readingsameday.co.uk Cross Site Scripting vulnerability OBB-1256501

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

libavif:avif_decode_fuzzer: Crash in avifDecoderDataFillImageGrid

Project: https://github.com/AOMediaCodec/libavif.git Detailed Report: https://oss-fuzz.com/testcase?key=5201315165372416 Project: libavif Fuzzing Engine: libFuzzer Fuzz Target: avifdecodefuzzer Job Type: libfuzzerasanlibavif Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7fb81ac821...

lineartek.cn Cross Site Scripting vulnerability OBB-1252486

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : ppp vulnerability (USN-4451-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4451-1 advisory. Thomas Chauchefoin working with Trend Micros Zero Day Initiative, discovered that ppp incorrectly handled module loading. A local attacker...

USN-4452-1: libvirt vulnerability

Trent Shea working with Trend Micro´s Zero Day Initiative, discovered that the libvirt package set incorrect permissions on the UNIX domain socket. A local attacker could use this issue to access libvirt and escalate privileges...

USN-4452-1 libvirt vulnerability

Trent Shea working with Trend Micro´s Zero Day Initiative, discovered that the libvirt package set incorrect permissions on the UNIX domain socket. A local attacker could use this issue to access libvirt and escalate privileges...

ffmpeg:ffmpeg_AV_CODEC_ID_CFHD_fuzzer: Heap-buffer-overflow in filter

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5148519623819264 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDCFHDfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6220000000d...

libucl:ucl_add_string_fuzzer: Heap-buffer-overflow in ucl_expand_variable

Project: https://github.com/vstakhov/libucl.git Detailed Report: https://oss-fuzz.com/testcase?key=5469837653180416 Project: libucl Fuzzing Engine: honggfuzz Fuzz Target: ucladdstringfuzzer Job Type: honggfuzzasanlibucl Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

libheif:encoder-fuzzer: Heap-buffer-overflow in x265::PicYuv::copyFromPicture

Project: https://github.com/strukturag/libheif.git Detailed Report: https://oss-fuzz.com/testcase?key=5148929759641600 Project: libheif Fuzzing Engine: libFuzzer Fuzz Target: encoder-fuzzer Job Type: libfuzzerasanlibheif Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

nanopb:fuzztest: Heap-buffer-overflow in allocate_field

Project: https://github.com/nanopb/nanopb.git Detailed Report: https://oss-fuzz.com/testcase?key=5646298464911360 Project: nanopb Fuzzing Engine: afl Fuzz Target: fuzztest Job Type: aflasannanopb Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x621000008956 Crash State...

weberbauer.at1.webbox.interalp.at Cross Site Scripting vulnerability OBB-1246496

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

penetration-1

This is a collection of 0-day exploits for various web applications, including CreateLive CMS, BlueCMS, and DVBBS. The exploits are written in a mix of languages, including Chinese, Russian, and English. The exploits target various vulnerabilities, including SQL injection, cross-site scripting XS...

Zoom Flaw Could Have Allowed Hackers To Crack Meeting Passcodes

A security issue in popular video conferencing platform Zoom was disclosed this week, which could have allowed attackers to crack private meeting passcodes and snoop in on video conferences. The problem, which has already been fixed, stems from Zoom not having any check against repeated incorrect...

harfbuzz:hb-shape-fuzzer: Crash in hb_realloc_impl

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5675987258572800 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

Root Cause Analyses for 0-day In-the-Wild Exploits

Posted by Maddie Stone, Project Zero When a 0-day is exploited in the wild AND it is detected, we need to use that as an opportunity to learn as much as possible about the vulnerability and the exploit if we hope to make 0-day hard. One of the main methods to do that is to perform a root cause...

Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019

Posted by Maddie Stone, Project Zero In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post...

php:php-fuzz-parser: Heap-use-after-free in destroy_op_array

Detailed Report: https://oss-fuzz.com/testcase?key=5668642998714368 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-parser Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x606000013760 Crash State: destroyoparray fuzzerdorequest...

grok:grk_decompress_fuzzer: Container-overflow in grk::T2Decode::read_packet_header

Detailed Report: https://oss-fuzz.com/testcase?key=5136412048097280 Project: grok Fuzzing Engine: honggfuzz Fuzz Target: grkdecompressfuzzer Job Type: honggfuzzasangrok Platform Id: linux Crash Type: Container-overflow READ 8 Crash Address: 0x61500007a760 Crash State:...

envoy:xds_fuzz_test: Heap-use-after-free in std::__1::__list_iterator<std::__1::unique_ptr<Envoy::Server::ListenerImpl, std:

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5715241737125888 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: xdsfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x603000f1b6...

Beers with Talos Ep. #88: It’s not about the vote, it’s about trust

Beers with Talos BWT Podcast episode No. 88 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded July 7, 2020 Nigel is out this week, but we have a...