PT-2018-10392 · Hdf +1 · Hdf5 +1

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.10.2 Description: A NULL pointer dereference was discovered in the H5S hyper make spans function in H5Shyper.c. This issue could allow a remote denial of service attack. Recommendations: For version 1.10.2, consider updating to...

Sudohulk - Try Privilege Escalation Changing Sudo Command

This tool change sudo command, hooking the execve syscall using ptrace, tested under bash and zsh supported architectures: x8664 x86 arm How use: $ make cc -Wall -Wextra -O2 -c -o bin/shremotedata.o src/shremotedata.c cc -Wall -Wextra -O2 -c -o bin/shstring.o src/shstring.c cc -Wall -Wextra -O2 -...

UBUNTU-CVE-2018-5803

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "sctpmakechunk" function net/sctp/smmakechunk.c when handling SCTP packets length can be exploited to cause a kernel crash...

Easy Windows and Linux cross-compilers for macOS

tl;dr: you can install cross-compiler toolchains to compile C/C++ for Windows or Linux from macOS with these two Homebrew Formulas. brew install FiloSottile/musl-cross/musl-cross brew install mingw-w64 Cross-compiling C and C++ is dreadful. While in Go you just need to set an environment variable...

Remote Code Execution (RCE)

django-make-app is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the usage of the insecure usage of YAML.load...

QuarkslaB Dynamic binary Instrumentation: QBDI

QuarkslaB Dynamic binary Instrumentation QBDI is a modular, cross-platform and cross-architecture DBI framework. It aims to support Linux, macOS, Android, iOS and Windows operating systems running on x86, x86-64, ARM and AArch64 architectures. Information about what is a DBI framework and how QBD...

Photo Fusion 1.0 Cross Site Scripting

Exploit Title: Photo Fusion - Free Stock Photos Script - Xss Google Dork: N/A Date: 2017/31/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://codecanyon.net/user/teamworktec Software Buy:...

Locations Multipurpose CMS Directory Theme 1.0 Cross Site Scripting

Exploit Title: Locations - Multipurpose CMS Directory Theme - xss Google Dork: N/A Date: 2017/27/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://themerig.com Software Buy:...

beverlyhillsporsche.com XSS vulnerability

Open Bug Bounty ID: OBB-432394 Description| Value ---|--- Affected Website:| beverlyhillsporsche.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Django-make-app Arbitrary Command Execution Vulnerability

djangomakeapp is a tool for generating code for Django applications. A security vulnerability exists in the YAML parsing function of the readyamlfile method of the ioutils.py file in djangomakeapp version 0.1.3. An attacker can exploit this vulnerability by injecting Python into loaded YAML to...

PYSEC-2017-79

An exploitable vulnerability exists in the YAML parsing functionality in the readyamlfile method in ioutils.py in djangomakeapp 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability...

Remote Code Execution Vulnerability in Stranger Client

Stranger is a location-based mobile social networking tool. There is a remote code execution vulnerability in the Stranger client, which can be exploited by an attacker to trigger an attack code to automatically download and automatically use the interface to install any application, call sensiti...

Securing a Raspberry Pi

A Raspberry Pi is a tiny computer designed for makers and all sorts of Internet-of-Things types of projects. Make magazine has an article about securing it. Reading it, I am struck by how much work it is to secure. I fear that this is beyond the capabilities of most tinkerers, and the result will...

GNU Binutils 'bfd_make_section_with_flag' function null pointer dereference vulnerability

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...

freeradius: Out-of-bounds read/write due to improper output buffer size check in make_secret()

An out-of-bounds read and write flaw was found in the way FreeRADIUS server handled RADIUS packets. A remote attacker could use this flaw to crash the FreeRADIUS server by sending a specially crafted RADIUS packet...

Friends in War Make or Break Authentication Bypass Vulnerability

Make or Break is a parenting blog. An authentication bypass vulnerability exists in Friends in War Make or Break. It allows an attacker to bypass login authentication via injection...

Friends In War Make Or Break 1.7 SQL Injection

Exploit Title: Friends in War Make or Break 1.7 SQL Injection Dork: N/A Date: 26.07.2017 Vendor : http://software.friendsinwar.com/ Software: http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Demo: http://localhost/PATH/ Version: 1.7 Author: Ihsan Sencan SQL Injection/Exploit :...

Friends In War Make Or Break 1.7 Password Change

Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail: shinnaiatautisticidotorg site: http://www.shinnai.altervista.org/...

Friends in War Make or Break 1.7 - CSRF (Change Admin Password) Vulnerability

Exploit for php platform in category web applications Friends in War Make or Break 1.7 - Unauthenticated admin password change Url: http://software.friendsinwar.com/ http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Author: shinnai mail: shinnaiatautisticidotorg site:...

Friends in War Make or Break 1.7 - SQL Injection

Friends in War Make or Break 1.7 - SQL Injection Exploit Title: Friends in War Make or Break 1.7 SQL Injection Dork: N/A Date: 26.07.2017 Vendor : http://software.friendsinwar.com/ Software: http://software.friendsinwar.com/downloads.php?catid=2&fileid=9 Demo: http://localhost/PATH/ Version: 1.7...