fasthttp:fuzz_request: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5745696710590464 Project: fasthttp Fuzzing Engine: libFuzzer Fuzz Target: fuzzrequest Job Type: libfuzzerasanfasthttp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000555d7b8 Crash State: NULL Sanitizer: address ASAN Recommended...

php:php-fuzz-execute: Use-of-uninitialized-value in zend_generator_search_multi_children_node

Detailed Report: https://oss-fuzz.com/testcase?key=5146486399303680 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-execute Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: zendgeneratorsearchmultichildrennode...

FreeBSD-SA-20:30.ftpd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:30.ftpd Security Advisory The FreeBSD Project Topic: ftpd privilege escalation via ftpchroot feature Category: core Module: ftpd Announced: 2020-09-15...

Magecart Attack Impacts More Than 10K Online Shoppers

One of the largest known Magecart campaigns to date took place over the weekend, with nearly 2,000 e-commerce sites hacked in an automated campaign that may be linked to a zero-day exploit. The attacks have impacted tens of thousands of customers, who had their credit-card and other information...

svenkaesling.de Cross Site Scripting vulnerability OBB-1330648

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

gdal:gtiff_fuzzer: Heap-buffer-overflow in Fax3Decode2D

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5139548596862976 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gtifffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000000c80 Cra...

gdal:gtiff_fuzzer: Heap-buffer-overflow in Fax3Decode2D

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5428642430320640 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gtifffuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x615000000c80 Cra...

eftacourt.int Improper Access Control vulnerability OBB-1309857

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

printabledailyplanners.com Cross Site Scripting vulnerability OBB-1306706

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ffmpeg:ffmpeg_AV_CODEC_ID_DXTORY_fuzzer: Heap-buffer-overflow in dxtory_decode_v1_420

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5152935225589760 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDDXTORYfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address...

Vulnerability Disclosure: Ethical Hackers Seek Best Practices

The process of vulnerability disclosure has improved over the years, but still too many security researchers face threats when trying to report bugs. Disclosure policies that give ethical hackers clear guidelines are vast and varied and are seldom universally followed, which adds to the friction...

mytiktok.com Cross Site Scripting vulnerability OBB-1301725

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

WordPress File Manager Plugin < 6.9 Arbitrary File Upload

We noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads lib/php/elFinderConnector.class.php...

php:php-fuzz-execute: Crash in zend_gc_delref

Detailed Report: https://oss-fuzz.com/testcase?key=5700128755941376 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f67427c7800 Crash State: zendgcdelref izvalptrdtor zenduncleanzvalptrdt...

dougpitassirealestateagent.webpin.com Cross Site Scripting vulnerability OBB-1295651

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Operation PowerFall: CVE-2020-0986 and variants

In August 2020, we published a blog post about Operation PowerFall. This targeted attack consisted of two zero-day exploits: a remote code execution exploit for Internet Explorer 11 and an elevation of privilege exploit targeting the latest builds of Windows 10. While we already described the...

pft.net Cross Site Scripting vulnerability OBB-1294736

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Cisco Issues Warning Over IOS XR Zero-Day Flaw Being Targeted in the Wild

Cisco has warned of an active zero-day vulnerability in its router software that's being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device. "An attacker could exploit these vulnerabilities by sending crafted IGMP...

Cisco Issues Warning Over IOS XR Zero-Day Flaw Being Targeted in the Wild

Cisco has warned of an active zero-day vulnerability in its router software that's being exploited in the wild and could allow a remote, authenticated attacker to carry out memory exhaustion attacks on an affected device. "An attacker could exploit these vulnerabilities by sending crafted IGMP...

File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE

Seravo noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads...