Internet Bug Bounty: integer overflow in fgets cause heap corruption

Please check: https://bugs.php.net/bug.php?id=73011...

LastPass Patches Ormandy Remote Compromise Flaw

LastPass has patched a vulnerability in its Firefox add-on found by Google Project Zero researcher Tavis Ormandy that allows attackers complete remote compromise of the password manager, . The divisive Ormandy submitted a bug report on Tuesday to LastPass after a series of tweets hinting at serio...

Gratipay: prevent null bytes in email field

Hi, Zawad here. Description I recently visited gratipay.com and logged in. I found that invalid characters eg. null bytes were accepted in email field, which is obviously not an expected behavior. Steps to Reproduce 1. Go to https://gratipay.com/username/emails/ 2. Enter [email protected]\0 or...

libical 0.47 / 1.0 Crash

Hello lists Attached is a test case for causing a crash in libical 0.47 shipped with Thunderbird and this was also tested against 1.0 various versions shipped with various email clients. ================================================================= ==24662==ERROR: AddressSanitizer: SEGV on...

Trello: Report bug on jetpack plugin

Hey I saw that u guys upgraded the jetpack plugin And today jetpack has relased that plugins greater 4.0.2 & 4.0.3 have multiple bugs Here is the jetpack blog https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/...

Hacker Breaks into Political Party's Video Conference System; Could Spy, too!

A critical flaw in the video conferencing software of the Quebec Liberal Party PLQ − a Canadian federalist provincial political party − allowed a user to spy on and hear the strategy discussions of the party at its premises and even access the live video camera feeds. But luckily, the unknown whi...

meteoconsult.es IFRAME Injection vulnerability

Open Bug Bounty ID: OBB-159983 Description| Value ---|--- Affected Website:| meteoconsult.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Iframe Injection / CWE-79 CVSSv3 Score:| 6.1...

Google Android - '/system/bin/sdcard' Stack Buffer Overflow (PoC)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=798 Android: Stack-buffer-overflow in /system/bin/sdcard There's an integer overflow issue in getnodepathlocked, which results in a buffer overflow. For all of the calling paths, this is going to overflow a stack buffer in the pare...

drchrono: Bug Report

Sir, I want to report a bug in your web which i have found in few minutes ago : I have registered In your website and i have found a upload option i want to upload some php files but its saying only .pdf file allowed so i have just change my .php file extension to .pdf first its saying not allowe...

Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products:...

Liferay CE 6.2 CE GA6 - Persistent Cross-Site Scripting

Liferay CE 6.2 CE GA6 - Persistent Cross-Site Scripting CVE-2016-3670 Stored Cross Site Scripting in Liferay CE 1. Vulnerability Properties Title: Stored Cross-Site Scripting Liferay CE CVE ID: CVE-2016-3670 CVSSv3 Base Score: 4.6 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Vendor: Liferay Inc Products:...

Internet Bug Bounty: Integer Overflow in php_html_entities()

This bug report at https://bugs.php.net/bug.php?id=72135, and fixed in: https://github.com/php/php-src/commit/41fc3c76e97a36ff3b505da7d704ca17bb171fdf https://github.com/php/php-src/commit/0da8b8b801f9276359262f1ef8274c7812d3dfda...

FFmpeg remote file stealing vulnerabilities – moving end of the safety analysis report-vulnerability warning-the black bar safety net

0x1 vulnerability of origin FFmpeg remote file stealing vulnerabilities original source is Foreign vulnerability of the platform,the last year has been in the CTF match is used. Official in January of this year released the fixed version and published the vulnerability number CVE-2 0 1 6-1 8 9...

bugzilla: cross-site scripting

An attacker can craft a malicious summary within a bug report to host malicious javascript code. This code will be served to a user when he or she navigates to the bug's dependency graph...

WordPress Advanced Custom Fields 4.4.7 Cross Site Scripting

FULL DISCLOSURE Product : Advanced Custom Fields Exploit Author : Rahul Pratap Singh Version : 4.4.7 Home page Link :https://wordpress.org/plugins/advanced-custom-fields/ Website : https://0x62626262.wordpress.com Linkedin : https://in.linkedin.com/in/rahulpratapsingh94 Date : 1/5/2016...

CVE-2015-8807

Cross-site scripting XSS vulnerability in the renderVarInputnumber function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2015-8806

dict.c in libxml2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via an unexpected character immediately after the "!DOCTYPE html" substring in a crafted HTML document...

Vimeo: Missing rate limit on private videos password

Missing rate limit on password protected clips. Rate-limits is a non-qualifying bug at this time. We have received multiple reports of this in the past, however, since that time we have implemented a clip password rate limit. This was not appropriately applied to all clip password areas, so we've...

Internet Bug Bounty: Buffer overflow in HTTP url parsing functions

This bug report was submitted directly to the PHP bug tracker: The issue was verified and fixed on 2016-03-09. Updated HTTP packages 2.5.6 and 3.0.1 were released the same day. Following you find the bug description that has been reported to the PHP maintainers: Description The HTTP url parsing...

ThisData: Login CSRF using Google OAuth

This bug is related to bug report https://hackerone.com/reports/774 as this bug also allows a user to be logged in as the attacker. An attacker could exploit this bug as follows: Attacker initiates Google OAuth process with thisdata Attacker allows access to thisdata app Attacker records and drop...