CVE-2021-32618: URL Redirection to Untrusted Site

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....

OSV-2021-766 Negative-size-param in frame_get_vlmetalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34259 Crash type: Negative-size-param Crash state: framegetvlmetalayers frametoschunk blosc2schunkfrombuffer...

PT-2021-28258

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash involves the functions frame get vlmetalayers, frame ...

c-blosc2:decompress_frame_fuzzer: Negative-size-param in frame_get_vlmetalayers

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5598950410289152 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Negative-size-param Crash Address:...

Command injection in bestzip

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param...

PT-2021-28241

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 1 crash type. The crash state involves real param, zpdfinkpath, and interp. No information is availabl...

sleuthkit:sleuthkit_fls_iso9660_fuzzer: Negative-size-param in parse_susp

Project: https://github.com/sleuthkit/sleuthkit.git Detailed Report: https://oss-fuzz.com/testcase?key=5327993783320576 Project: sleuthkit Fuzzing Engine: afl Fuzz Target: sleuthkitflsiso9660fuzzer Job Type: aflasansleuthkit Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash...

CVE-2021-24239

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaioncode GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue...

WS-2021-0625

Memcpy-param-overlap in ZSTDcreateDDict...

CITSmart ITSM 9.1.2.27 - (query) Time-based Blind SQL Injection (Authenticated) Vulnerability

Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection Authenticated Google Dork: "citsmart.local" Exploit Author: skysbsb Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html Version: = 9.1.2.28 Vendor has...

U.S. Dept Of Defense: DOM Based XSS on https://████ via backURL param

Description: The following endpoint suffers from DOM Based XSS https://████████/██████=javascript:alertdocument.domain The ████████ param determines the content which will be displayed on the "Back to Search Result" button, eventually leading to RXSS. References ██████ Regards nagli Impact...

Health Center Patient Record Management System 1.0 Cross Site Scripting Vulnerability

Exploit Title: Health Center Patient Record Management System | 'address' param Stored Cross Site Scripting Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/11058/health-center-patient-record-management-system.html Software Link:...

c-blosc2:decompress_frame_fuzzer: Negative-size-param in blosc_d

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=4516447050137600 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Negative-size-param Crash Address:...

NewStart CGSL MAIN 6.02 : libtiff Vulnerability (NS-SA-2021-0058)

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by a vulnerability: - tifgetimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow...

OSV-2021-366 Negative-size-param in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30748 Crash type: Negative-size-param Crash state: framegetmetalayers frametoschunk blosc2schunkfrombuffer...

PT-2021-28072

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash occurs in the following functions: frame get metalayers...

c-blosc2:decompress_frame_fuzzer: Negative-size-param in frame_get_metalayers

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5964915892420608 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Negative-size-param Crash Address:...

wolfssl:fuzzer-wolfssh-server-randomize: Negative-size-param in DoUserAuthRequestEcc

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5731809763655680 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-server-randomize Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: Negative-size-param Crash...

OSV-2021-274 Memcpy-param-overlap in frame_get_metalayers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30253 Crash type: Memcpy-param-overlap Crash state: framegetmetalayers blosc2frametoschunk fuzzdecompressframe.c...

PT-2021-28045

Name of the Vulnerable Software and Affected Versions blosc versions affected versions not specified Description The issue is related to a crash caused by a memcpy parameter overlap. Technical details include the crash type being Memcpy-param-overlap, and the crash state involves functions such a...