gdal/gdal_filesystem_fuzzer: Heap-buffer-overflow in ycc_rgb_convert

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5359746084241408 Project: gdal Fuzzer: aflgdalfilesystemfuzzer Fuzz target binary: gdalfilesystemfuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

Security Bulletin: Tivoli Workload Scheduler is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and...

Phabricator: Administrator can create user without entering high security mode

When an administrator wants to create a user, he can go to https://phabricator.example.com/people/create/ and will be required to enter his MFA token in order to enter high security mode. However, if an administrator goes to https://phabricator.example.com/people/new/standard/ he will bypass the...

Asylo Open-Source Framework Tackles TEEs for Cloud

Asylo, an open-source framework and software development kit SDK for creating applications that run in trusted execution environments TEEs, has launched to tackle the complexity involved in running a confidential computing platform for workloads in the cloud and virtual environments. TEEs provide...

open62541/fuzz_binary_decode: Heap-use-after-free in UA_Array_copy

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5212581976342528 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarydecode Fuzz target binary: fuzzbinarydecode Job Type: libfuzzerasanopen62541 Platform Id: linux Crash Type:...

cras/cras_rclient_message: Heap-use-after-free in cras_fmt_conv_destroy

Detailed report: https://oss-fuzz.com/testcase?key=4889818489159680 Project: cras Fuzzer: aflcrasrclientmessage Fuzz target binary: rclientmessage Job Type: aflasancras Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x610000005150 Crash State: crasfmtconvdestroy...

dlplibs/pdbfuzzer: Heap-buffer-overflow in ucnv_UTF8FromUTF8

Detailed report: https://oss-fuzz.com/testcase?key=6686971150729216 Project: dlplibs Fuzzer: libFuzzerdlplibspdbfuzzer Fuzz target binary: pdbfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x606000000300 Crash State: ucnvUTF8FromUT...

XAMPP Control Panel - Denial Of Service

''' + Credits: John Page hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/XAMPP-CONTROL-PANEL-MEMORY-CORRUPTION-DOS.txt + ISR: ApparitionSec Vendor: ===================== www.apachefriends.org Product: =================== XAMPP Control Panel XAMPP...

SPIP 3.1.2 Cross Site Request Forgery

SPIP 3.1.2 Exec Code Cross-Site Request Forgery CVE-2016-7980 Product Description SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU/GPL licence. Vulnerability...

The vulnerability of the Internet Explorer browser allows a malicious attacker to compromise the confidentiality and integrity of protected information.

A vulnerability that allows bypassing security mechanisms exists in Internet Explorer and is related to the improper implementation of requirements for high-security SSL certificates, particularly regarding the prohibition on using group certificates. Exploiting this vulnerability enables a...

FerretCMS 2.0.2-alpha - CSRF / Full Path Disclosure Vulnerabilities

Exploit for php platform in category web applications Title : FerretCMS 2.0.2-alpha - Exploit CSRF Vulnerability Author : ZwX Date : 24/02/2015 Download : https://codeload.github.com/JRogaishio/ferretCMS/zip/master Vendor : https://github.com/JRogaishio Level Security : Hight Tested on : Windows ...

Zer0 - Secured file deletion made easy

Zer0 is a user friendly file deletion tool with a high level of security. With Zer0, you'll be able to delete files and to prevent file recovery by a 3rd person. So far, no user reported an efficient method to recover a file deleted by Zer0. Features User friendly HMI : Drag'n'drop, 1 click and t...

WORK System E-Commerce <= 3.0.1 - Remote Include Vulnerability

No description provided by source. ============================================================================================ WORK System E-Commerce ginclude Remote File Inclusion Vulnerability ============================================================================================...

Web Wiz Forums 9.68 SQLi Vulnerability

No description provided by source. ========================================= Web Wiz Forums 9.68 SQLi Vulnerability ========================================= Name : Web Wiz Forums 9.68 SQLi Vulnerability Date : june, 9 2010 Vendor url :http://www.webwiz.co.uk/webwizforums/ Platform: Windows...

Python CGIHTTPServer Encoded Path Traversal Vulnerability

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root. The CGIHTTPServer Python module does not properly handle URL-encoded path...

Important: nrpe

Issue Overview: DISPUTED Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor NRPE 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/checknrpe. NOTE: this issue is disputed by multiple parties. It ha...

CVE-2014-2913

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor NRPE 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/checknrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the...

Microsoft Internet Explorer内存破坏漏洞(MS14-010)

CVECAN ID:...

Enghouse Interactive IVR Pro (VIP2000) Remote Root

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 XPD - XPD Advisory https://xpd.se Enghouse Interactive IVR Pro VIP2000 remote root authentication bypass Vulnerability Advisory ID: XPD-2013-001 CVE reference: CVE-2013-6838 Affected platforms: IVR Pro/Contact Center VIP2000 platforms with OpenVZ an...

FileMaster SY-IT 3.1 iOS - Multiple Web Vulnerabilities

FileMaster SY-IT 3.1 iOS - Multiple Web Vulnerabilities Document Title: =============== FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1170 Release Date: ============= 2013-12-16 Vulnerability...