dropbear/fuzzer-preauth_nomaths: Use-of-uninitialized-value in wrapfd_select

Detailed report: https://oss-fuzz.com/testcase?key=5112123366572032 Project: dropbear Fuzzer: libFuzzerdropbearfuzzer-preauthnomaths Fuzz target binary: fuzzer-preauthnomaths Job Type: libfuzzermsandropbear Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions

ActivePDF Toolkit 8.1.0 multiple RCE Introduction ============ The ActivePDF Toolkit is a Windows library which enhances business processes to stamp, stitch, merge, form-fill, add digital signatures, barcodes to PDF. Both .NET and native APIs are provided. Amongst many other operations, this...

llvm/llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::StringMapImpl::LookupBucketFor

Project: https://github.com/llvm/llvm-project.git Detailed report: https://oss-fuzz.com/testcase?key=4901411281174528 Project: llvm Fuzzer: libFuzzerllvmllvm-dwarfdump-fuzzer Fuzz target binary: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow...

File Upload Vulnerability in PESCMS TEAM v2.1.0

PESCMS TEAM is a task management system open-sourced under the GPLv2 license. A file upload vulnerability exists in PESCMS TEAM v2.1.0 due to the system failing to perform a security check on uploaded zip archive files. An attacker can exploit this vulnerability to upload a Trojan horse file to...

Joomla 3.7 - SQL Injection Vulnerability

Exploit for php platform in category web applications --==Mannu joomla SQL Injection exploiter by Team Indishell==-- body font-family: Tahoma; color: white; background: 333333; input border : solid 2px ; border-color : black; BACKGROUND-COLOR: 444444; font: 8pt Verdana; color: white; submit BORDE...

graphicsmagick/coder_GIF_fuzzer: Use-of-uninitialized-value in MagickArraySize

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5422603280842752 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderGIFfuzzer Fuzz target binary: coderGIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

Targeted Evil Twin Wireless Access Point Attack Toolkit: The Rogue Toolkit

The Rogue Toolkit is an extensible toolkit aimed at providing penetration testers an easy-to-use platform to deploy software-defined Access Points AP for the purpose of conducting penetration testing and red team engagements. By using Rogue, penetration testers can easily perform targeted evil tw...

Massive Spam Campaign Targets Unpatched Systems

Cybercriminals are leveraging a recently patched critical Adobe Flash Player vulnerability in a massive spam campaign targeting unpatched computers. According to cybersecurity firm Morphisec, cybercriminals are blasting spam messages that urge recipients to click a link to download a Word documen...

Contain Attacks in Real Time with Live Response in Cb Defense

Endpoint security is broken. Yes, you’ve heard it before - traditional, signature-based antivirus AV can’t keep up with the volume of new malware and advanced attack methods being developed by cyber criminals every day. And that’s absolutely true. But a report published last year highlights an ev...

imagemagick/encoder_mvg_fuzzer: Heap-buffer-overflow in TracePoint

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5731419616706560 Project: imagemagick Fuzzer: libFuzzerimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

Sony Playstation 4 (PS4) 5.01 < 5.05 - WebKit Code Execution (PoC)

PS4 5.01 WebKit Exploit PoC =========================== Based on: - CVE-2017-7005 - PegaSwitch Copyright 2017 ReSwitched Team - 4.0x exploit by qwertyoruiopz This exploit supports 5.01 maybe others! Installation ============ 1. Install the latest version of node from nodejs.org 2. Clone this...

open62541/fuzz_binary_message: Use-of-uninitialized-value in NodeId_deleteMembers

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5704078257553408 Project: open62541 Fuzzer: libFuzzeropen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type:...

vTiger File Upload

File upload vulnerability in vTiger CompanyDetailsSave.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Invoke-Obfuscation - PowerShell Obfuscator

Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator. Purpose Attackers and commodity malware have started using extremely basic obfuscation techniques to hide the majority of the command from the command line arguments of powershell.exe. I developed this...

CVE-2018-1197: GCP Metadata Endpoint Accessible from Application Containers on Windows | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Windows Stemcells All versions prior to 1200.14 Description Apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this...

ManageEngine OpManager SQL Injection

SQL query restriction bypass vulnerability via default hardcoded admin account Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

DVHMA - Damn Vulnerable Hybrid Mobile App (For Android) That Intentionally Contains Vulnerabilities

Damn Vulnerable Hybrid Mobile App DVHMA is an hybrid mobile app for Android that intentionally contains vulnerabilities. Its purpose is to enable security professionals to test their tools and techniques legally, help developers better understand the common pitfalls in developing hybrid mobile ap...

libreoffice/pptfuzzer: Bad-cast to SdrObjectSdrEdgeObj::Notify in SfxBroadcaster::Broadcast

Detailed report: https://oss-fuzz.com/testcase?key=5146943924731904 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000010fd2e70 Crash State: Bad-cast to...

imagemagick/encoder_pcx_fuzzer: Use-of-uninitialized-value in IsPixelMonochrome

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5648049637425152 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderpcxfuzzer Fuzz target binary: encoderpcxfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

The Fifth Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am taking a deeper dive into each question and breaking them down one at a time. We will discuss why CEOs should care about each question and the type...