Cross-Site Scripting

Overview Versions of simple-markdown prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a...

SQL Injection Vulnerability in pr***.asp Page of E-Long Technology Website Builder System

Ningbo Yilong Olive Tree Computer Technology Co., Ltd. is a design and construction company specializing in corporate website platforms, government schools, home services and other industries. There is a SQL injection vulnerability in the pr.asp page of the website builder system of E-Dragon...

java-1.8.0-openjdk security update

1:1.8.0.201.b09-0 - Update to aarch64-shenandoah-jdk8u201-b09. - Resolves: rhbz1661577 1:1.8.0.192.b12-0 - Add port of 8189170 to AArch64 which is missing from upstream 8u version. - Resolves: rhbz1661577 1:1.8.0.192.b12-0 - Add 8160748 for AArch64 which is missing from upstream 8u version. -...

SQL injection vulnerability in Pr***.asp page of website building system of Taizhou Zhisou Network Technology Co.

Taizhou Zhisou Network Technology Co., Ltd. is engaged in website construction, website production, website revision, website optimization of the network company. Taizhou Zhisou Network Technology Co., Ltd. building system Pr.asp page there is a SQL injection vulnerability, the attacker can use t...

Cross site request forgery (csrf)

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery CSRF vulnerability in API endpoint: /api/ that can result in Task metadata such as task name, id, parameter, etc. will be leake...

pr-lg.ru XSS vulnerability

Open Bug Bounty ID: OBB-710266 Description| Value ---|--- Affected Website:| pr-lg.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

Command Injection

Overview Versions of egg-scripts before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: eggctl start --daemon --stderr='/tmp/eggctlstderr.log; touch /tmp/malicious' Recommendation Update to version 2.8.1 or late...

pr-lg.ru XSS vulnerability

Open Bug Bounty ID: OBB-636408 Description| Value ---|--- Affected Website:| pr-lg.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pr-inside.com XSS vulnerability

Open Bug Bounty ID: OBB-633469 Description| Value ---|--- Affected Website:| pr-inside.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Out-of-bounds Read

Overview Versions of byte before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length Recommendation Update to version 1.4.1 or later. References - HackerOne Report - PR 3 - GitHub Advisory...

Vega Stealer Malware Takes Aim at Chrome, Firefox

A malware dubbed Vega Stealer has been uncovered, looking to make off with saved credentials and credit-card information in the Chrome and Firefox browsers. While it’s a simple payload for now, researchers said it has the ability to evolve into something more concerning in the future. Proofpoint,...

Memory Exposure

Overview Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write Versions 1.3.0 are not affected due to not using unguarded Buffer constructor. Recommendation Update to version 1.5.2, 1.4.11, 1.3.2 or later. If you are unable to update...

CVE-2018-1000143

CVE-2018-1000143 affects Jenkins GitHub Pull Request Builder Plugin (versions 1.39.0 and earlier) and GhprbCause.java, enabling a local attacker with filesystem access to obtain GitHub credentials. The issue is confirmed across NVD and multiple security trackers. Impact is exposure of credentials...

evento.centralfordpr.com XSS vulnerability

Open Bug Bounty ID: OBB-585445 Description| Value ---|--- Affected Website:| evento.centralfordpr.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Debian DLA-1291-1 : tzdata new upstream version

This update includes the changes in tzdata 2018c. Notable changes are : - So Tom and Prncipe switched from +00 to +01. - Brazil's DST will now start on November's first Sunday. For Debian 7 'Wheezy', these problems have been fixed in version 2018c-0+deb7u1. We recommend that you upgrade your tzda...

pr-lighting.com XSS vulnerability

Open Bug Bounty ID: OBB-555166 Description| Value ---|--- Affected Website:| pr-lighting.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-17613

Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php prid parameter or the searchbycatlist.php catid parameter...

c2.pr-cy.ru Open Redirect vulnerability

Vulnerable URL: https://c2.pr-cy.ru/a/click/3cc728f5aa12f4ccb085812e85fc85fd/?to=http://openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.12.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Equifax Breach Response Turns Dumpster Fire

I cannot recall a previous data breach in which the breached company's public outreach and response has been so haphazard and ill-conceived as the one coming right now from big-three credit bureau Equifax, which rather clumsily announced Thursday that an intrusion jeopardized Social security...

Design/Logic Flaw

An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway ALG. Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with...