Inflection: HTTP Host Header Injection on app.goodhire.com

Researcher reported an issue that was previously reported by a different researcher and subsequently removed from program scope and then requested that we publicly disclose the report after closing it as a duplicate...

Inflection: Host Header Injection and Cache Poisoning

Researcher submitted a report duplicating an issue that had already been reported to us, and then requested that we disclose this report publicly. So here we are...

Inflection: Goodhire Open Redirect

Researcher reported a duplicate issue...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 3 (VA MN: 7.0.2-510, VA Agent: 7.0.2-258)

This hotfix for Virtuozzo Automator 7.0.2 provides new features as well as stability and usability bug fixes. Vulnerability id: PVA-34527 Alert reason would not be shown on clicking the alert icon on the virtual environment or hardware node summary page if the corresponding event had already been...

CVE-2017-15083

CVE-2017-15083 is a reservation/duplicate of CVE-2009-1642. The connected records describe Mini‑stream ASX to MP3 Converter 3.0.0.7 as vulnerable to multiple stack-based buffer overflows enabling remote code execution via crafted inputs (e.g., a long RTSP URL in a .ram file or a long string in th...

Razer US: Reflected XSS on the https://deals.razerzone.com/json/translation endpoint

Thanks to SP1D3RS for the great report and working with the team on this one. This was a trivial POST-XSS, caused by using text/html Content-Type on the JSON endpoint, and ability to control the part of the response using unsanitized input. Why I disclosed it if this is a trivial issue? I pretty...

CVE-2017-5716

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-12865. Reason: This candidate is a reservation duplicate of CVE-2017-12865. Notes: All CVE users should reference CVE-2017-12865 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2017-5716

Summary: ConnMan contains a stack-based buffer overflow in the DNS proxy (dnsproxy.c) that can be exploited by crafted DNS responses to cause a denial of service or remote code execution. This vulnerability has CVEs linked to CVE-2017-12865 and CVE-2017-5716, with public advisories noting remote ...

Legal Robot: Error the message with already e-mail

Hi team .. I found bug on your site i register with already e-mail your site show me this message please verify your e-mail click to resend verification email please fixed it soon change the message to this e-mail already sign up with other user .. PoC .. screenshow...

Excluding already redirected folders with UPM

Customers environment has Windows Settings\Folder Redirection setup for Documents or other folders. If UPM is also in use, the redirected folder might get a duplicate copy after UPM processes the logon. This is by design and expected...

UBUNTU-CVE-2017-13753

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9396. Reason: This candidate is a duplicate of CVE-2016-9396. Notes: All CVE users should reference CVE-2016-9396 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usag...

CVE-2017-13753

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9396. Reason: This candidate is a duplicate of CVE-2016-9396. Notes: All CVE users should reference CVE-2016-9396 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2017-13753

JasPer (JPEG-2000 codec) is affected by two documented CVEs: CVE-2016-9396 (reachable assertion in JPC_NOMINALGAIN) and CVE-2017-1000050 (NULL pointer exception in jp2_encode). Multiple vendor advisories confirm affected products and fixes, e.g., Red Hat/CentOS (CESA RHSA-2018:3253) and IBM Power...

CVE-2017-1000123

CVE-2017-1000123 is a reservation duplicate of CVE-2017-12425. Connected records provide concrete details for CVE-2017-12425: a denial-of-service vulnerability in Varnish (Varnish Cache) caused by a faulty if statement in varnishd that can trigger an assertion when processing invalid client reque...

CVE-2017-1000162

CVE-2017-1000162 is rejected and not used; reference CVE-2017-12474/12475/12476.

CVE-2017-1000205

CVE-2017-1000205 is rejected; reference CVE-2017-9091 instead.

CVE-2017-1000216

CVE-2017-1000216 is a reservation duplicate of CVE-2017-11104 and should reference CVE-2017-11104. The active vulnerability is CVE-2017-11104 in Knot DNS: versions 2.4.x prior to 2.4.5 and 2.5.x prior to 2.5.2 contain a TSIG authentication bypass due to an improper TSIG validity period check. Exp...

CVE-2017-1000202

CVE-2017-1000202 is a reserved/duplicate entry; refer to CVE-2017-12933.

CVE-2017-1000165

CVE-2017-1000165 is a rejected/duplicate entry and should reference CVE-2017-11366.

CVE-2017-1000177

CVE-2017-1000177 is a reservation/duplicate of CVE-2017-11097. The connected records describe the underlying issue as: SWFTools 0.9.2 processes a crafted SWF file in swfc, causing a NULL pointer dereference in dict_lookup() in lib/q.c. This is the same vulnerability tracked under CVE-2017-11097; ...