12021 matches found
Weblate: Open Github Repo Leaking WEBLATE SECRET KEY
Team, While going through Github search I discovered a public repository which contains Weblate Secret Key Issue & Poc: Repo: https://github.com/WeblateOrg File:https://github.com/WeblateOrg/weblate/blob/592472958f7b847701c51b36f4768b9784219fa1/weblate/settingsdocker.py SECRETKEY = os.environ.get...
DJI drone app can transfer sensitive data and install malicious apps
By Deeba Ahmed DJI drone app called "DJI GO4" can have full control of the users' devices... This is a post from HackRead.com Read the original post: DJI drone app can transfer sensitive data and install malicious apps...
OSV-2020-1011 Heap-buffer-overflow in ndpi_search_mail_smtp_tcp
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18731 Crash type: Heap-buffer-overflow READ 4 Crash state: ndpisearchmailsmtptcp checkndpitcpflowfunc ndpidetectionprocesspacket...
sklekaren.sk Cross Site Scripting vulnerability OBB-1234527
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
NewStart CGSL MAIN 6.01 : python3 Multiple Vulnerabilities (NS-SA-2020-0030)
The remote NewStart CGSL host, running version MAIN 6.01, has python3 packages installed that are affected by multiple vulnerabilities: - http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into...
Important Announcement
ATTENTION: Your vulnerability tests are out of maintenance and not updated since July 1st 2020. Your setup of Greenbone Source Edition will not report about any new threats in your scanned environment since this date! REASON: Your Greenbone setup is connected to a discontinued download protocol o...
fcn-usa.org Improper Access Control vulnerability OBB-1232729
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
awards.theingots.org Cross Site Scripting vulnerability OBB-1226505
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra This document describes the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. About Apple security updates F...
Small CRM 2.0 SQL Injection
Exploit Title: Small CRM in PHP - 'id' SQL Injection Date: 2020-07-05 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/small-crm-php/ Software Link:...
OSV-2020-757 Heap-buffer-overflow in cras_channel_remix_conv_create
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23612 Crash type: Heap-buffer-overflow READ 4 Crash state: craschannelremixconvcreate audiothreadconfigglobalremix ccrhandlemessagefromclient...
binutils:fuzz_disassemble: Global-buffer-overflow in print_insn_arc
Detailed Report: https://oss-fuzz.com/testcase?key=6258025384640512 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzdisassemble Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000001427320 Crash State: printinsnarc...
sugarwish.com Improper Access Control vulnerability OBB-1217474
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
JobSearch < 1.5.3 - Multiple Cross-Site Scripting Issues
An Unauthenticated Reflected & Multiple Authenticated Persistent XSS vulnerabilities was discovered in the JobSearch plugin through 1.5.1 and 1.5.2 for WordPress. Authenticated Persistent XSS on the Candidate and Employer Profile pages. An Authenticated Persistent XSS @ Job Page will trigger on t...
Engel & Völkers Technology GmbH: SQL Injection at /displayPDF.php (printshop.engelvoelkers.com)
Intro An SQL injection has been identified. Through this vulnerability an attacker could execute arbitrary SQL statements compromising the integrity of the database and obtain sensitive information, violating the confidentiality of the data. Given the great impact of the vulnerability and...
c-blosc2:decompress_fuzzer: Use-of-uninitialized-value in blosc_run_decompression_with_context
Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=4799687189331968 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressfuzzer Job Type: libfuzzermsanc-blosc2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cra...
OSV-2020-626 UNKNOWN READ in ot::Buffer::GetNextBuffer
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13412 Crash type: UNKNOWN READ Crash state: ot::Buffer::GetNextBuffer ot::MessagePool::FreeBuffers ot::Coap::ResponsesQueue::DequeueAllResponses...
OSV-2020-573 UNKNOWN READ in (__has_construct<std::__1::allocator<unsigned
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14479 Crash type: UNKNOWN READ Crash state: hasconstruct::value, void::t std::1::vector ::vectoruns...
OSV-2020-430 Stack-use-after-return in OSSL_PARAM_get_int32
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15114 Crash type: Stack-use-after-return READ 4 Crash state: OSSLPARAMgetint32 md5sha1setparams ssl3finalfinishmac...