wireshark: Heap-buffer-overflow in bootp_option

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=6216983760601088 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkudpport-bootp Fuzz target binary: fuzzsharkudpport-bootp Job Type:...

wireshark: Heap-buffer-overflow in print_address_prefix_buf

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=6147014918144000 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkdissectorip Fuzz target binary: fuzzsharkdissectorip Job Type:...

Apache XML Graphics FOP 2.1 Information Disclosure Vulnerability

Exploit for multiple platform in category remote exploits CVE-2017-5661: Apache XML Graphics FOP information disclosure vulnerability Severity: Medium Vendor: The Apache Software Foundation Versions Affected: FOP 1.0 - 2.1 Description: Files lying on the filesystem of the server which uses batik...

wireshark: Heap-buffer-overflow in OALMarshal_UncompressValue

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=5462407063273472 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkdissectorip Fuzz target binary: fuzzsharkdissectorip Job Type:...

file: Heap-buffer-overflow in cdf_getuint32

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=4694120629010432 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Nextcloud: CSRF token validation is missing

Greetings, Hello Security Team, Summary I know this is a medium risk issue but i want you guys to be aware of it that the CSRF token validation is missing at the time of login on https://portal.nextcloud.com/login.php login page. PoC Code: Email Password Login Now Forgot Password? var tabs = '';...

file: Heap-buffer-overflow in cdf_getuint32

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=4879865188712448 Project: file Fuzzer: aflfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: aflasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x611000000280 Cra...

libtsm: Heap-buffer-overflow in tsm_screen_tab_left

Project: git://people.freedesktop.org/dvdhrm/libtsm Detailed report: https://oss-fuzz.com/testcase?key=5437603467755520 Project: libtsm Fuzzer: afllibtsmfuzzer Fuzz target binary: libtsmfuzzer Job Type: aflasanlibtsm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Moxa MXview 2.8 - Denial of Service

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MXVIEW-v2.8-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product: =========== MXView v2.8 Download:...

dlplibs: Heap-buffer-overflow in librevenge::RVNGString::Iter::operator

Detailed report: https://oss-fuzz.com/testcase?key=6384974469005312 Project: dlplibs Fuzzer: libFuzzerdlplibsabwfuzzer Fuzz target binary: abwfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60a000002cf8 Crash State:...

libxml2: Use-of-uninitialized-value in xmlNextChar

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5437541593382912 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

libxml2: Use-of-uninitialized-value in xmlParsePI

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=4556488108408832 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

file: Use-of-uninitialized-value in match

Detailed report: https://oss-fuzz.com/testcase?key=6203080456536064 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzermsanfile Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: match filesoftmagic mget Sanitizer:...

file: Heap-buffer-overflow in cdf_file_property_info

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=5417710252982272 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

The power of Wallarm search engine

In this article I would like to show and explain my personal use cases of the Wallarm search engine. The cool thing about it is human readable search with intuitive commands. Just look at this search command before we start: attacks incidents vulns today RCE 502 For a security engineer looking at...

libxml2: Use-of-uninitialized-value in xmlParseXMLDecl

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=4803617708048384 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

openSUSE Security Update : clamav-database (openSUSE-2017-444)

This update for clamav-database refreshes the database. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2017-444...

dlplibs: Heap-buffer-overflow in libzmf::PNGWriter::writeData

Detailed report: https://oss-fuzz.com/testcase?key=6548817405018112 Project: dlplibs Fuzzer: afldlplibszmffuzzer Fuzz target binary: zmffuzzer Job Type: aflasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x619000001900 Crash State: libzmf::PNGWriter::writeDat...

libxml2: Use-of-uninitialized-value in xmlParseSystemLiteral

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5958424892276736 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

Cesanta Mongoose OS - Use-After-Free

Cesanta Mongoose OS - Use-After-Free COMPASS SECURITY ADVISORY https://www.compass-security.com/en/research/advisories/ Product: Mongoose OS Vendor: Cesanta CVE ID: CVE-2017-7185 CSNC ID: CSNC-2017-003 Subject: Use-after-free / Denial of Service Risk: Medium Effect: Remotely exploitable Authors:...