priest Vendor Homepage: http://webtareas.sourceforge.net/general/home.php Software Link: http://webtareas.sourceforge.net/general/home.php Version: Webtareas v2.0 Tested on...

php:php-fuzz-mbstring: Use-of-uninitialized-value in node_min_byte_len

Detailed Report: https://oss-fuzz.com/testcase?key=4822305188610048 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: nodeminbytelen nodeminbytelen optimizenodes...

Topcoder: Stored-Xss at connect.topcoder.com/projects/ affected on project chat members

Hi team , I'm sorry for my bad report and english , but i wish you understand the impact of that bug here , if it well performed the sers may lose their access to their sso accounts Summary: While a developer at connect.topcoder.com can manage a messages about his/her project with someonelse , Th...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5167653459329024 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

libspectre:spectre_read_fuzzer: Heap-buffer-overflow in gc_mark_string

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5703675452588032 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzerasanlibspectre Platform Id: linux Crash Type: Heap-buffer-overflow...

open-xchange.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1057445 Security Researcher passc0de Helped patch 22 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting open-xchange.com website and its users. Following...

zkje.age-of-nox.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1047702 Security Researcher geeknik Helped patch 8753 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting zkje.age-of-nox.de website...

opensc:fuzz_pkcs15_reader: Stack-buffer-overflow in sc_pkcs15emu_object_add

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5181993696624640 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

donostia.eus Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1024943 Security Researcher PoisoNBlEedinG Helped patch 114 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting donostia.eus website and its users. Following...