4498 matches found
Shopify: H1514 Server Side Template Injection in Return Magic email templates?
Summary: Possible template injection in return magic email templates. Description: I've been playing with return magic workflow email templates and there seems to be some kinda of template injection but I am not sure if it's exploitable or even valid. Here is why I think it could be vulnerable: I...
Shopify: H1514 Stored XSS in Return Magic App portal content
Summary: Stored XSS vulnerability was found in return magic app portal content which executes in the application domain in https://services.alveo.io/dashboard-shopify/settings/portal/content Description: It's been found that Return Magic app allows users to add HTML content to their return portal...
2018 Flare-On Challenge Solutions
We are pleased to announce the conclusion of the fifth annual Flare-On Challenge. The numbers are in and we can safely say that this was by far the most difficult challenge we’ve ever hosted. We plan to reduce the difficulty next year, so it may be that the 114 people who solved this year’s...
h1-5411-CTF: H1-5411 CTF Write-up by erbbysam and ziot
@erbbysam and I recently set out to beat the latest CTF challenge hosted by HackerOne. Here is a write-up with the process we took from start to finish. The h1-5411 CTF begins with a tweet from HackerOne: https://twitter.com/Hacker0x01/status/1044974142150373378 F351665 This leads to a website...
Memory Corruption Vulnerability in Softmedia Icon Master, Softmedia Magic, Qingdao (CNVD-2018-19757)
Softmedia Icon Master is an icon management software with functions such as icon extraction, icon replacement, icon format conversion and icon cache repair. There is a memory corruption vulnerability in Softmedia Icon Master, which allows an attacker to cause the program to crash by constructing...
Microsoft Edge Chakra JIT InlineArrayPush Type Confusion
Microsoft Edge: Chakra: JIT: Type confusion with InlineArrayPush This is similar to issue 1531 . The patch seems to prevent type confusion triggered from StElemIA instructions. But the SetItem method can also be invoked through the Array.prototype.push method which can be inlineed. We can achieve...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
PT-2018-4114
Name of the Vulnerable Software and Affected Versions csrf-magic versions prior to 1.0.4 Description The issue allows an attacker to bypass CSRF protections due to a predictable Anti-CSRF Token. This predictability occurs when the $GLOBALS'csrf''secret' is not configured, resulting in the lack of...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
CVE-2013-7464: Cross-Site Request Forgery (CSRF)
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
CVE-2013-7464
In csrf-magic before 1.0.4, if $GLOBALS'csrf''secret' is not configured, the Anti-CSRF Token used is predictable and would permit an attacker to bypass the CSRF protections, because an automatically generated secret is not used...
magic-duels.gamerch.com XSS vulnerability
Open Bug Bounty ID: OBB-647172 Description| Value ---|--- Affected Website:| magic-duels.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
USN-3686-1 file vulnerabilities
Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2014-9620 Alexander Cherepanov discovered that file incorrectly handled certain long strings. An...
Microsoft Edge Chakra JIT - Magic Value Type Confusion Exploit
Exploit for windows platform in category dos / poc / BOOL JavascriptNativeFloatArray::SetItemuint32 index, double dValue if uint64&dValue == uint64&JavascriptNativeFloatArray::MissingItem JavascriptArray varArr = JavascriptNativeFloatArray::ToVarArraythis; varArr-DirectSetItemAtindex,...
Microsoft Edge Chakra JIT - Magic Value Type Confusion
/ BOOL JavascriptNativeFloatArray::SetItemuint32 index, double dValue if uint64&dValue == uint64&JavascriptNativeFloatArray::MissingItem JavascriptArray varArr = JavascriptNativeFloatArray::ToVarArraythis; varArr-DirectSetItemAtindex, JavascriptNumber::ToVarNoCheckdValue, GetScriptContext; return...
Fedora 26 : ckeditor (2018-1361f39801)
4.9.2 https://ckeditor.com/cke4/release/CKEditor-4.9.2 Security Updates - Fixed XSS vulnerability in the Enhanced Image image2 plugin reported by Kyaw Min Thein. - Issue summary: It was possible to execute XSS inside CKEditor using the tag and specially crafted HTML. Please note that the default...
CVE-2014-5014
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in imagemagicpath...
PT-2018-4247
Name of the Vulnerable Software and Affected Versions WordPress Flash Uploader plugin versions prior to 3.1.3 Description The issue allows remote attackers to execute arbitrary commands. This is related to invalid characters in the image magic path. Recommendations For WordPress Flash Uploader...
Mobile's customized "Magic Box" smart set-top box has smart hardware vulnerabilities
Smart Set Top Box is a set top box product from ZTE Corporation. A smart hardware vulnerability exists in the mobile customized "Magic Box" smart set-top box. An attacker can use the vulnerability to communicate with the device using a ttl line, log in to the operating system without password...