libspng/spng_read_fuzzer_structure_aware: Heap-use-after-free in read_chunks_before_idat

Project: https://gitlab.com/randy408/libspng.git https://github.com/randy408/libspng.git Detailed report: https://oss-fuzz.com/testcase?key=5759860653686784 Project: libspng Fuzzer: afllibspngspngreadfuzzerstructureaware Fuzz target binary: spngreadfuzzerstructureaware Job Type: aflasanlibspng...

Palo Alto Networks MineMeld XSS

The vulnerability of the Palo Alto Networks MineMeld software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

Undertow Missing Authorization when requesting a protected directory without trailing slash

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

GHSA-W69W-JVC7-WJGV Undertow Missing Authorization when requesting a protected directory without trailing slash

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

macOS / iOS JavaScriptCore - JSValue Use-After-Free in ValueProfiles Exploit

macOS / iOS JavaScriptCore - JSValue Use-After-Free in ValueProfiles Exploit While fuzzing JSC, I encountered the following JS program which crashes JSC from current HEAD and release /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc: // Run with --useConcurrentJIT=false...

eDocLib Platform XSS

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser when the page is opened. Th...

eDocLib Platform XSS

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser during the opening of the access...

eDocLib Platform XSS

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of its web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in a speciall...

eDocLib Platform XSS

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of its web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in a speciall...

eDocLib Platform XSS

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in a speciall...

Authentication flaw

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication...

CVE-2019-10266

Affected product: Ahsay Cloud Backup Suite prior to 8.1.1.50. Issue: unauthenticated, out-of-bounds XML input can trigger XML External Entity (XXE) processing, enabling an attacker to read file structures and contents from the server. Root cause: improper handling of XML input leading to informat...

CVE-2019-10184

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

UBUNTU-CVE-2019-10184

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

Memory corruption

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

CVE-2019-10184

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...

CVE-2019-10184

Undertow (the web server component referenced for CVE-2019-10184) is affected up to version 2.0.23.Final. The issue is an information exposure where web apps’ directory structures can be predicted through API requests made without trailing slashes, enabling partial confidentiality leakage. The li...

CVE-2019-2306

Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206,...

Design/Logic Flaw

Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206,...

Design/Logic Flaw

Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...