Automattic: XSS Vulnerability in WooCommerce Product Vendors plugin

Version 2.0.27 of the WooCommerce Product Vendors plugin doesn't appear to correctly escape the "vendor description" POST parameter and can be manipulated to reflect arbitrary scripting. The good news is that it does appear to do some form of clientside validation before posting, in addition to...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference

WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

SUSE-SU-2017:1939-1 Security update for Linux Kernel Live Patch 21 for SLE 12

This update for the Linux Kernel 3.12.61-5272 fixes one issue. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack guard pa...

Microsoft Windows Kernel - IOCTL 0x120007 (NsiGetParameter) nsiproxy/netio Pool Memory Disclosure

Exploit for windows platform in category dos / poc / We have discovered that the handler of the 0x120007 IOCTL in nsiproxy.sys \.\Nsi device discloses portions of uninitialized pool memory to user-mode clients, likely due to output structure alignment holes. On our test Windows 7 32-bit...

hometrainershop.nl XSS vulnerability

Vulnerable URL: https://www.hometrainershop.nl/category/225796%22-prompt%22XSSPOSED%22-%22'onclick='promptlocation.search.slice1'/hometrainers.html?XSSPOSED Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 864079...

nastandgreeley.harpweek.com XSS vulnerability

Vulnerable URL: http://nastandgreeley.harpweek.com/SubPages/cartoon-1872-mediumA.asp?UniqueID=21=1"...

antiumaurum.com XSS vulnerability

Vulnerable URL: http://www.antiumaurum.com/search.php/stare-mincecateg%5B%5D=113?p=1"...

tetonadv.com XSS vulnerability

Vulnerable URL: http://www.tetonadv.com/funds.php?fundid=1"...

CVE-2017-2292

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safeload, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safeload on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a...

widget.jobberman.com.gh XSS vulnerability

Open Bug Bounty ID: OBB-253520 Description| Value ---|--- Affected Website:| widget.jobberman.com.gh Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

libreoffice: Heap-buffer-overflow in SVBT16ToShort

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5027507092848640 Project: libreoffice Fuzzer: libFuzzerlibreofficeww8fuzzer Fuzz target binary: ww8fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overfl...

CVE-2017-9778

GNU Debugger GDB 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GDB to repeatedly allocate memory until a process limit is reached. This can, for example, impede efforts to analyze malware with GDB...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2017:1626-1)

This update for sudo fixes the following security issue : - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. bsc1042146 Also the following non security bug was...

SUSE-SU-2017:1626-1 Security update for sudo

This update for sudo fixes the following security issue: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. bsc1042146 Also the following non security bug was...

padima.es XSS vulnerability

Open Bug Bounty ID: OBB-250461 Description| Value ---|--- Affected Website:| padima.es Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

intranoi.aircorsica.com XSS vulnerability

Vulnerable URL: http://intranoi.aircorsica.com/index.php?preaction=galeriealbum=photo=2206677=1=xss"%27;";prompt/OPENBUGBOUNTY/...

Cisco Ultra Services Framework Element Manager Insecure Default Credentials Vulnerability

A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in as an admin or oper user of the affected device. The vulnerability is due to weak, hard-coded credentials of the admin and oper user...

Design/Logic Flaw

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

CVE-2017-8439

Kibana 5.4.0 has a Cross-Site Scripting (XSS) vulnerability in the Time Series Visual Builder (CVE-2017-8439) that could allow a Kibana user’s data to be exposed. The Connected documents provide CVSS metrics (v3 base 6.1 MEDIUM, network access, user interaction required) and confirm the affected ...

ffmpeg: Stack-use-after-return in put_h264_qpel8_hv_lowpass_9

Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=4719816059387904 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDH264fuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Stack-use-after-return READ 2 Crash Address: 0x7fd5f505c0e0 Crash...