7128 matches found
File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE
Seravo noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads...
imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::ljpeg_diff
Detailed Report: https://oss-fuzz.com/testcase?key=5663580178087936 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::ljpegdiff...
Quote of the Day (qotd) Service Detection (TCP)
TCP based detection of a Quote of the Day qotd service. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
esanlocalgov.com Cross Site Scripting vulnerability OBB-1280448
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-17397
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the...
leptonica:pix4_fuzzer: Use-of-uninitialized-value in pixGetCmapHistogramInRect
Project: https://github.com/DanBloomberg/leptonica.git Detailed Report: https://oss-fuzz.com/testcase?key=4713657823657984 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: pix4fuzzer Job Type: libfuzzermsanleptonica Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...
c-blosc2:decompress_fuzzer: Heap-buffer-overflow in tinfl_decompress
Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5120916286341120 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressfuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...
This Week in Security News: Trend Micro’s Zero Day Initiative Celebrates 15 Years and 24 Million Customers Affected after Experian Data Breach
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read how the Zero Day Initiative ZDI has awarded more than $25 million in bounty rewards to security researchers over the past decade and a...
mail.forex-day-trading.com Cross Site Scripting vulnerability OBB-1262307
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
libyal:libbde_volume_fuzzer: Heap-buffer-overflow in libbde_metadata_read_volume_master_key
Detailed Report: https://oss-fuzz.com/testcase?key=5036694974496768 Project: libyal Fuzzing Engine: honggfuzz Fuzz Target: libbdevolumefuzzer Job Type: honggfuzzasanlibyal Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x60300000098c Crash State:...
Mac Users Targeted by Spyware Spreading via Xcode Projects
A campaign aimed at Mac users is spreading the XCSSET suite of malware, which has the capability to hijack the Safari web browser and inject various JavaScript payloads that can steal passwords, financial data and personal information, deploy ransomware and more. Infections are propagating via...
sleuthkit:sleuthkit_fls_hfs_fuzzer: Heap-buffer-overflow in hfs_cat_traverse
Detailed Report: https://oss-fuzz.com/testcase?key=6261381394071552 Project: sleuthkit Fuzzing Engine: libFuzzer Fuzz Target: sleuthkitflshfsfuzzer Job Type: libfuzzerasansleuthkit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61e000000a8a Crash State: hfscattraverse...
util-linux:test_fdisk_script_fuzz: Heap-buffer-overflow in fdisk_partname
Project: https://github.com/karelzak/util-linux.git Detailed Report: https://oss-fuzz.com/testcase?key=5705475858104320 Project: util-linux Fuzzing Engine: libFuzzer Fuzz Target: testfdiskscriptfuzz Job Type: libfuzzerasani386util-linux Platform Id: linux Crash Type: Heap-buffer-overflow READ 1...
Microsoft Reveals New Innocent Ways Windows Users Can Get Hacked
Microsoft earlier today released its August 2020 batch of software security updates for all supported versions of its Windows operating systems and other products. This month's Patch Tuesday updates address a total of 120 newly discovered software vulnerabilities, of which 17 are critical, and th...
Microsoft Reveals New Innocent Ways Windows Users Can Get Hacked
Microsoft earlier today released its August 2020 batch of software security updates for all supported versions of its Windows operating systems and other products. This month's Patch Tuesday updates address a total of 120 newly discovered software vulnerabilities, of which 17 are critical, and th...
Internet Explorer and Windows zero-day exploits used in Operation PowerFall
Executive summary In May 2020, Kaspersky technologies prevented an attack on a South Korean company by a malicious script for Internet Explorer. Closer analysis revealed that the attack used a previously unknown full chain that consisted of two zero-day exploits: a remote code execution exploit f...
Google Chrome Bug Could Let Hackers Bypass CSP Protection; Update Web Browsers
If you haven't recently updated your Chrome, Opera, or Edge web browser to the latest available version, it would be an excellent idea to do so as quickly as possible. Cybersecurity researchers on Monday disclosed details about a zero-day flaw in Chromium-based web browsers for Windows, Mac and...
A New vBulletin 0-Day RCE Vulnerability and Exploit Disclosed Publicly
A security researcher earlier today publicly revealed details and proof-of-concept exploit code for an unpatched, critical zero-day remote code execution vulnerability affecting the widely used internet forum software vBulletin that's already under active exploitation in the wild. vBulletin is a...
A New vBulletin 0-Day RCE Vulnerability and Exploit Disclosed Publicly
A security researcher earlier today publicly revealed details and proof-of-concept exploit code for an unpatched, critical zero-day remote code execution vulnerability affecting the widely used internet forum software vBulletin that's already under active exploitation in the wild. vBulletin is a...
Researcher Publishes Patch Bypass for vBulletin 0-Day
A security researcher has published proof-of-concept code to outsmart a patch issued last year for a zero-day vulnerability discovered in vBulletin, a popular software for building online community forums. Calling a patch for the flaw a “fail” and “inadequate in blocking exploitation,” Austin-bas...