Zero-day vulnerability in Telegram

In October 2017, we learned of a vulnerability in Telegram Messenger's Windows client that was being exploited in the wild. It involves the use of a classic right-to-left override attack when a user sends files over the messenger service. Right-to-left override in a nutshell The special nonprinti...

DNSspider - Very Fast, Async Mulithreaded Subdomain Scanner

A very fast multithreaded bruteforcer of subdomains that leverages a wordlist and/or character permutation. CHANGELOG: v0.9 use async multithreading via concurrent.futures module attack while mutating - don't generate whole list when using -t 1 log only the subdomains to logfile when '-r' was...

CVE-2017-13228

In function ih264drefidxreordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions:...

CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

Debian DSA-4103-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2017-15420 Drew Springall discovered a URL spoofing issue. - CVE-2017-15429 A cross-site scripting issue was discovered in the v8 JavaScript library. - CVE-2018-6031 A use-after-free issue was discovered in the pdfium...

[OST]French Canadian Keyboard not mapping properly to VDA from Mac

French Canadian special accent characters not displaying correctly when accessing a Windows 7 VDA from a Macclient device with Receiver for OSX 12.4. On a Mac with a French Canadian keyboard, the circumflex character ^ is not mapped as expected with Receiver Macversion 12 connecting to a Windows ...

Mozilla: From address with encoded null character is cut off in message header display

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird 52.5.2...

Ruby: Unix domain socket and a path containing a null character

Some methods on UNIX domain socket are not checked for null characters. vagrant@localhost $ ls /tmp vagrant@localhost $ irb irbmain:001:0 require 'socket' = true irbmain:002:0 UNIXServer.open"/tmp/socket\0ruby" |serv| irbmain:003:1 c = UNIXSocket.open"/tmp/socket\0sapphire" irbmain:004:1 s =...

Ruby: The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.

It seems that entries,new, and empty? do not check NULL characters in methods of Dir. log vagrant@localhost $ ls test vagrant@localhost $ irb irbmain:001:0 Dir.open"/home/vagrant\0xxx" do |d| irbmain:002:1 p d.read = "." irbmain:003:1 p d.read = ".." irbmain:004:1 p d.read irbmain:005:1 p d.read...

UBUNTU-CVE-2017-7829

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed if preceded by a null character in the display string. This vulnerability affects Thunderbird 52.5.2...

DEBIAN-CVE-2017-17935

The Filereadline function in epan/wslua/wsluafile.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service buffer underflow and application crash via a crafted packet that triggers the attempted processing of an empty line...

Security update for Mozilla Thunderbird (important)

This update for Mozilla Thunderbird to version 52.5.2 fixes the following vulnerabilities: - CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin bsc1074043 - CVE-2017-7847: Local path string can be leaked from RSS feed bsc1074044 - CVE-2017-7848: RSS Feed vulnerable to new line...

Microsoft Windows jscript!NameTbl::GetValDef Use-After-Free Exploit

Exploit for windows platform in category dos / poc Windows: use-after-free in jscript!NameTbl::GetValDef CVE-2017-11903 There is a use-after-free vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - An attacker on the local network could exploit this...

CVE-2017-16363

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the module that handles character codes for...

CVE-2017-16363

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the module that handles character codes for...

[SECURITY] Fedora 26 Update: nodejs-balanced-match-0.4.2-4.fc26

Match balanced character pairs, like "" and ""...

CVE-2017-1001003

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object...

Valve: Link filter protection bypass

Description Hi, there is a protection bypass in the linkfilter function. By using the character 。 %E3%80%82 url encoded instead of a normal dot in urls, it is possible to bypass the blocking. PoC Normal request : https://steamcommunity.com/linkfilter/?url=pornhub.com F240919 Bypass :...

Synology DiskStation Manager smart.cgi Remote Command Execution

This module exploits a vulnerability found in Synology DiskStation Manager DSM versions use exploit/linux/http/synology/dsmsmartexecauth msf undefineddsmsmartexecauth show actions ...actions... msf undefineddsmsmartexecauth set ACTION msf undefineddsmsmartexecauth show options ...show and set...

Fake WhatsApp On Google Play Store Downloaded By Over 1 Million Android Users

Cybercriminals are known to take advantage of everything that's popular among people in order to spread malware, and Google's official Play Store has always proved no less than an excellent place for hackers to get their job done. Yesterday some users spotted a fake version of the most popular...