mytiktok.com Cross Site Scripting vulnerability OBB-1301725

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

WordPress File Manager Plugin < 6.9 Arbitrary File Upload

We noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads lib/php/elFinderConnector.class.php...

php:php-fuzz-execute: Crash in zend_gc_delref

Detailed Report: https://oss-fuzz.com/testcase?key=5700128755941376 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f67427c7800 Crash State: zendgcdelref izvalptrdtor zenduncleanzvalptrdt...

dougpitassirealestateagent.webpin.com Cross Site Scripting vulnerability OBB-1295651

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Operation PowerFall: CVE-2020-0986 and variants

In August 2020, we published a blog post about Operation PowerFall. This targeted attack consisted of two zero-day exploits: a remote code execution exploit for Internet Explorer 11 and an elevation of privilege exploit targeting the latest builds of Windows 10. While we already described the...

pft.net Cross Site Scripting vulnerability OBB-1294736

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Cisco Issues Warning Over IOS XR Zero-Day Flaw Being Targeted in the Wild

Cisco has warned of an active zero-day vulnerability in its router software that's being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device. "An attacker could exploit these vulnerabilities by sending crafted IGMP...

Cisco Issues Warning Over IOS XR Zero-Day Flaw Being Targeted in the Wild

Cisco has warned of an active zero-day vulnerability in its router software that's being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device. "An attacker could exploit these vulnerabilities by sending crafted IGMP...

File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE

Seravo noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads...

File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE

Seravo noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::ljpeg_diff

Detailed Report: https://oss-fuzz.com/testcase?key=5663580178087936 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::ljpegdiff...

Quote of the Day (qotd) Service Detection (TCP)

TCP based detection of a Quote of the Day qotd service. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

esanlocalgov.com Cross Site Scripting vulnerability OBB-1280448

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-17397

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the...

leptonica:pix4_fuzzer: Use-of-uninitialized-value in pixGetCmapHistogramInRect

Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=4713657823657984 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: pix4fuzzer Job Type: libfuzzermsanleptonica Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

c-blosc2:decompress_fuzzer: Heap-buffer-overflow in tinfl_decompress

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5120916286341120 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressfuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

This Week in Security News: Trend Micro’s Zero Day Initiative Celebrates 15 Years and 24 Million Customers Affected after Experian Data Breach

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read how the Zero Day Initiative ZDI has awarded more than $25 million in bounty rewards to security researchers over the past decade and a...

mail.forex-day-trading.com Cross Site Scripting vulnerability OBB-1262307

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

libyal:libbde_volume_fuzzer: Heap-buffer-overflow in libbde_metadata_read_volume_master_key

Detailed Report: https://oss-fuzz.com/testcase?key=5036694974496768 Project: libyal Fuzzing Engine: honggfuzz Fuzz Target: libbdevolumefuzzer Job Type: honggfuzzasanlibyal Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x60300000098c Crash State:...

Mac Users Targeted by Spyware Spreading via Xcode Projects

A campaign aimed at Mac users is spreading the XCSSET suite of malware, which has the capability to hijack the Safari web browser and inject various JavaScript payloads that can steal passwords, financial data and personal information, deploy ransomware and more. Infections are propagating via...