IDOR can reveal execution data and logs to unauthorized user in Rundeck

Impact Authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is...

libzmq:socket_bind_fuzzer: Heap-buffer-overflow in zmq::tcp_read

Project: https://github.com/zeromq/libzmq.git Detailed Report: https://oss-fuzz.com/testcase?key=5669751377625088 Project: libzmq Fuzzing Engine: libFuzzer Fuzz Target: socketbindfuzzer Job Type: libfuzzerasani386libzmq Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...

Project Open CMS 5.0.3 Cross Site Scripting / SQL Injection

Document Title: =============== Project Open v5.0.3 CMS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2225 Release Date: ============= 2020-04-25 Vulnerability Laboratory ID VL-ID: ==================================== 22...

HardDrive v2.1 iOS - Arbitrary File Upload Vulnerability

Document Title: =============== HardDrive v2.1 iOS - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2221 Release Date: ============= 2020-04-28 Vulnerability Laboratory ID VL-ID: ====================================...

File Explorer 1.4 Information Disclosure

Document Title: =============== File Explorer v1.4 iOS - Information Disclosure Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2220 Release Date: ============= 2020-04-28 Vulnerability Laboratory ID VL-ID:...

neomutt:address-fuzz: Stack-buffer-overflow in mutt_addrlist_parse

Project: https://github.com/neomutt/neomutt.git Detailed Report: https://oss-fuzz.com/testcase?key=5731491599613952 Project: neomutt Fuzzing Engine: libFuzzer Fuzz Target: address-fuzz Job Type: libfuzzerasanneomutt Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash Address:...

Project Open v5.0.3 PMS - Multiple Web Vulnerabilities

Document Title: =============== Project Open v5.0.3 PMS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2225 Release Date: ============= 2020-04-24 Vulnerability Laboratory ID VL-ID: ==================================== 22...

radare2:ia_fuzz: Heap-buffer-overflow in read_reloc

Project: https://github.com/radare/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=5635500556943360 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x6210000a897...

Foxit PDF Reader, PhantomPDF Open to Remote Code Execution

Foxit Software has released patches for dozens of high-severity flaws impacting its PDF reader and editor platforms. The most severe of the bugs, which exist on Windows versions of the software, enable a remote attacker to execute arbitrary code on vulnerable systems. Overall, Foxit Software...

Sky File v2.1.0 iOS - Multiple Web Vulnerabilities

Document Title: =============== Sky File v2.1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2207 Release Date: ============= 2020-04-20 Vulnerability Laboratory ID VL-ID: ==================================== 2207...

grpc:client_fuzzer: Heap-use-after-free in gpr_unref

Detailed Report: https://oss-fuzz.com/testcase?key=5680426091020288 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: clientfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x610000000040 Crash State: gprunref grpcerrordounref...

suricata:fuzz_applayerparserparse: Heap-use-after-free in htp_connp_is_line_terminator

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=5099629239861248 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzapplayerparserparse Job Type: libfuzzerasansuricata Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Addres...

CVE-2020-2953

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications component: Promotions. The supported version that is affected is 18.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2020-2950

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Analytics Web General. Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker wi...

CVE-2020-2758

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ...

File Transfer iFamily 2.1 Directory Traversal

Document Title: =============== File Transfer iFamily v2.1 - Directory Traversal Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2199 Release Date: ============= 2020-04-14 Vulnerability Laboratory ID VL-ID:...

AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-29592 Potential Impact: Denial of service, privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2013-4312, CVE-2013-7446, CVE-2014-3631, CVE-2014-5206, CVE-2014-5207, CVE-2014-6410, CVE-2014-7145, CVE-2014-782...

WSO2 3.1.0 - Arbitrary File Delete

Title: WSO2 3.1.0 - Arbitrary File Delete Date: 2020-04-12 Author: raki ben hamouda Vendor: https://apim.docs.wso2.com Softwrare link: https://apim.docs.wso2.com/en/latest/ CVE: N/A Document Title: =============== WOS2 API ManagerDelete Extension Arbitrary File DeletePath traversal CVE not assign...

radare2:ia_fuzz: Heap-use-after-free in Pe64_r_bin_pe_free

Project: https://github.com/radare/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=5754875154792448 Project: radare2 Fuzzing Engine: libFuzzer Fuzz Target: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x602000039370...

jbig2dec:jbig2_fuzzer: Heap-use-after-free in jbig2_release_huffman_table

Project: git://git.ghostscript.com/jbig2dec.git Detailed Report: https://oss-fuzz.com/testcase?key=5721375701729280 Project: jbig2dec Fuzzing Engine: libFuzzer Fuzz Target: jbig2fuzzer Job Type: libfuzzerasanjbig2dec Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...