EUVD-2015-5547

Malware in sbrugna...

binutils:fuzz_objdump_safe: Use-of-uninitialized-value in sanitize_string

Detailed Report: https://oss-fuzz.com/testcase?key=6720195520757760 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjdumpsafe Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: sanitizestring dumpsectionheader...

CVE-2015-5593

The sanitizestring function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting XSS attack by wrapping a payload in "scriptpayload", or in an image tag, with the payload as the onerror event...

CVE-2015-5592

Zenphoto is affected by CVE-2015-5592 due to an incomplete blacklist in sanitize_string prior to version 1.4.9, enabling remote attackers to conduct cross-site scripting (XSS). The vulnerability affects Zenphoto 1.4.x before 1.4.9. The root cause is improper input validation in the sanitize_strin...

CVE-2015-5592: Improper Neutralization of Input During Web Page Generation

Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...

CVE-2015-5593: Improper Neutralization of Input During Web Page Generation

The sanitizestring function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting XSS attack by wrapping a payload in "payload ", or in an image tag, with the payload as the onerror event...

CVE-2015-5594

The sanitizestring function in ZenPhoto before 1.4.9 utilized the htmlentitydecode function after input sanitation, which might allow remote attackers to perform a cross-site scripting XSS via a crafted string...

CVE-2015-5594: Improper Neutralization of Input During Web Page Generation

The sanitizestring function in ZenPhoto before 1.4.9 utilized the htmlentitydecode function after input sanitation, which might allow remote attackers to perform a cross-site scripting XSS via a crafted string...