glib/fuzz_bookmark: Heap-buffer-overflow in fuzz_bookmark.c

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed report: https://oss-fuzz.com/testcase?key=5131520774766592 Project: glib Fuzzer: libFuzzerglibfuzzbookmark Fuzz target binary: fuzzbookmark Job Type: libfuzzerasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Addres...

Grammarly: Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin

Summary: Attacker could trigger Grammarly extension's gnar.fetch command using a crafted page to perform XHR with cookies and any configurational params to any cross-origin resource. Description: Page could Init Grammarly popup editor no user gesture, helper Events have isTrusted property, which...

www-secure.org XSS vulnerability

Open Bug Bounty ID: OBB-656772 Description| Value ---|--- Affected Website:| www-secure.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-6884

creationtimestamp| type| source ---|---|--- 2018-07-30 08:48:18+00:00| seen| MISP/5b5ece74-a5c8-40cd-87d6-d789950d210f 2020-01-08 13:22:45+00:00| seen| MISP/5e15d698-a3b4-40fd-86e7-15cc02de0b81 2020-10-09 14:13:46+00:00| seen| MISP/b6fb39e0-8665-41f9-bc21-88d7f1945ec4 2020-10-09 16:07:57+00:00|...

iPhone Hacking Campaign Using MDM Software Is Broader Than Previously Known

India-linked highly targeted mobile malware campaign, first unveiled two weeks ago, has been found to be part of a broader campaign targeting multiple platforms, including windows devices and possibly Android as well. As reported in our previous article, earlier this month researchers at Talos...

How to block ads like a pro

In part one of this series, we had a look at a few reasons why you should be blocking online advertisements on your network and devices. From malvertising attacks and privacy-invading tracking systems to just being an outright annoyance, online ads and trackers are a nuisance that provides an...

Semrush: Stored XSS in '' Section and WAF Bypass

Summary Stored Cross-site Scripting XSS is the most dangerous type of Cross Site Scripting. Web applications that allow users to store data are potentially exposed to this type of attack. stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores...

poppler/pdf_fuzzer: Use-of-uninitialized-value in clip01

Project: https://anongit.freedesktop.org/git/poppler/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5664576019365888 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type:...

Code injection

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device...

CVE-2016-6543

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device...

CVE-2016-6542

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address...

CVE-2016-6542 The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address...

CVE-2016-6543

CVE-2016-6543 describes an issue in iTrack Easy where a captured MAC/device ID can be registered under multiple user accounts, allowing access to getgps GPS data and enabling unauthenticated parties to track the device. The connected documents confirm the exposure and associated risk but do not p...

CVE-2016-6542

The CVE-2016-6542 entry concerns the iTrack Easy device, where the BLE MAC address (the tracker ID) can be obtained by being within range of the device. The issue is described as an information exposure vulnerability: an unauthenticated party could learn the device’s BLE MAC address, enabling pot...

[SECURITY] Fedora 28 Update: glpi-9.2.4-2.fc28

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

CVE-2018-0707

creationtimestamp| type| source ---|---|--- 2018-07-13 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/45015 2018-07-14 15:26:26+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/qnapqcenterchangepasswdexec.rb 2018-07-17...

GHSA-HXF9-7H4C-F5JV Django-Anymail prone to a timing attack

webhooks/base.py in Anymail aka django-anymail before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOKAUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events...

Django-Anymail prone to a timing attack

webhooks/base.py in Anymail aka django-anymail before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOKAUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events...

Everybody and their mother is blocking ads, so why aren’t you?

This post may ruffle a few feathers. But we’re not here to offer advice to publishers on how to best generate revenue for their brand. Rather, we’re here to offer the best advice on how to maintain a safe and secure environment. If you’re not blocking advertisements on your PC and mobile device,...

Trackerjacker - Like Nmap For Mapping Wifi Networks You'Re Not Connected To, Plus Device Tracking

Like nmap for mapping wifi networks you're not connected to. Maps and tracks wifi networks and devices through raw 802.11 monitoring. PyPI page: https://pypi.python.org/pypi/trackerjacker Install pip3 install trackerjacker Supported platforms : Linux tested on Ubuntu, Kali, and RPi and macOS...