591 matches found
WordPress Plugin Loco Translate 2.2.1 - Local File Inclusion
Exploit Title: Wordpress Loco Translate Version 2.2.1 Plugin LFI Google Dork: N/A Date: 03 / 26 / 2019 Exploit Author: Ali S. Ahmad S4R1N Vendor Homepage: https://localise.biz/ Software Link: https://wordpress.org/plugins/loco-translate/ Version: Version 2.2.1 Tested on: Debian GNU/Linux 9 Docker...
Loco Translate < 2.2.2 - Authenticated LFI
WordPress plugin Loco Translate version appears to have an Authenticated LFI Vulnerability under the 'Edit Template' Functionality. The following vulnerability can be exploited by any user with access to the plugin access can range from Admin to Subscriber WPScanTeam Note: Was not able to reprodu...
gdal/gdal_vector_translate_fuzzer: Heap-use-after-free in VSIFCloseL
Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5767757281361920 Project: gdal Fuzzer: aflgdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...
Clever Phishing Attack Enlists Google Translate to Spoof Login Page
UPDATE Recently-discovered phishing emails scoop up victims’ Facebook and Google credentials and hides its malicious landing page via a novel method – Google Translate. The phishing campaign uses a two-stage attack to target both Google and Facebook usernames and passwords, according to researche...
Phishing Attacks Against Facebook / Google via Google Translate
When it comes to phishing, criminals put a lot of effort into making their attacks look legitimate, while putting pressure on their victims to take action. In today's post, we're going to examine a recent phishing attempt against me personally...
Cross-Site Scripting (XSS)
angular-gettext is vulnerable to cross-site scripting. interpolationContext is passed to getString or getPlural functions in dist/angular-gettext.js and src/directive.js, which allows attackers to inject arbitrary Javascript code into a victim's browser when the attribute...
CVE-2018-17046
translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js...
CVE-2018-17046
translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js...
translate man cross-site scripting vulnerability
translate man is a browser plugin that can call the Google Translate interface. A cross-site scripting vulnerability exists in versions of translate man prior to 2018-08-21. A remote attacker can exploit the vulnerability to execute malicious code with the help of the...
gdal/gdal_vector_translate_fuzzer: Bad-cast to VSIVirtualHandle from invalid vptr in VSIFWriteL
Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5769514363912192 Project: gdal Fuzzer: libFuzzergdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Bad-cast Crash Address:...
gdal/gdal_vector_translate_fuzzer: Bad-cast to OGRMultiPolygon from OGRGeometryCollection in OGRMultiPolygon* cpl::down_cast<OGRMultiPolygon*, OGRGeometry>
Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4755222246195200 Project: gdal Fuzzer: libFuzzergdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Bad-cast Crash Address:...
gdal/gdal_vector_translate_fuzzer: Heap-buffer-overflow in _escapeString_GCIO
Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5667643664105472 Project: gdal Fuzzer: aflgdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash...
gdal/gdal_vector_translate_fuzzer: Heap-buffer-overflow in SHPCreateLL
Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=4684654431961088 Project: gdal Fuzzer: aflgdalvectortranslatefuzzer Fuzz target binary: gdalvectortranslatefuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...
openSUSE Security Update : translate-toolkit (openSUSE-2018-130)
This update for translate-toolkit to 2.2.4 fixes several issues. This security issue was fixed : - Prevent inclusion of external ressources XXE boo1073535 These non-security issues were fixed : - Added support for nested and WebExtension JSON dialects. - po2txt no longer converts non-translatable...
Scarab ransomware: new variant changes tactics
The Scarab ransomware was discovered in June 2017. Since then, several variants have been created and discovered in the wild. The most popular or widespread versions were distributed via the Necurs botnet and initially written in Visual C compiled. However, after unpacking, we've found that anoth...
XML External Entities (XXE)
translate-toolkit is vulnerable to XML External Entity XXE attacks. The vulnerability exists due to the use of insecure defaults where external entities were resolved. This allows arbitrary file reads when processing malicious XML files...
translate-tattoo.ru XSS vulnerability
Open Bug Bounty ID: OBB-446214 Description| Value ---|--- Affected Website:| translate-tattoo.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...
x86: Incorrect handling of self-linear shadow mappings with translated guests
ISSUE DESCRIPTION The shadow pagetable code uses linear mappings to inspect and modify the shadow pagetables. A linear mapping which points back to itself is known as self-linear. For translated guests, the shadow linear mappings being in a separate address space are not intended to be self-linea...
WordPress My WP Translate plugin <=1.0.3 - Authenticated Option Deletion Vulnerability
WordPress My WP Translate plugin Authenticated Option Deletion Vulnerability was found in 1.0.3 version and exists in the function ajaxmtswptremoveplugin accessible through WordPress AJAX functionality to users who are logged in. Solution Update the plugin...
