ALPINE-CVE-2019-8905

docorenote in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to fileprintable, a different vulnerability than CVE-2018-10360...

PT-2019-5198

Name of the Vulnerable Software and Affected Versions File version 5.35 Description The issue is related to a buffer overflow in the do core note function of the File utility, which is used to determine the types of given files. This can be exploited by a remote attacker to cause a denial of...

PT-2019-5655

Name of the Vulnerable Software and Affected Versions file version 5.35 Description The issue is related to a stack-based buffer over-read in the do bid note function in readelf.c in libmagic.a. This is connected to file printf and file vprintf. Exploitation of the issue may allow a remote attack...

PT-2019-5656

Name of the Vulnerable Software and Affected Versions file version 5.35 Description The issue is related to a stack-based buffer over-read in the do core note function in readelf.c in libmagic.a. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability...

PT-2019-19000

Name of the Vulnerable Software and Affected Versions Tcpreplay version 4.3.1 Description An issue in the do checksum function in checksum.c can be triggered by sending a crafted pcap file to the tcpreplay-edit binary, causing an invalid memory access. This can lead to a Denial of Service...

A week in security (February 4 – 8)

Last week on Malwarebytes Labs, we took a closer look at the technical and reputational challenges for Facebook as it tries to integrate secure messaging across Messenger, WhatsApp, and Instagram. We explored Google’s latest attempts to change how the public sees—literally—web browser URLs, gave...

River Past Cam Do 3.7.6 Local Buffer Overflow

Exploit Title: River Past CamDo SEH Local Exploit Date: 07.02.2019 Vendor Homepage:www.riverpast.com Software Link: https://en.softonic.com/download/river-past-cam-do/windows/post-download?sl=1 Exploit Author: Achilles Tested Version: 3.7.6 Tested on: Windows XP SP3 EN 1.- Run python code :...

CVE-2019-7236: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal...

PT-2019-18475

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered that allows directory traversal via the app parameter, set to /../, in the "admincp.php?app=apps&do=save" endpoint. This can lead to the creation of a ZIP archive file containi...

PT-2019-18478

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered in idreamsoft iCMS, allowing directory traversal through the editor/editor.admincp.php endpoint, specifically when accessing admincp.php?app=files&do=browse ... Recommendations...

CVE-2019-7237: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\ Directory Traversal...

Description of the security update for Outlook 2016: January 8, 2019

None None...

PT-2019-5197

Name of the Vulnerable Software and Affected Versions File version 5.35 Description The issue is related to an out-of-bounds read in the do core note function of the File utility, specifically in the readelf.c file within libmagic.a. This can lead to a denial of service. The problem arises from t...

PT-2018-15462

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue concerns a CSRF vulnerability in the ?do=user addpost endpoint. Recommendations For UCMS version 1.4.7, consider implementing proper CSRF protection mechanisms to prevent exploitation. As a temporary...

PT-2018-15476

Name of the Vulnerable Software and Affected Versions UWA version 2.3.11 Description The issue allows for a CSRF attack via the index.php?g=admin&c=admin&a=add admin do endpoint. Recommendations For version 2.3.11, consider implementing CSRF protection measures, such as token-based validation, to...

ALPINE-CVE-2018-1000845

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID: CVE-2017-6519. Reason: This candidate is a duplicate of CVE-2017-6519. Notes: All CVE users should reference CVE-2017-6519 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

cantinhodovideo.com XSS vulnerability

Open Bug Bounty ID: OBB-709400 Description| Value ---|--- Affected Website:| cantinhodovideo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Amazon Linux AMI : postgresql96 (ALAS-2018-1119)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side...

PT-2018-19052

Name of the Vulnerable Software and Affected Versions Android versions prior to Android-9 Description The issue is related to a possible out-of-bound read in the bta ag do disc function of bta ag sdp.cc. This could lead to remote information disclosure without requiring additional execution...

camposdojordaocultura.com.br XSS vulnerability

Open Bug Bounty ID: OBB-707046 Description| Value ---|--- Affected Website:| camposdojordaocultura.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...