1162 matches found
CVE-2017-5932
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " double quote character and a command substitution metacharacter...
GNU / Bash v4.4 autocompletion Code Execution Vulnerability
Exploit for linux platform in category local exploits GNU Bash code execution vulnerability in path completion Jens Heyens, Ben Stock January 2017 1 Introduction GNU Bash from version 4.4 contains two bugs in its path completion feature leading to a code execution vulnerability. An exploit can be...
Cross site scripting
The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...
quote-spy.com Open Redirect vulnerability
Vulnerable URL: http://www.quote-spy.com/redirect.ashx?target=http://www.openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 259092 VIP website status:| No...
Magento Community Edition 2.x < 2.0.6 Multiple Vulnerabilities
Binary data 9694.prm...
Internet Bug Bounty: integer overflow in preg_quote caused heap corruption
Please check: https://bugs.php.net/bug.php?id=72895...
Potential Command Injection
Overview Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments. Proof of Concept: The following characters are not escaped properly: ,;,, Bash has...
CVE-2015-6790
Removed by vendor...
chromium-browser: Escaping issue in saved pages
The WebPageSerializerImpl::openTagToString function in WebKit/Source/web/WebPageSerializerImpl.cpp in the page serializer in Google Chrome before 47.0.2526.80 does not properly use HTML entities, which might allow remote attackers to inject arbitrary web script or HTML via a crafted document, as...
CVE-2015-6790
The WebPageSerializerImpl::openTagToString function in WebKit/Source/web/WebPageSerializerImpl.cpp in the page serializer in Google Chrome before 47.0.2526.80 does not properly use HTML entities, which might allow remote attackers to inject arbitrary web script or HTML via a crafted document, as...
Google Android - 'Stagefright' Remote Code Execution
!/usr/bin/env python Joshua J. Drake @jduck of ZIMPERIUM zLabs Shout outs to our friends at Optiv formerly Accuvant Labs C Joshua J. Drake, ZIMPERIUM Inc, Mobile Threat Protection, 2015 www.zimperium.com Exploit for RCE Vulnerability CVE-2015-1538 1 Integer Overflow in the libstagefright MP4 ‘sts...
Threat Outbreak Alert RuleID17190: Email Messages Distributing Malicious Software on August 6, 2015
Medium Alert ID: 40342 First Published: 2015 August 6 19:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17190 may contain the following files: Name | Si...
CVE-2015-4728
Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Bid/Quote creation...
Design/Logic Flaw
Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Bid/Quote creation...
CVE-2015-4728
Technical details for CVE-2015-4728 are not publicly available in the provided documents. Monitor closely for updated information and disclosures.
WordPress Flexi Quote Rotator Plugin - Multiple Vulnerabilities
This plugin is prone to a cross site request forgery and SQL injection vulnerabilities. Solution Upgrade the plugin...
WordPress Flexi Quote Rotator Plugin - Multiple Vulnerabilities
This plugin is prone to a cross site request forgery and SQL injection vulnerabilities. Solution Upgrade the plugin...
DEBIAN-CVE-2015-3145
The sanitizecookiepath function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service out-of-bounds write and crash or possibly have other unspecified impact via a cookie path containing only a double-quote...
Out-of-bounds
The sanitizecookiepath function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service out-of-bounds write and crash or possibly have other unspecified impact via a cookie path containing only a double-quote...
CVE-2015-3145
The sanitizecookiepath function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service out-of-bounds write and crash or possibly have other unspecified impact via a cookie path containing only a double-quote...