GSA Bounty: Information disclosure (system username) in the x-amz-meta-s3cmd-attrs response header on federation.data.gov

Description Hi. I just noticed, that you are extended the scope for the bounty program. I looked to the first resource - https://federation.data.gov/ I noticed, that the x-amz-meta-s3cmd-attrs response header returns sensitive information, like system username:...

ImageMagick Denial of Service Vulnerability (CNVD-2017-236955)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A denial of service vulnerability exists in the 'formatIPTC' function of the coders/meta.c file in ImageMagick version...

UBUNTU-CVE-2017-13062

In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function formatIPTC in coders/meta.c, which allows attackers to cause a denial of service WriteMETAImage memory consumption via a crafted file...

CVE-2015-3649

The CVE-2015-3649 entry concerns the Ruby gem open-uri-cached. Affected component: open-uri-cached Ruby gem; root cause: insecure/predictable temporary file handling in /tmp, where a directory named with openuri- and a meta/marker file is created, allowing a local attacker to place Ruby code and ...

CVE-2015-3649

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created...

PT-2017-6689

Name of the Vulnerable Software and Affected Versions open-uri-cached rubygem affected versions not specified Description The issue allows local users to execute arbitrary Ruby code. This is achieved by creating a directory under /tmp with a specific name, including "openuri-" followed by a craft...

The vulnerability of the parse8BIMW and format8BIM functions in the coder/meta.c file of the console image editing tool ImageMagick allows a hacker to cause a memory access violation.

The vulnerability of the parse8BIMW and format8BIM functions in the coders/meta.c file related to the WriteImage function in coders/meta.c in the console-based graphic editor ImageMagick arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability could...

DEBIAN-CVE-2017-12418

ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c...

ImageMagick coders/meta.c file memory leak vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A memory leak vulnerability exists in the 'parse8BIMW' and 'format8BIM' functions of the coders/meta.c file in...

[SECURITY] Fedora 25 Update: kernel-4.11.12-200.fc25

The kernel meta package...

acacias-meta.gov.co XSS vulnerability

Open Bug Bounty ID: OBB-269733 Description| Value ---|--- Affected Website:| acacias-meta.gov.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 26 Update: kernel-4.11.11-300.fc26

The kernel meta package...

[SECURITY] Fedora 24 Update: kernel-4.11.10-100.fc24

The kernel meta package...

WakaTime: Missing filteration of meta characters in all full name field on wakatime.com

Hi there Vulnerability Title: Meta characters are not filtered into full name Description You haven't filtered control meta characters such as %00 etc in full name field which allows an attacker to impersonate or hide their real identity within the application. This one is not rejected. It turns...

[SECURITY] Fedora 26 Update: kernel-4.11.6-301.fc26

The kernel meta package...

[SECURITY] Fedora 25 Update: kernel-4.11.6-201.fc25

The kernel meta package...

[SECURITY] Fedora 24 Update: kernel-4.11.6-101.fc24

The kernel meta package...

CVE-2017-9731

In meta/classes/packageipk.bbclass in Poky in poky-pyro 17.0.0 for Yocto Project through YP Core - Pyro 2.3, attackers can obtain sensitive information by reading a URL in a Source entry in an ipk package...

Code injection

In meta/classes/packageipk.bbclass in Poky in poky-pyro 17.0.0 for Yocto Project through YP Core - Pyro 2.3, attackers can obtain sensitive information by reading a URL in a Source entry in an ipk package...

CVE-2017-9731

The CVE-2017-9731 entry concerns the Yocto Project/Poky component: meta/classes/package_ipk.bbclass (Poky-Pyro 17.0.0 for Yocto through YP Core - Pyro 2.3). The issue enables information disclosure by allowing attackers to read a URL from a Source entry in an ipk package, exposing sensitive data....