CVE-2018-20774

Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field...

CVE-2018-20774: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field...

PT-2019-10215

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue allows PHP code execution. This can be achieved by sending ?php code to the "admin/?/layout/edit/1" URI, which is an API endpoint. Recommendations: For Frog CMS version 0.9.5, update to a newer...

PT-2019-10217

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the "admin/?/layout/edit/1" endpoint, specifically in the Body field. Recommendations: For Frog...

Multiple Apple Products Kernel Out-of-Bounds Read Vulnerability

Apple iOS is an operating system developed for mobile devices; macOS Sierra, macOS High Sierra, and macOS Mojave are different versions of a specialized operating system developed for Mac computers; tvOS is a smart TV operating system. Kernel is one of the kernel components. An out-of-bounds read...

Valve: GoldSrc: Buffer Overflow in DELTA_ParseDelta function leads to RCE

Description The bug is triggered by 2 packets. First one is svcdeltadescription which describes memory layout of such structures as eventt, weapondatat, ... It is sent as a list of fields' descriptions: type, offset and others. Next, DELTAParseDelta fills these structures when corresponding delta...

Multiple Apple Products Kernel Information Disclosure Vulnerability

Apple iOS, tvOS, watchOS, and macOS High Sierra are products of Apple Inc. Apple iOS is an operating system for mobile devices; tvOS is a smart TV operating system; watchOS is a smart watch operating system; and macOS High Sierra is a specialized operating system developed for Mac computers. Sier...

Integer overflow

A pointer overflow, with code execution, was discovered in ZeroMQ libzmq aka 0MQ 4.2.x and 4.3.x before 4.3.1. A v2decoder.cpp zmq::v2decodert::sizeready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leverag...

CVE-2019-6250

A pointer overflow, with code execution, was discovered in ZeroMQ libzmq aka 0MQ 4.2.x and 4.3.x before 4.3.1. A v2decoder.cpp zmq::v2decodert::sizeready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leverag...

Notes on Self-Publishing a Book

In this post I would like to share a few thoughts on self-publishing a book, in case anyone is considering that option. As I mentioned in my post on burnout, one of my goals was to publish a book on a subject other than cyber security. A friend from my Krav Maga school, Anna Wonsley, learned that...

Information disclosure

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

CVE-2018-20484

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

CVE-2018-20484

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

CVE-2018-20484

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

CVE-2018-20484

CVE-2018-20484 affects Zoho ManageEngine ADSelfService Plus 5.7 before build 5702, with a cross-site scripting vulnerability in the self-update layout implementation. The issue is a XSS in the auto-update/deployment flow (build

CVE-2018-20484: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

PT-2018-15406

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus version 5.7 before build 5702 Description The issue concerns an XSS in the self-update layout implementation. Recommendations For Zoho ManageEngine ADSelfService Plus version 5.7 before build 5702, update t...

DEBIAN-CVE-2018-20022

LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vulnerability in VNC client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak...

UBUNTU-CVE-2018-20023

LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Repeater client code that allows attacker to read stack memory and can be abuse for information disclosure. Combined with another vulnerability, it can be used to leak stack memor...

FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2019-07076)

FUEL CMS is a content management system based on CodeIgniter. A cross-site scripting vulnerability exists in FUEL CMS 1.4.3, which can be exploited by an attacker to conduct a cross-site scripting attack via a title or body text in a layout variable during new page creation...