Buffer overflow

Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a crafted application, aka Android internal bug 32639452 and Qualcomm internal bug CR1079713...

CVE-2018-1000003

CVE-2018-1000003 affects the DNSSEC validation component of PowerDNS Recursor (version 4.1.0). The root cause is improper input validation in the DNSSEC validators, enabling a network attacker in a man‑in‑the‑middle position to replay packets and cause the existence of some DNS data to be denied ...

duontax.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-524157 Description| Value ---|--- Affected Website:| duontax.co.kr Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosu...

Fedora 27 : FlightGear (2017-45beeef896)

This update fixes a security bug in the FGLogger subsystem, to prevent it from overwriting arbitrary files the user has write access to CVE-2017-13709 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

Open-Xchange: [XSS/CSRF] filter content-type bypass in Files

Hi. I found trick for inject any content-type for files. If content-type contains , then browser Chrome, Firefox skip content-type before , e.g.: any, text/html - text/html Upload any html/xml/svg/swf without extension F253137 and update mimetype: - "file":"filemimetype":"t,text/html" -...

Microsoft Edge Chakra JIT BackwardPass::RemoveEmptyLoopAfterMemOp Failed Insert

Microsoft Edge: Chakra: JIT: BackwardPass::RemoveEmptyLoopAfterMemOp doesn't insert branches. CVE-2017-11909 The optimizations for memory operations may leave empty loops as follows: for let i = 0; i arr.length; i++ arri = 0; Becomes: Memsetarr, 0, arr.length; for let i = 0; i arr.length; i++ //...

pt.tezenis.com XSS vulnerability

Open Bug Bounty ID: OBB-500466 Description| Value ---|--- Affected Website:| pt.tezenis.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure base...

Mavenlink: Users email can be changed without verification

A user api endpoint that accepts updates for user profile information also accepts an email address field. The researcher found a bug where a previously verified email address could be updated via this endpoint but would not be marked as unverified. This endpoint still accepts email address chang...

CVE-2017-1000433

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

CVE-2017-1000423

b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation backslash and single quote escape in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup...

Wikipedia Search Engine 1.0 Cross Site Scripting

Exploit Title: Wikipedia Search Engine PHP - xss Google Dork: N/A Date: 2017/31/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/niagawebster Software Buy: https://www.codester.com/items/5328/wikipedia-search-engine-php Demo:...

Chatting System PHP Ajax MySQL JavaScript 1.0 Cross Site Scripting

Exploit Title: Chatting System PHP Ajax MySQL JavaScript - xss Google Dork: N/A Date: 2017/31/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/IngeniousDeveloper Software Buy:...

Shopify: Ability to bypass partner email confirmation to take over any store given an employee email

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through partners given an employee email address. This is possible because I found a way to confirm arbitrary emails. I don't know the Shopify ecosystem well enough to know the other...

vostok.ru XSS vulnerability

Open Bug Bounty ID: OBB-457403 Description| Value ---|--- Affected Website:| vostok.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

SUSE-SU-2017:3410-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to receive various security and bugfixes. This update enables SMB encryption in the CIFS support in the Linux Kernel fate324404 The following security bugs were fixed: - CVE-2017-1000410: The Linux kernel was affected by an informatio...

acumatica.com XSS vulnerability

Open Bug Bounty ID: OBB-456833 Description| Value ---|--- Affected Website:| acumatica.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

Outlook for Android - Attachment Download Directory Traversal

''' There is a directory traversal issue in attachment downloads in Outlook for Android. There is no path sanitization on the attachment filename in the app. If the email account is a Hotmail account, this will be sanitized by the server, but for other accounts it will not be. This allows a file ...

CVE-2017-17522

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is...

Semrush: Reflected XSS using Header Injection

Host : www.semrush.com Path : /billing-admin/profile/subscription/?l=de Payload : c5obc'+alert1+'p7yd5 Steps to reproduce : Request Header : GET /billing-admin/profile/subscription/?l=de HTTP/1.1 Host: www.semrush.com Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0;...

Apple macOS - necp_get_socket_attributes so_pcb Type Confusion

Apple macOS - necpgetsocketattributes sopcb Type Confusion / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1392&desc=2 When getsockopt edited; original report said "setsockopt" is called on any socket with level SOLSOCKET and optname SONECPATTRIBUTES, necpgetsocketattributes i...