CVE-2016-3793

CVE-2016-3793 affects the NVIDIA camera driver (NVIDIA Tegra/Kernel driver) on Android, where a race condition use-after-free in the camera kernel path could allow a local attacker to gain privileges via a crafted app on affected Nexus devices (e.g., Nexus 9). The issue is described as a race con...

CVE-2016-2503

The Qualcomm GPU driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28084795 and Qualcomm internal bug CR1006067...

CVE-2015-8889

CVE-2015-8889 concerns the aboot implementation in Qualcomm components within Android on Nexus 6P devices, prior to the 2016-07-05 patch. The description notes that the recovery PIN feature is omitted, with impact and attack vectors listed as unspecified. Connected CNVD-2016-04846 and related CNV...

CVE-2014-9803

CVE-2014-9803 affects the Linux kernel and Android deployments using affected kernels prior to 3.15-rc5-next-20140519 (notably on Nexus 5X/6P before 2016-07-05). The issue arises in arch/arm64/include/asm/pgtable.h where execute-only pages are mishandled, enabling a local attacker to gain privile...

A year of Windows kernel font fuzzing #1: the results

Posted by Mateusz Jurczyk of Google Project Zero This post series is about how we used at-scale fuzzing to discover and report a total of 16 vulnerabilities in the handling of TrueType and OpenType fonts in the Windows kernel during the last year. In part 1 here, we present a general overview of...

CVE-2016-2481

CVE-2016-2481 affects the mm-video-v4l2 venc component in Android Mediaserver. It arises from how Mediaserver mishandles a buffer count, enabling a local attacker to gain privileges (Signature or SignatureOrSystem) via a crafted app. Affected are Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1....

Armadito Antimalware - Backdoor/Bypass

Exploit for windows platform in category dos / poc / Exploit Title : Armadito antimalware - Backdoor/Bypass Date : 07-06-2016 DD-MM-YYYY Exploit Author : Ax. Vendor Homepage : http://www.teclib-edition.com/teclib-products/armadito-antivirus/ Software Link : https://github.com/41434944/armadito-av...

CVE-2016-1677

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."...

Graphite2 - TtfUtil::CmapSubtable4NextCodepoint Heap Overread

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=755 The following crash due to a heap-based buffer overread can be observed in an ASAN build of the standard Graphite2 gr2FontTest utility git trunk, triggered with the following command: $ ./gr2fonttest /path/to/file -auto --- cut...

CVE-2015-8530

The IBM SPSS Statistics ActiveX Control is vulnerable to a stack-based buffer overflow in Initialize, allowing remote authenticated code execution via a long argument. Affected: IBM SPSS Statistics ActiveX control across versions 19/20 (before 20.0.0.2-IF0008), 21 (before 21.0.0.2-IF0010), 22 (be...

Design/Logic Flaw

The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27253079...

CVE-2016-2457

server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to bypass intended restrictions on Wi-Fi configuration changes by leveraging guest access, aka internal bug 27411179...

Fedora 24 : roundcubemail-1.1.5-1.fc24 (2016-aff691237e)

Release 1.1.5 Plugin API: Added html2text hook Plugin API: Added addressbookexport hook Fix missing emoticons on html-to-text conversion Fix random 'access to this resource is secured against CSRF' message at logout 4956 Fix missing language name in 'Add to Dictionary' request in HTML mode 4951...

Uber: OneLogin authentication bypass on WordPress sites

First, I'm sorry about reporting another WordPress bug my intention was just to check if WP-OneLogin stores any sensitive info that could be used to attack OneLogin on your other websites. Overview The .uber.com WordPress sites use OneLogin SAML-SSO instead of the normal WordPress login. The...

Internet Bug Bounty: EBCDIC overread (CVE-2016-2176)

https://github.com/openssl/openssl/commit/ea96ad5a206b7b5f25dad230333e8ff032df3219...

Internet Bug Bounty: Out-of-bounds reads in zif_grapheme_stripos with negative offset

https://bugs.php.net/bug.php?id=72061 graphemestripos from the intl extension had a security issue when handling negative offsets, this allowed to read from arbitrary memory locations. Reported to developers on 2016-04-24, fixed 2016-04-29 and released at 2016-04-28, affected PHP 5.5 , 5.6 and 7...

CVE-2016-0648

CVE-2016-0648 is an unspecified local-privilege/availability vulnerability in Oracle MySQL (versions 5.5.48 and earlier, 5.6.29 and earlier, 5.7.11 and earlier) and in MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 that can affect availability via PS-related vectors. Conn...

CVE-2016-0847

The CVE affects the Android Telecom component on Android 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-04-01). The issue allows a crafted app with Signature or SignatureOrSystem access to spoof the originating telephone number of a call. The impact is limited to local attacker ...

HackerOne: DOS Report FILE html inside <code> in markdown

LOOK rezult https://hackerone.com/reports/127809 F82764 POC Copy in F82766 TXT file all and create a new review I warn you , if you do this , then the report cannot open . You can create a report , attach files and replace my files F82764 and F82765 , paste in the contents of the report and creat...

Adobe Flash - textfield.maxChars Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581 There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent object, which is then used. A minimal PoC is as...