CVE-2018-19800

aubio v0.4.0 to v0.4.8 has a Buffer Overflow in newaubiotempo...

CVE-2018-20662

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing...

CVE-2018-14979

The CVE-2018-14979 entry concerns ASUS ZenFone 3 Max (ASUS_X008_1) with pre-installed com.asus.loguploader. The issue is an exported service, LogUploaderService, accessible via a specific action, that can write a bugreport (kernel log, logcat, system service states including active notifications)...

CVE-2018-14979: Exposure of Sensitive Information to an Unauthorized Actor

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains a pre-installed app with a package name of com.asus.loguploader versionCode=1570000275, versionName=7.0.0.55170515. This app contains an...

CVE-2018-18521

Divide-by-zero vulnerabilities in the function arlibaddsymbols in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service application crash with a crafted ELF file, as demonstrated by eu-ranlib, because a zero shentsize is mishandled...

CVE-2017-15232

libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file...

gnutls: Use-of-uninitialized-value in mpz_import

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5790636118638592 Project: gnutls Fuzzer: libFuzzergnutlssrpclientfuzzer Fuzz target binary: gnutlssrpclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

CVE-2017-6349

An integer overflow at a ureadundo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows...

shopify-scripts: SIGSEGV in mrb_vm_exec

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1296.rb: 0.instanceevalsuper Sandbox: ------------------- x@x:/Desktop/research/mruby-engine/bin$ ./sandbox testmrbvmexec1296.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000028 ruby 2.2.6p396 2016-11-15...

Winace UnAce 2.2 Command Line Argument Buffer Overflow Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/9002/info UnAce has been reported to be prone to a buffer overflow vulnerability. The issue presents itself when UnAce handles ace filenames that are of excessive length. When this filename is passed to the UnAce utility ...

bcoos 1.0.10 (lfi / SQL Injection) Multiple Vulnerabilities

No description provided by source. WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: Bcoos Multiple Vulnerabilities Vendor: http://www.bcoos.net/ Bugs: Local File Inclusion, Sql Injection Vulnerable Version: bcoos 1.0.10 prior versions also may be affected...

CVE-2012-2963: Improper Authentication

The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file...

PHP CGI Argument Injection Remote Exploit (PHP Version)

Exploit for php platform in category web applications PHP CGI Argument Injection Remote Exploit PHP CG...

CVE-2011-2938

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

Ferdows CMS Pro 1.1.0 - Multiple Vulnerabilities

www.BugReport.ir AmnPardaz Security Research Team Title: Ferdows CMS Pro =1.1.0 Multiple Vulnerabilities Vendor: www.fcms.ir Exploit: Available Vulnerable Version: 1.1.0 Pro Impact: Medium Original Advisory: http://www.bugreport.ir/index77.htm Fix: N/A 1. Description: Ferdows CMS is a complete,...

AneCMS 1.0 Code Execution / Local File Inclusion

www.BugReport.ir AmnPardaz Security Research Team Title: AneCMS Multiple Vulnerabilities Vendor: http://anecms.com/ Vulnerable Version: 1.0 Latest version till now Exploitation: Remote with a RAW HTTP packet sender Fix: N/A - Description: AneCMS is a small and fast CMS completely modular. Written...

Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting

www.BugReport.ir AmnPardaz Security Research Team Title: chicomas Dtabase Information Disclosure POC: http://URL/chicomas/config.inc +--The Latest generated Database backups POC: http://URL/chicomas/backup +--Cross Site Scripting XSS. Reflected XSS attack in "index.php" in "q" parameter. POC:...

ParsaWeb CMS - 'Search' SQL Injection

www.BugReport.ir AmnPardaz Security Research Team Title: ParsaWeb CMS SQL Injection Vendor: http://www.parsagostar.com Demo: http://cms.parsagostar.com/ Exploit: Available Impact: High Fix: N/A Original advisory: http://www.bugreport.ir/index53.htm 1. Description: ParsaWeb is a commercial ASP.NET...

translucid-upload.txt

www.BugReport.ir AmnPardaz Security Research Team Title: TransLucid 1.75 fckeditor Remote Arbitrary File Upload Vendor: www.translucidonline.com Vulnerable Version: 1.75 prior versions also may be affected Exploitation: Remote with browser Exploit: Available Impact: Medium Fix: N/A Original...

Pooya Site Builder (PSB) 6.0 - Multiple SQL Injections

Pooya Site Builder PSB 6.0 - Multiple SQL Injections www.BugReport.ir AmnPardaz Security Research Team Title: Pooya Site Builder PSB SQL Injection Vulnerabilities Vendor: www.paridel.com Vulnerable Version: 6.0 Assembly Version Exploit: Available Impact: High Fix: N/A Original Advisory:...