CVE-2018-1766

IBM Team Concert RTC 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IB...

CVE-2018-1766

IBM Team Concert (RTC) and Rational CLM are affected by a cross-site scripting (XSS) vulnerability in the Web UI for RTC versions 5.0–5.0.2 and 6.0–6.0.5 (6.0.6 iFix03 or later is the remediation). The underlying issue allows an attacker to embed arbitrary JavaScript, potentially altering functio...

IBM Rational Team Concert and Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability

IBM Rational Team Concert RTC and Rational Collaborative Lifecycle Management CLM are both collaborative lifecycle management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM RTC and Rational CLM. A remote attacker can exploit this vulnerability to inject arbitrary...

mupdf/pdf_fuzzer: NULL

Detailed report: https://oss-fuzz.com/testcase?key=5658375946240000 Project: mupdf Fuzzer: aflmupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: aflasanmupdf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN Reproducer...

Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)

Oracle Weblogic Server - Deserialization Remote Command Execution Patch Bypass // All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team // URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/ package ysoserial.payloads; import...

What You Should Look For in a Next-Generation Security Solution

Today’s businesses face a unique set of challenges. They want security that works and is easy to implement and manage but, frequently, are working with a limited budget and resources. Many organizations know their current antivirus solution has gaps, but don’t know where to begin in the search fo...

php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter

The PHP team reports: imapopen allows to run arbitrary shell commands via mailbox parameter...

harfbuzz/hb-shape-fuzzer: Use-of-uninitialized-value in bool hb_sanitize_context_t::check_array<OT::IntType<unsigned char, 1u> >

Detailed report: https://oss-fuzz.com/testcase?key=5097734906839040 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: bool...

Apache Struts 2 Multiple Tags Result Namespace Handling RCE

Remote command execution vulnerability in Apache Struts 2 multiple tags result namespace handling Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

bzip2/bzip2_decompress_target: Crash in unRLE_obuf_to_output_FAST

Detailed report: https://oss-fuzz.com/testcase?key=5660879073312768 Project: bzip2 Fuzzer: libFuzzerbzip2decompresstarget Fuzz target binary: bzip2decompresstarget Job Type: libfuzzerasanbzip2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7ff82d64d2f8 Crash State:...

Beers with Talos EP 39: VB 2018 Rundown and Prevalent Problems with PDF

Beers with Talos BWT Podcast Ep. 39 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 39 show notes: Recorded Oct. 5, 2018 - We start out with a quick chat to get to know this week’s special guests from the Talo...

Deja-XNU

Posted by Ian Beer, Google Project Zero This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2. State of the art An idea I've wanted to play with for a while is to revisit old...

jQuery File Upload

File upload vulnerability in jQuery File Upload server/php/index.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Drupal Core - Multiple Vulnerabilities - SA-CORE-2018-006

Content moderation - Moderately critical - Access bypass - Drupal 8 In some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass. In order to fix this issue, the following changes have been made to content moderation which may have...

gdal/gtiff_fuzzer: Crash in GDAL_LercNS::Lerc2::ReadHeader

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5741391389392896 Project: gdal Fuzzer: aflgdalgtifffuzzer Fuzz target binary: gtifffuzzer Job Type: aflasangdal Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x618f800006ff Crash State:...

libreoffice/ww6fuzzer: Heap-use-after-free in SwIndex::Remove

Detailed report: https://oss-fuzz.com/testcase?key=5733739670274048 Project: libreoffice Fuzzer: afllibreofficeww6fuzzer Fuzz target binary: ww6fuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x61400004ece0 Crash State: SwIndex::Remove...

WordPress Quick Chat SQL Injection

SQL Injection vulnerability in WordPress Quick Chat plugin Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

October 2018 Security Update Release

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. MSRC team...

freetype2/cidtype1: Heap-buffer-overflow in cff_parser_run

Detailed report: https://oss-fuzz.com/testcase?key=5663020483608576 Project: freetype2 Fuzzer: libFuzzerfreetype2cidtype1 Fuzz target binary: cidtype1 Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x60800000007a Crash State: cffparserr...

User-friendly SVN vulnerable to cross-site scripting

Overview User-friendly SVN provided by USVN Team contains a reflected cross-site scripting vulnerability CWE-79. Jun Okutsu of NTT TechnoCross Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...