PT-2017-14715

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue allows for arbitrary file read in the dapur/apps/app theme/libs/check file.php file via the src or name variables in the $ GET request. Recommendations For Fiyo CMS version 2.0.7, consider restricti...

Wget HTTP integer overflow Exploit

Exploit for linux platform in category dos / poc wget HTTP integer overflow Exploit https://xorl.wordpress.com/2017/11/11/cve-2017-13089-wget-http-integer-overflow/ That’s an interesting vulnerability in GNU wget. According to the wget project, this was reported by Antti Levomäki, Christian Jalio...

Ed: Oauth flow on the comments widget login can lead to the access code leakage

Description Hello. Here is a keyword: frog I discovered an little Oauth flow in the comments widget authentication process using redirecturi manipulations. The widget located on the all blogposts, which have URL https://edoverflow.com/2017/post-title/ Upon authentication, it appeared that code...

Medium: cacti

Issue Overview: include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page. CVE-2017-15194 Affected Packages: cacti Issue Correction: Run yum update cacti or yum update --advisory ALAS-2017-923 to update your system. New Packages: noarch: ...

wget HTTP integer overflow(CVE-2017-13089)

That’s an interesting vulnerability in GNU wget. According to the wget project, this was reported by Antti Levomäki, Christian Jalio, Joonas Pihlaja of Forcepoint as well as Juhani Eronen of the Finnish National Cyber Security Centre. The vulnerability is in src/http.c source code file and more...

Oracle Java SE - Web Start jnlp XML External Entity Processing Information Disclosure Exploit

Exploit for java platform in category web applications !/usr/local/bin/python """ Oracle Java SE Web Start jnlp XML External Entity Processing Information Disclosure Vulnerability Affected: + eg: ./poc.py 'C:/Program Files/Java/jre1.8.0131/README.txt' saturn: mrme$ ./poc.py 'C:/Program...

Oracle Java SE - Web Start jnlp XML External Entity Processing Information Disclosure

!/usr/local/bin/python """ Oracle Java SE Web Start jnlp XML External Entity Processing Information Disclosure Vulnerability Affected: + eg: ./poc.py 'C:/Program Files/Java/jre1.8.0131/README.txt' saturn: mrme$ ./poc.py 'C:/Program Files/Java/jre1.8.0131/README.txt' Oracle Java Web Start JNLP XML...

CVE-2017-15096: NULL Pointer Dereference

A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in sendbrickreq function in glusterfsd/src/gfattach.c may be used to cause denial of service...

CVE-2017-15008

PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in the SRC attribute of an IMG element...

CVE-2017-15008: Improper Neutralization of Input During Web Page Generation

PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in the SRC attribute of an IMG element...

PT-2017-13812

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor version 17.3.33.2830 Description The issue is related to stored Cross-Site Scripting on all sensor titles, due to incorrect error handling for a %00 in the SRC attribute of an IMG element. Recommendations For version...

Radancy: [werkenbijmcdonalds.nl] Unsafe-inline in "script-src" results in "bootstrapping" or passing data to JavaScript from HTML pages.

Hi Dear Maximum Team Hope you are good! Vulnerablity Summary The HTTP header of the werkenbijmcdonalds.nl website includes an unsafe-inline parameter for "script-src". Impact: However, the "script-src" parameter is set to "unsafe-inline" or "unsafe-eval", which allows injection of user passed...

CVE-2017-14744

UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element...

CVE-2017-14744

UEditor 1.4.3.3 is vulnerable to cross-site scripting via the SRC attribute of an IFRAME element. The issue is documented across multiple sources (NVD, CNVD, Red Hat, CVE lists) and is consistently described as an XSS in Baidu/UEditor, with no explicit remediation or patch version provided in the...

PT-2017-13663

Name of the Vulnerable Software and Affected Versions UEditor version 1.4.3.3 Description The issue is related to a cross-site scripting XSS problem. It occurs via the SRC attribute of an IFRAME element. Recommendations For UEditor version 1.4.3.3, update to a newer version that contains a fix fo...

CVE-2017-14744: Improper Neutralization of Input During Web Page Generation

UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element...

CVE-2017-11695

Heap-based buffer overflow in the allocsegs function in lib/dbm/src/hash.c in Mozilla Network Security Services NSS allows context-dependent attackers to have unspecified impact using a crafted cert8.db file...

Medium: curl

Issue Overview: FILE buffer read out of bounds CVE-2017-1000099 TFTP sends more than buffer size CVE-2017-1000100 URL globbing out of bounds read CVE-2017-1000101 Affected Packages: curl Issue Correction: Run yum update curl or yum update --advisory ALAS-2017-889 to update your system. New...

WS-2017-3756

In php-src, php-4.3.0RC1 to 7.2.0beta3, the “imagecreatefromstring” PHP function is vulnerable to a denial of service, and potentially to an information disclosure vulnerability, due to mishandling of the bmp images data start offset...

Legal Robot: CSP script-src includes "unsafe-inline"

A security researcher pointed out that our Content Security Policy included the unsafe-eval keyword in the script-src directive. I pointed out some low level issue in CSP policy. and great fix by legalrobot team...