mirp.pnzreg.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1099594 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting mirp.pnzreg.ru website an...

arrow:parquet-arrow-fuzz: Crash in arrow::BufferBuilder::Append

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5671667462569984 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerubsanarrow Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x009a00000097 Crash...

arrow:parquet-arrow-fuzz: Negative-size-param in parquet::PlainByteArrayDecoder::DecodeArrowDense

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=5685456455073792 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: parquet-arrow-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

imagemagick:encoder_ttf_fuzzer: Heap-buffer-overflow in RenderFreetype

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5736942228733952 Project: imagemagick Fuzzing Engine: honggfuzz Fuzz Target: encoderttffuzzer Job Type: honggfuzzasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

rome2rio.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1080895 Security Researcher rahul83636534 Helped patch 39 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting rome2rio.com website and its users. Following...

CVE-2020-1931

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian...

imagemagick:encoder_plasma_fuzzer: Use-of-uninitialized-value in RoundToUnity

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5734463269240832 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderplasmafuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

Webtareas 2.0 - (id) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Webtareas 2.0 - 'id' SQL Injection Exploit Author: Greg.Priest Vendor Homepage: http://webtareas.sourceforge.net/general/home.php Software Link: http://webtareas.sourceforge.net/general/home.php Version: Webtareas v2.0 Tested on...

php:php-fuzz-mbstring: Use-of-uninitialized-value in node_min_byte_len

Detailed Report: https://oss-fuzz.com/testcase?key=4822305188610048 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-mbstring Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: nodeminbytelen nodeminbytelen optimizenodes...

Topcoder: Stored-Xss at connect.topcoder.com/projects/ affected on project chat members

Hi team , I'm sorry for my bad report and english , but i wish you understand the impact of that bug here , if it well performed the sers may lose their access to their sso accounts Summary: While a developer at connect.topcoder.com can manage a messages about his/her project with someonelse , Th...

harfbuzz:hb-subset-fuzzer: Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5167653459329024 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash...

libspectre:spectre_read_fuzzer: Heap-buffer-overflow in gc_mark_string

Project: https://gitlab.freedesktop.org/libspectre/libspectre.git Detailed Report: https://oss-fuzz.com/testcase?key=5703675452588032 Project: libspectre Fuzzing Engine: libFuzzer Fuzz Target: spectrereadfuzzer Job Type: libfuzzerasanlibspectre Platform Id: linux Crash Type: Heap-buffer-overflow...

open-xchange.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1057445 Security Researcher passc0de Helped patch 22 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting open-xchange.com website and its users. Following...

zkje.age-of-nox.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1047702 Security Researcher geeknik Helped patch 8753 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting zkje.age-of-nox.de website...

opensc:fuzz_pkcs15_reader: Stack-buffer-overflow in sc_pkcs15emu_object_add

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5181993696624640 Project: opensc Fuzzing Engine: honggfuzz Fuzz Target: fuzzpkcs15reader Job Type: honggfuzzasanopensc Platform Id: linux Crash Type: Stack-buffer-overflow READ Crash Address:...

donostia.eus Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1024943 Security Researcher PoisoNBlEedinG Helped patch 114 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting donostia.eus website and its users. Following...

camdencounty.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8562 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting camdencounty.com website and its users. Following...

Ruby: Code Injection Bug Report

Good morning, I hope this message finds you well. On 22 November 2019, I emailed [email protected] about a Code Injection bug on cache.ruby-lang.org, as the ruby-lang.org website is considered out-of-scope on H1. on 24 November 2019 the bug was acknowledged and a patch released. This morning...

llvm:clang-fuzzer: Segv on unknown address in HasAccess

Detailed Report: https://oss-fuzz.com/testcase?key=5740402812649472 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: HasAccess IsAccessible CheckEffectiveAccess Sanitize...