Internet Bug Bounty: Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack

See my official writeups here: http://bugs.python.org/issue25944 http://bugs.python.org/issue25945 The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that ...

CVE-2016-0864

Tollgrade SmartGrid LightHouse Sensor Management System SMS Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors...

HackerOne: Private Program Disclosure in /:handle/reports/draft.json endpoint

PoC revealed an issue in the HTTP codes returned for the /reports/draft.json endpoint: private team: https://hackerone.com/invite-only team handle/reports/draft.json Returned "error":"You need to sign in or sign up before continuing." with Status Code:401 OK user: https://hackerone.com/user...

Paragon Initiative Enterprises: Cross-domain AJAX request

Hi Paragonie Team, While reviewing your website i discovered that there are Cross-domain AJAX requests being sent, though you are implementing Content-Security-Policy header but Internet Explorer uses experimental X-Content-Security-Policy header according to Wikipedia info...

chromium-browser: various fixes from internal audits

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easie...

Database Assessment Tool: DbDat

DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...

HackerOne: Signals get affected once reports closed as self

According to your documentation "https://hackerone.com/blog/introducing-signal-and-impact" Examples ActivityReputation Report Self close as N/A : 0 . its means Signals are not affected . But our case signal affected by self-closed reports Signals doesn't take the 0 baseline into consideration for...

CVE-2015-6004

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via 1 the UniqueID aka sUniqueID parameter to WrFreeFormText.asp in the Reports component or 2 the Find Device parameter...

CVE-2015-6004

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via 1 the UniqueID aka sUniqueID parameter to WrFreeFormText.asp in the Reports component or 2 the Find Device parameter...

PT-2015-7107 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: IPSwitch WhatsUp Gold versions prior to 16.4 Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via two parameters: 1 the UniqueID also known as sUniqueID parameter to the "WrFreeFormText.as...

foreman: reports show/destroy not restricted by host authorization

A flaw was discovered where Satellite failed to properly enforce permissions on the show and delete actions for reports. An authenticated user with show or delete report permissions could use this flaw to view or delete any reports held in Foreman...

Moderate: Red Hat Bug Fix Advisory: setroubleshoot bug fix and enhancement update

Updated setroubleshoot packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7. The setroubleshoot packages contain a set of analysis plug-ins for use with the setroubleshoot utility. Each plug-in has the capacity to analyze SELinux Access Vect...

The vulnerability of the Oracle E-Business Suite system allows a perpetrator to gain unauthorized access to read data.

The vulnerability of the Oracle Report Manager component sub-component Reports Security of the Oracle E-Business Suite automation system is related to code errors. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to read data...

[USN-2782-1] Apport vulnerability

========================================================================== Ubuntu Security Notice USN-2782-1 October 27, 2015 apport vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

USN-2782-1: Apport vulnerability

Gabriel Campana discovered that Apport incorrectly handled Python module imports. A local attacker could use this issue to elevate privileges...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2015-06955)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle. An unspecified vulnerability exists in Oracle PeopleSoft Products 9.2. It allows an authenticated remote user to affect confidentiality through the associated expense report general unknown vector...

CVE-2015-4886

Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the...

Xxe

Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the...

CVE-2015-4886

Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the...

CVE-2015-4886

Oracle E-Business Suite CVE-2015-4886 is an XXE injection vulnerability in the Report Manager component (OA_HTML/copxml) that can allow a remote attacker to read arbitrary files, cause DoS, or enable SMB relay by sending a crafted XML with a DTD. Vulnerable product/version: Oracle E-Business Suit...