libxml2:xml: Heap-use-after-free in xmlStaticCopyNode

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6039216293937152 Project: libxml2 Fuzzing Engine: honggfuzz Fuzz Target: xml Job Type: honggfuzzasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60c00000220...

openh264:decoder_fuzzer: Heap-buffer-overflow in WelsDec::WelsDecodeMbCabacPSlice

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5730626752479232 Project: openh264 Fuzzing Engine: afl Fuzz Target: decoderfuzzer Job Type: aflasanopenh264 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash Address: 0x61800000379b...

openh264:decoder_fuzzer: Heap-buffer-overflow in WelsDec::NeedErrorCon

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5131855194750976 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzerasani386openh264 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

binutils:fuzz_readelf: Heap-buffer-overflow in read_leb128

Detailed Report: https://oss-fuzz.com/testcase?key=6294642243665920 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzreadelf Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6210000064fc Crash State: readleb128...

firetree.net Cross Site Scripting vulnerability OBB-1353272

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

10000en.jp Cross Site Scripting vulnerability OBB-1353038

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

opencv:imdecode_fuzzer: Heap-buffer-overflow in void cv::copyToMat<int>

Project: https://github.com/opencv/opencv.git Detailed Report: https://oss-fuzz.com/testcase?key=5171310492385280 Project: opencv Fuzzing Engine: afl Fuzz Target: imdecodefuzzer Job Type: aflasanopencv Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x6060000008f0 Crash...

reigningcatzanddogz.com Cross Site Scripting vulnerability OBB-1347022

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Advantech WebAccess Node

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Advantech Equipment: WebAccess Node Vulnerability: Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate their...

fasthttp:fuzz_request: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5745696710590464 Project: fasthttp Fuzzing Engine: libFuzzer Fuzz Target: fuzzrequest Job Type: libfuzzerasanfasthttp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000555d7b8 Crash State: NULL Sanitizer: address ASAN Recommended...

php:php-fuzz-execute: Use-of-uninitialized-value in zend_generator_search_multi_children_node

Detailed Report: https://oss-fuzz.com/testcase?key=5146486399303680 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-execute Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: zendgeneratorsearchmultichildrennode...

FreeBSD-SA-20:30.ftpd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:30.ftpd Security Advisory The FreeBSD Project Topic: ftpd privilege escalation via ftpchroot feature Category: core Module: ftpd Announced: 2020-09-15...

Magecart Attack Impacts More Than 10K Online Shoppers

One of the largest known Magecart campaigns to date took place over the weekend, with nearly 2,000 e-commerce sites hacked in an automated campaign that may be linked to a zero-day exploit. The attacks have impacted tens of thousands of customers, who had their credit-card and other information...

svenkaesling.de Cross Site Scripting vulnerability OBB-1330648

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

gdal:gtiff_fuzzer: Heap-buffer-overflow in Fax3Decode2D

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5139548596862976 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gtifffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000000c80 Cra...

gdal:gtiff_fuzzer: Heap-buffer-overflow in Fax3Decode2D

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5428642430320640 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gtifffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000000c80 Cra...

eftacourt.int Improper Access Control vulnerability OBB-1309857

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

printabledailyplanners.com Cross Site Scripting vulnerability OBB-1306706

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ffmpeg:ffmpeg_AV_CODEC_ID_DXTORY_fuzzer: Heap-buffer-overflow in dxtory_decode_v1_420

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5152935225589760 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDDXTORYfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address...

Vulnerability Disclosure: Ethical Hackers Seek Best Practices

The process of vulnerability disclosure has improved over the years, but still too many security researchers face threats when trying to report bugs. Disclosure policies that give ethical hackers clear guidelines are vast and varied and are seldom universally followed, which adds to the friction...