OpenEdx Ironwood.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: Multiple Reflected Cross-site Scripting Vulnerabilities in OpenEdx version Ironwood.1 Affected Software: OpenEdx Affected Versions: Ironwood.1 Homepage: https://open.edx.org/ Vulnerability: Cross site Scripting Severity: Medium Status:...

libssh2:ssh2_client_fuzzer: Heap-buffer-overflow in _libssh2_ntohu32

Project: https://github.com/cmeister2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5641535651053568 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerasanlibssh2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

mupdf:pdf_fuzzer: Use-of-uninitialized-value in fz_hash_find

Project: git://git.ghostscript.com/mupdf.git Detailed Report: https://oss-fuzz.com/testcase?key=5761352991244288 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

New Relic: Passive stored XSS at Synthetics job result page (View resource)

Hey team, I've discovered a stored XSS at Synthetics job result page. There is a View resource link near every URL which was requested by a browser and this link href is the requested URL itself: F577804 All the URLs, the browser interacted with, are saved into the database by a minion, when the...

libhevc:hevc_dec_fuzzer: Use-of-uninitialized-value in ihevc_recon_32x32

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5716526304329728 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzermsanlibhevc Platform Id: linux Crash Type: Use-of-uninitialized-value...

skia:sksl2spirv: Heap-buffer-overflow in SkSL::FunctionDeclaration::determineFinalTypes

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5736337256218624 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6030000006f8...

libhevc:hevc_dec_fuzzer: Heap-buffer-overflow in ihevcd_parse_coding_unit

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5647284229898240 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzerasani386libhevc Platform Id: linux Crash Type: Heap-buffer-overflow READ...

libhevc:hevc_dec_fuzzer: Use-of-uninitialized-value in ihevc_deblk_luma_vert_ssse3

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5745258909925376 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzermsanlibhevc Platform Id: linux Crash Type: Use-of-uninitialized-value...

libhevc:hevc_dec_fuzzer: Use-of-uninitialized-value in ihevcd_fmt_conv_420sp_to_rgb565

Detailed Report: https://oss-fuzz.com/testcase?key=5728697516032000 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzermsanlibhevc Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: ihevcdfmtconv420sptorgb565 ihevcdfmtconv...

matio:matio_fuzzer: Use-of-uninitialized-value in psnip_safe_size_mul

Project: git://git.code.sf.net/p/matio/matio Detailed Report: https://oss-fuzz.com/testcase?key=4804018169184256 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzermsanmatio Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libfdk-aac:aacDecoder_DecodeFrame: Index-out-of-bounds in sbrGetChannelElement

Detailed Report: https://oss-fuzz.com/testcase?key=5745965901807616 Project: libfdk-aac Fuzzing Engine: libFuzzer Fuzz Target: aacDecoderDecodeFrame Job Type: libfuzzerubsanlibfdk-aac Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: sbrGetChannelElement sbrDecoderPar...

dav1d:dav1d_fuzzer: Crash in dav1d_put_bilin_avx2

Project: https://code.videolan.org/videolan/dav1d.git Detailed Report: https://oss-fuzz.com/testcase?key=5739751889436672 Project: dav1d Fuzzing Engine: libFuzzer Fuzz Target: dav1dfuzzer Job Type: libfuzzerasandav1d Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f75ef779060 Crash...

skia:api_mock_gpu_canvas: Use-of-uninitialized-value in compute_vectors

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5655326388387840 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: apimockgpucanvas Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...

cryptofuzz:cryptofuzz-openssl: Heap-buffer-overflow in cipher_hw_desx_cbc_initkey

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5678733813350400 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl Job Type: libfuzzerasani386cryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

ntp:fuzz_ntpd_receive: Use-of-uninitialized-value in receive

Detailed Report: https://oss-fuzz.com/testcase?key=5684730627883008 Project: ntp Fuzzing Engine: libFuzzer Fuzz Target: fuzzntpdreceive Job Type: libfuzzermsanntp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: receive fuzzntpdreceive.c fuzzntpdreceive.c...

cryptofuzz:cryptofuzz-openssl-noasm: Heap-buffer-overflow in cipher_hw_desx_cbc_initkey

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5688606802313216 Project: cryptofuzz Fuzzing Engine: afl Fuzz Target: cryptofuzz-openssl-noasm Job Type: aflasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_VORBIS_fuzzer: Index-out-of-bounds in vorbis_residue_decode

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5157893162139648 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDVORBISfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

Wolters Kluwer TeamMate+ 3.1 Cross Site Request Forgery

Title: ==== Wolters Kluwer TeamMate+ – Cross-Site Request Forgery CSRF vulnerability Credit: ====== Name: Bhadresh Patel CVE: ==== CVE-2019-10253 Date: ==== 19/03/2019 dd/mm/yyyy Vendor: ====== Wolters Kluwer is a global leader in professional information, software solutions, and services for the...

Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery

Hello, Please find the below vulnerability details, --------------------------------------------------------------------------------------------------------------------------------- Exploit Title: Wolters Kluwer TeamMate+ – Cross-Site Request Forgery CSRF vulnerability Date: 02/09/2019 Exploit...

curl:curl_fuzzer_smb: Use-of-uninitialized-value in smb_connection_state

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5642303913328640 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzersmb Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...