HTML Containing Malicious VBScript Obfuscated

Certain VBScript obfuscation schemes can be used to circumvent security software. These methods could allow attackers to execute arbitrary code on the target machines...

envoy/config_fuzz_test: Heap-use-after-free in std::__1::__bucket_list_deallocator<std::__1::allocator<std::__1::__hash_node_ba

Project: https://github.com/envoyproxy/envoy.git Detailed report: https://oss-fuzz.com/testcase?key=5666128418832384 Project: envoy Fuzzer: libFuzzerenvoyconfigfuzztest Fuzz target binary: configfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

GitLab Wiki API Attachments Command Injection (CVE-2018-18649)

A remote code execution vulnerability has been reported in GitLab Wiki API. The vulnerability is due to improper validation of parameters when uploading files to the Wiki repository via the Wiki API. A remote, authenticated attacker can exploit the vulnerability by sending a crafted request to th...

WordPress Core Local File Inclusion Remote Code Execution (CVE-2019-8942)

A remote code execution vulnerability exists in WordPress Core. Successful exploitation of this vulnerability could allow a remote attacker with at least author privileges to execute arbitrary code on the target server...

Beckhoff Target Browser Detection (Windows SMB Login)

Detects the installed version of Beckhoff Target Browser for Windows. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1028)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified oth...

Apache Struts 2 Commons FileUpload Insecure Deserialization (CVE-2016-1000031)

An insecure deserialization vulnerability exists in Apache Struts 2. This vulnerability is due to Apache Struts 2 having a dependency on a vulnerable version of Commons FileUpload. Successful exploitation can result in arbitrary file upload within the security context of the target application...

Jenkins NodeJS Plugin Remote Code Execution

A remote code execution vulnerability exists in Jenkins NodeJS plugin. Successful exploitation could allow an attacker to execute arbitrary code in the target machine...

Microsoft Windows CreateDIBitmap Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Windows Graphics Device Interface EMR_HEADER Information Disclosure (CVE-2018-8595)

An information disclosure vulnerability exists in the Graphics Device Interface GDI component of Microsoft Windows. The vulnerability is due to improperly disclosing memory content. Successful exploitation could result in disclosure of information which could be used to further compromise the...

skia/api_path_measure: Heap-buffer-overflow in compute_pos_tan

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5634563479437312 Project: skia Fuzzer: libFuzzerskiaapipathmeasure Fuzz target binary: apipathmeasure Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...

CVE-2018-1675

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110...

Directory Traversal

mcstatic is vulnerable to directory traversal. The vulnerability is possible because it does not handle the file name parameter properly, allowing the attacker to read arbitrary files on the target server by appending ../ in the file path...

Pown Recon - A Powerful Target Reconnaissance Framework Powered By Graph Theory

Pown Recon is a target reconnaissance framework powered by graph theory. The benefit of using graph theory instead of flat table representation is that it is easier to find the relationships between different types of information which comes quite handy in many situations. Graph theory algorithms...

Feds Dismantle Dark Web Credentials Market

Law-enforcement agencies across the world have taken aim at Dark Web denizens this week, with the takedown of a credentials marketplace as well as continued action against former users of the Webstresser.org DDoS-for-hire site. An international law-enforcement operation has dismantled the xDedic...

Rockwell Automation RNADiagReceiver Denial Of Service (CVE-2012-0222)

A denial of service vulnerability exists in Rockwell Automation RNADiagReceiver. A remote attacker could exploit this vulnerability by sending a specially crafted packet to the target system...

Joomla! Component vAccount 2.0.2 - 'vid' SQL Injection

Exploit Title: Joomla! Component vAccount 2.0.2 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://wdmtech.com/ Software Link: https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/ Version: 2.0.2 Category: Webapps Test...

Beebug - A Tool For Checking Exploitability

beebug is a tool that can be used to verify if a program crash could be exploitable. This tool was presented the first time at r2con 2018 in Barcelona. Some implemented functionality are: Stack overflow on libc Crash on Program Counter Crash on branch Crash on write memory Heap vulnerabilities Re...

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041. See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info...

GHSA-4P24-VMCR-4GQJ Bootstrap Cross-site Scripting vulnerability

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041. See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info...