UBUNTU-CVE-2022-22995

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code...

PT-2022-15765 · Afp +5 · Afp +5

Name of the Vulnerable Software and Affected Versions: SMB and AFP affected versions not specified Description: The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting this combination of primitives, an attacker can...

Western Digital My Cloud 后置链接漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A backlink vulnerability exists in Western Digital My Cloud OS 5 due to insufficient file validation during file uploads in the native language combination provided by SMB and AFP in its default configuration. A...

SEC Filing Reveals Fortune 500 Firm Targeted in Ransomware Attack

Fortune 500 integrated services firm R.R.Donnelley & Sons RRD is the latest victim of the hacking collective known as the Conti Group. According to regulatory disclosures RRD was the victim of a network breach that resulted in stolen data in December. RRD, a global firm with 33,000 employees,...

GoDaddy Data Breach Exposes Over 1 Million WordPress Customers' Data

Web hosting giant GoDaddy on Monday disclosed a data breach that resulted in the unauthorized access of data belonging to a total of 1.2 million active and inactive customers, making it the third security incident to come to light since 2018. In a filing with the U.S. Securities and Exchange...

The vulnerability in the implementation of SMB and AFP network protocol functions in the My Cloud OS operating systems allows a perpetrator to gain unauthorized access to protected information or execute arbitrary code.

The vulnerability of the SMB and AFP network protocol implementations in My Cloud OS operating systems is related to incorrect handling of symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or execute arbitrary code...

CVE-2021-3310

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure by reading local files...

CVE-2021-3310

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure by reading local files...

Chrome for Android Update

Hi, everyone! We've just released Chrome 86 86.0.4240.185 for Android: it'll become available on Google Play over the next few weeks. Security fixes in this release are listed in the corresponding Desktop Release. In addition, this Android release contains: $NA1144368 High CVE-2020-16010: Heap...

php:php-fuzz-execute: Use-of-uninitialized-value in zend_generator_search_multi_children_node

Detailed Report: https://oss-fuzz.com/testcase?key=5146486399303680 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-execute Job Type: libfuzzermsanphp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: zendgeneratorsearchmultichildrennode...

Twitter Could Face $250M FTC Fine Over Improper Data Use

Twitter may be facing a Federal Trade Commission FTC fine of up to $250 million, after the social media giant last year revealed the improper use of users’ email addresses and phone numbers. In October 2019, Twitter acknowledged that user phone numbers and email addresses gathered for security...

Vermont Taxpayers Warned of Data Leak Over the Past Three Years

The Vermont Department of Taxes may have been exposing taxpayer data that could be used in credential scams for more than three years due to a vulnerability in its online tax filing system. A notice PDF posted on the department’s website warned taxpayers who filed a Property Transfer Tax return...

php:php-fuzz-parser: Crash in _fini

Detailed Report: https://oss-fuzz.com/testcase?key=5630056790228992 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-parser Job Type: honggfuzzasanphp Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000012fabd4 Crash State: fini Sanitizer: address ASAN Recommended...

stb:stbi_read_fuzzer: Heap-buffer-overflow in load_jpeg_image

Detailed Report: https://oss-fuzz.com/testcase?key=5726154781884416 Project: stb Fuzzing Engine: afl Fuzz Target: stbireadfuzzer Job Type: aflasanstb Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62b000006e0f Crash State: loadjpegimage stbijpegload stbiloadmain...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_search_kerberos

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4791365602115584 Project: ndpi Fuzzing Engine: afl Fuzz Target: fuzzprocesspacket Job Type: aflasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60e00000029d Crash State...

ndpi:fuzz_process_packet: Heap-buffer-overflow in ndpi_check_spotify

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5644310457614336 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzprocesspacket Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 7 Crash Address: 0x60300000011f...

SQL Injection Vulnerability in New Commercial Housing Online Signing and Filing Management System sh***_im***.aspx Page

The online contract filing management system for newly-built commercial properties provides business management functions such as commercial property pre-sale license application, approval, commercial property booking, pre-sale, contract signing and online contract filing. SQL injection...

File Upload Vulnerability in Record Management System V3.1 of Shanghai Chuangqi World Technology Co.

Trunkey ICP/IP address information filing management system is a set of ISP service provider enterprise side filing management system. A file upload vulnerability exists in the filing management system V3.1 of Shanghai Trunkey Technology Co...

Command injection

A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filin...

Unauthorized Access Vulnerability in Profile 30.0 of Qixing Filing System (CNVD-2020-00011)

Qixing File System Profile 30.0 is a system for managing employee files, contracts, training, personnel, attendance, payroll and other information within an organization. Kaixing File System Profile 30.0 suffers from an unauthorized access vulnerability, which can be exploited by attackers to...