Veris: Complete or Edit Another User's Profile

Hi, I've found an issue where verified users can complete and submit a profile on behalf of another user. I've attached two video POCs unlisted on YouTube. Completion - https://www.youtube.com/watch?v=erH7ShUpqso Editing - https://youtu.be/IQboAIHNpq4 Steps to reproduce: 1. Register a new user...

New Relic: Emails and alert policies can be altered by malicious users.

Recreate Steps 1 Create Two Accounts 2 In separate browsers Firefox and Chrome log into each account and go to the edit page a https://rpm.newrelic.com/users//edit 3 Check one of the email or alert boxes and click save. Gather the post. a Should be similar to this:...

E-TILLER期刊采编系统 /ch/reader/inner_key_query_article_list.aspx等2处 POST注入漏洞

No description provided by source...

IBM WebSphere Portal Design Vulnerability

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects the internal and external parts of an organization, allowing employees, customers and suppliers to access internal data through the platform. A security vulnerability exists in IB...

PDF Editing Code Execution

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow a malicious actor to...

[SECURITY] Fedora 22 Update: code-editor-2.8.1-13.fc22

CodeEditor is a slimmed down, customized version of Qt Creator that focuses on bringing its text/code modern editing capabilities to users looking for just a simpl e and beautiful editor...

[SECURITY] Fedora 23 Update: code-editor-2.8.1-13.fc23

CodeEditor is a slimmed down, customized version of Qt Creator that focuses on bringing its text/code modern editing capabilities to users looking for just a simpl e and beautiful editor...

Adobe Reader PDF Code Execution

The vulnerability of PDF viewing and editing programs like Adobe Reader, Document Cloud, Adobe Reader, and Adobe Acrobat is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

[SECURITY] Fedora 22 Update: shotwell-0.23.0-0.1.20160105gitf2fb1f7.fc22

Shotwell is an easy-to-use, fast photo organizer designed for the GNOME desktop. It allows you to import photos from your camera or disk, organize them by date and subject matter, even ratings. It also offers basic photo editing, like crop, red-eye correction, color adjustments, and straighten...

[SECURITY] Fedora 23 Update: shotwell-0.23.0-0.1.20160105gitf2fb1f7.fc23

Shotwell is an easy-to-use, fast photo organizer designed for the GNOME desktop. It allows you to import photos from your camera or disk, organize them by date and subject matter, even ratings. It also offers basic photo editing, like crop, red-eye correction, color adjustments, and straighten...

Debian Security Advisory DSA 3440-1 (sudo - security update)

When sudo is configured to allow a user to edit files under a directory that they can already write to without using sudo, they can actually edit read and write arbitrary files. Daniel Svartman reported that a configuration like this might be introduced unintentionally if the editable files are...

DLA-382-1 sudo - security update

Bulletin has no description...

Adobe Issues HotFix For ColdFusion

Adobe this afternoon released hotfixes and security updates for three of its products that patch a handful of vulnerabilities, none of which are being publicly exploited. The most serious vulnerabilities were in ColdFusion, Adobe’s web application development platform. The hotfix affects ColdFusi...

[SECURITY] Fedora 22 Update: owncloud-8.0.9-1.fc22

ownCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. ownCloud is extendable via a simple but powerful API f...

PDF Editing Acrobat Document Cloud Privilege Escalation

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, are related to deficiencies in access control mechanisms. Exploiting these vulnerabilities can allow attackers to...

PDF Editing JavaScript Bypass

The vulnerability of the CBSharedReviewIfOfflineDialog method in PDF editing programs from Adobe Acrobat and Adobe Acrobat Document Cloud, as well as in PDF viewing programs from Adobe Reader and Adobe Reader Document Cloud, is related to deficiencies in access control for certain functions...

PDF Editing JavaScript Bypass

The vulnerability of the CBAutoConfigCommentRepository method in PDF editing programs from Adobe Acrobat and Adobe Acrobat Document Cloud, as well as in PDF viewing programs from Adobe Reader and Adobe Reader Document Cloud, is related to deficiencies in access control for certain functions...

PDF Editing Code Execution

The vulnerabilities of Adobe Acrobat and Adobe Acrobat Document Cloud for PDF file editing, as well as Adobe Reader and Adobe Reader Document Cloud for PDF file viewing, are due to buffer overflow vulnerabilities. Exploiting these vulnerabilities can allow an attacker to execute arbitrary code or...

PDF Editing Code Execution

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow a malicious actor to...

Adobe Acrobat Document Cloud PDF Memory Access

The vulnerabilities of Adobe Acrobat and Adobe Acrobat Document Cloud for editing PDF files, as well as Adobe Reader and Adobe Reader Document Cloud for viewing PDF files, are related to deficiencies in access control mechanisms. Exploiting these vulnerabilities can allow attackers to gain access...