1819 matches found
sqlite3: Global-buffer-overflow in translateColumnToCopy
Detailed report: https://oss-fuzz.com/testcase?key=4848090467008512 Project: sqlite3 Fuzzer: libFuzzersqlite3ossfuzz Fuzz target binary: ossfuzz Job Type: libfuzzerasansqlite3 Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address: 0x000002a01c3c Crash State:...
New Relic: Privilege Escalation in Share Report
Hello, I would like to report about Privilege Escalation on synthetics.newrelic.com domain. You can enable report sharing for monitor without permission. In order to reproduce it, do the following steps: 1 Login as company administrator 2 Navigate to...
Chrome: bypass for download filetype blacklist, extension->native privesc
This bug report describes a vulnerability that can be used by an extension with some permissions to escalate to native code execution on Linux desktops if Java is installed. No user interaction is required. Chrome permits extensions with appropriate permissions "downloads" and "downloads. open" t...
Important: Red Hat Security Advisory: qemu-kvm security and bug fix update
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
Apple macOS HelpViewer 10.12.1 - XSS Leads to Arbitrary File Execution Arbitrary File Read
Apple macOS HelpViewer 10.12.1 - XSS Leads to Arbitrary File Execution Arbitrary File Read / OSX: HelpViewer XSS leads to arbitrary file execution and arbitrary file read. HelpViewer is an application and using WebView to show a help file. You can see it simply by the command: open...
openSUSE: Security Advisory for kernel (openSUSE-SU-2016:3050-1)
The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2017-5015
Removed by vendor...
Node.js 模块 node-serialize 反序列化任意代码执行漏洞
原文链接：Exploiting Node.js deserialization bug for Remote Code Execution 有增改 原作者：Ajin Abraham 译：Holic 知道创宇404安全实验室 tl;dr 若不可信的数据传入 unserialize 函数，通过传递立即调用函数表达式（IIFE）的 JavaScript 对象可以实现任意代码执行。 漏洞详情 审计 Node.js 代码时，我正好看到一个名为 node-serialize 的序列号/反序列化模块。下面是一段代码示例，来自网络请求的 cookie 会传递到该模块的 unserialize 函数中。...
CVE-2017-5593
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Psi+ 0.16.563.580 -...
LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)
Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumption from the server by abusing the captcha servlet Description: By sending a specially crafted request and changing the height/width parameters in the captcha form it is possib...
shopify-scripts: SIGSEGV - mrb_vm_exec - line:1312
PoC ------------------- The following code triggers the bug attached as mrbvmexec.rb: n s s k h GC.start ObjectSpace.eachobject|obj|obj Debug - mirb ------------------- gdb r mrbvmexec.rb The program being debugged has been started already. Start it from the beginning? y or n y Starting program:...
HelpDeskZ 1.0.2 - (Authenticated) SQL Injection Unauthorized File Download
HelpDeskZ 1.0.2 - Authenticated SQL Injection Unauthorized File Download ''' Exploit Title: HelpDeskZ fetchRow"SELECT , COUNTid AS total FROM ".TABLEPREFIX."attachments WHERE id=".$db-realescapestring$params2." AND ticketid=".$params0." AND msgid=".$params3; third argument AND msgid=".$params3;...
CVE-2016-10087
The pngsettext2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and...
SUSE-SU-2017:0279-1 Security update for systemd
This update for systemd fixes the following issues: This security issue was fixed: - CVE-2016-10156: Fix permissions set on permanent timer timestamp files, preventing local unprivileged users from escalating privileges bsc1020601. These non-security issues were fixed: - Fix permission set on...
Internet Bug Bounty: Out of bounds memory read in unserialize()
I have found and reported an out of bounds memory read in PHP: https://bugs.php.net/bug.php?id=73825 It affected all three supported versions and has been fixed with the latest updates: https://secure.php.net/ChangeLog-5.php5.6.30 https://secure.php.net/ChangeLog-7.php7.0.15...
libarchive: Heap-buffer-overflow in detect_form
Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4619748121772032 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...
shegame.com XSS vulnerability
Open Bug Bounty ID: OBB-206770 Description| Value ---|--- Affected Website:| shegame.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
UBUNTU-CVE-2016-8745
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...
CVE-2016-6772
CVE-2016-6772 is an Android Wi‑Fi elevation of privilege vulnerability. The issue could let a local malicious app execute code in the context of a privileged Wi‑Fi process. Affected products/versions per the entry: Android 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0. The root cause is exploitation of the W...