PENTOL - Pentester Toolkit For Fiddler2

PENTOL - Pentester Toolkit is built as a plugin for the Fiddler HTTP debugging proxy. Features CORS DETECTED Cross-Origin Resource Sharing CRLF DETECTED HTTP response splitting Headers DETECTED X-Frame-Options USAGE Install Fiddler2 Open Fiddler2 Press Key CTRL + R or Rules Customize Rules... Cop...

Node.js: Node.js HTTP/2 Large Settings Frame DoS

Hi, I would like to report a vulnerability in the http2 module of Node.js. In section 10.5 of the HTTP/2 RFC an attack is described where an attacker is sending large SETTINGS frames that includes many settings inside it. We tested this scenario by opening many connections to the server and sendi...

Google Android Buffer Overflow Vulnerability (CNVD-2019-27585)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A buffer overflow vulnerability exists in the ixheaacdextractframeinfold of the ixheaacdenvextr.c file in Android version 9, which stems from a lack of boundary checking in the...

[SECURITY] Fedora 29 Update: mingw-SDL2_image-2.0.4-1.fc29

Simple DirectMedia Layer SDL2 is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device. This package contains a simple library for loading images of various formats BMP, PPM, PCX, GIF, JPEG, PNG as SDL2 surfaces...

[SECURITY] Fedora 28 Update: mingw-SDL2_image-2.0.4-1.fc28

Simple DirectMedia Layer SDL2 is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device. This package contains a simple library for loading images of various formats BMP, PPM, PCX, GIF, JPEG, PNG as SDL2 surfaces...

CVE-2018-9532

In ixheaacdextractframeinfold of ixheaacdenvextr.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9...

Libav Heap Buffer Over Read Vulnerability

Libav is an open source audio and video processing tools , providing for conversion , manipulation and streaming of various multimedia formats and protocols cross-platform tools and libraries . A heap buffer over-read vulnerability exists in decodeframe in libavcodec/lcldec.c in Libav 12.3, which...

UBUNTU-CVE-2018-19128

In Libav 12.3, there is a heap-based buffer over-read in decodeframe in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi file...

PT-2018-14822 · FFmpeg · Libav

Name of the Vulnerable Software and Affected Versions: Libav version 12.3 Description: The issue is related to an invalid memory access in the vc1 decode frame function in libavcodec/vc1dec.c, which can be exploited by attackers to cause a denial-of-service via a crafted aac file. Recommendations...

PT-2018-14820

Name of the Vulnerable Software and Affected Versions Libav version 12.3 Description The issue is a heap-based buffer over-read in the decode frame function in libavcodec/lcldec.c, which can be exploited by an attacker to cause a denial-of-service using a crafted avi file. Recommendations For Lib...

CVE-2018-6909

A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request...

Design/Logic Flaw

A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request...

CVE-2018-6909

CVE-2018-6909 affects Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 Web Application. Root cause: missing X-Frame-Options header. Impact: allows clickjacking by remote attacker via an API page request; CVSSv3 base score 6.5 (NETWORK, LOW toward exploitation, user interactio...

CVE-2018-6909: Improper Restriction of Rendered UI Layers or Frames

A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request...

PT-2018-17817

Name of the Vulnerable Software and Affected Versions Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 affected versions not specified Description A missing X-Frame-Options header in the web application could be used by a remote attacker for clickjacking, as demonstrated by...

PT-2018-14677

Name of the Vulnerable Software and Affected Versions Libav version 12.3 Description A NULL pointer dereference exists in the ff vc1 parse frame header adv function in vc1.c, which can be exploited by attackers to cause a denial-of-service through a crafted file. Recommendations For Libav version...

CVE-2018-0378

A vulnerability in the Precision Time Protocol PTP feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a lack of...

CVE-2018-0378: Improper Input Validation

A vulnerability in the Precision Time Protocol PTP feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a lack of...

PT-2018-1741

Name of the Vulnerable Software and Affected Versions Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software affected versions not specified Description A vulnerability in the Precision Time Protocol PTP feature could allow an unauthenticated, remote attacker to cause a...

Centos Web Panel 0.9.8.480 XSS / LFI / Code Execution

Exploit Title: Centos Web Panel 0.9.8.480 Multiple Vulnerabilities Exploit Author: Seccops - Siber GA1/4venlik Hizmetleri https://seccops.com Vendor Homepage: http://centos-webpanel.com/ Software Link: http://centos-webpanel.com/system-requirements Version: 0.9.8.480 Tested on: Centos 7...