New Relic: Passive stored XSS at Synthetics job result page (View resource)

Hey team, I've discovered a stored XSS at Synthetics job result page. There is a View resource link near every URL which was requested by a browser and this link href is the requested URL itself: F577804 All the URLs, the browser interacted with, are saved into the database by a minion, when the...

libhevc:hevc_dec_fuzzer: Use-of-uninitialized-value in ihevc_recon_32x32

Project: https://android.googlesource.com/platform/external/libhevc Detailed Report: https://oss-fuzz.com/testcase?key=5716526304329728 Project: libhevc Fuzzing Engine: libFuzzer Fuzz Target: hevcdecfuzzer Job Type: libfuzzermsanlibhevc Platform Id: linux Crash Type: Use-of-uninitialized-value...

libssh2:ssh2_client_fuzzer: Heap-buffer-overflow in _libssh2_ntohu32

Project: https://github.com/cmeister2/libssh2.git https://github.com/libssh2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5651535966502912 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerasanlibssh2 Platform Id: linux Crash Type:...

libvips:jpegsave_file_fuzzer: Crash in vips__foreign_convert_saveable

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5688033944272896 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerubsanlibvips Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

opensc:fuzz_asn1_print: Heap-buffer-overflow in decode_bit_string

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5115715492773888 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzasn1print Job Type: libfuzzerasanopensc Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

postgis:wkb_import_fuzzer: Heap-buffer-overflow in byte_from_wkb_state

Project: https://git.osgeo.org/gitea/postgis/postgis.git Detailed Report: https://oss-fuzz.com/testcase?key=5686969597689856 Project: postgis Fuzzing Engine: afl Fuzz Target: wkbimportfuzzer Job Type: aflasanpostgis Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

libvips:jpegsave_buffer_fuzzer: Heap-buffer-overflow in attach_xmp_blob

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5673786296238080 Project: libvips Fuzzing Engine: afl Fuzz Target: jpegsavebufferfuzzer Job Type: aflasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

cryptofuzz:cryptofuzz-openssl-noasm: Heap-buffer-overflow in (__has_construct<std::__1::allocator<unsigned

Detailed Report: https://oss-fuzz.com/testcase?key=5733374043357184 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-noasm Job Type: libfuzzerasani386cryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0xbee238d5 Crash State:...

Excessive CPU usage in HTTP/2 with small window updates

Excessive CPU usage in HTTP/2 with small window updates Severity: medium CVE-2019-9511 Not vulnerable: 1.17.3+, 1.16.1+ Vulnerable: 1.9.5-1.17.2...

imagemagick/ping_mng_fuzzer: Use-of-uninitialized-value in ScaleQuantumToChar

Detailed report: https://oss-fuzz.com/testcase?key=5724110990082048 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmngfuzzer Fuzz target binary: pingmngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libspng/spng_read_fuzzer: Heap-buffer-overflow in spng_decode_image

Project: https://gitlab.com/randy408/libspng.git https://github.com/randy408/libspng.git Detailed report: https://oss-fuzz.com/testcase?key=5154004849393664 Project: libspng Fuzzer: libFuzzerlibspngspngreadfuzzer Fuzz target binary: spngreadfuzzer Job Type: libfuzzerasanlibspng Platform Id: linux...

openthread/ncp-uart-received-fuzzer: Stack-buffer-overflow in ot::NetworkData::Leader::IsStableUpdated

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5630599882080256 Project: openthread Fuzzer: libFuzzeropenthreadncp-uart-received-fuzzer Fuzz target binary: ncp-uart-received-fuzzer Job Type: libfuzzerasanopenthread Platform Id: linux Crash...

openthread/ncp-uart-received-fuzzer: Stack-buffer-overflow in ot::Message::Write

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5734126906245120 Project: openthread Fuzzer: aflopenthreadncp-uart-received-fuzzer Fuzz target binary: ncp-uart-received-fuzzer Job Type: aflasanopenthread Platform Id: linux Crash Type:...

poppler/pdf_fuzzer: Use-of-uninitialized-value in Gfx::fillPatch

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=6238658929098752 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz targ...

HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/HC10-HC.SERVER-10.14-REMOTE-INVALID-POINTER-WRITE.txt + ISR: ApparitionSec Vendor www.hostingcontroller.com Product HC10 HC.Server Service 10.14 HC10 is a unified hosting...

Thunderbird ESR < 60.7.XXX - Type Confusion

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2019-004 Type confusion in Thunderbird ============================= Severity Rating: Medium Confirmed Affected Versions: All versions affected Confirmed Patched Versions: Thunderbird ESR 60.7.XXX Vendor:...

Intel Turbo Boost Max Technology 3.0 Discontinuation - US

Lenovo Security Advisory: LEN-27841 Potential Impact: Privilege escalation Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2019-0164 Summary Description: A potential security vulnerability in the Intel Turbo Boost Max Technology 3.0 may allow escalation of privilege. Mitigatio...

njs/njs_process_script_fuzzer: Use-of-uninitialized-value in njs_values_hash_test

Project: http://hg.nginx.org/njs Detailed report: https://oss-fuzz.com/testcase?key=5683352457183232 Project: njs Fuzzer: libFuzzernjsprocessscriptfuzzer Fuzz target binary: njsprocessscriptfuzzer Job Type: libfuzzermsannjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

cryptofuzz/cryptofuzz-openssl-110-noasm: Use-of-uninitialized-value in bool std::__1::equal<std::__1::__wrap_iter<unsigned char const*>, std::__1::__wr

Project: https://github.com/guidovranken/cryptofuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5713279621529600 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-openssl-110-noasm Fuzz target binary: cryptofuzz-openssl-110-noasm Job Type: libfuzzermsancryptofuzz Platform Id:...

radare2/ia_fuzz: Heap-buffer-overflow in load

Project: https://github.com/radare/radare2.git Detailed report: https://oss-fuzz.com/testcase?key=5749546694475776 Project: radare2 Fuzzer: libFuzzerradare2iafuzz Fuzz target binary: iafuzz Job Type: libfuzzerasanradare2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...