Code injection

udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSGPEEK flag...

Free Mobile Recharge - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Free Mobile Recharge published at the 'play' market has multiple vulnerabilities...

Earn Free Recharge - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Earn Free Recharge published at the 'play' market has multiple vulnerabilities...

Mega-Like - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Mega-Like published at the 'play' market has multiple vulnerabilities...

Secure delete - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Secure delete published at the 'play' market has multiple vulnerabilities...

Like Tags For Instagram - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Like Tags For Instagram published at the 'play' market has multiple vulnerabilities...

Machine Liker - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Machine Liker published at the 'play' market has multiple vulnerabilities...

Tweet Followers - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Tweet Followers published at the 'play' market has multiple vulnerabilities...

Github Enterprise - Default Session Secret and Deserialization (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Github Enterprise Default Session Secret And Deserialization Vulnerability", 'Description' = %q This module exploits two securi...

CVE-2017-7250

A Cross-Site Scripting XSS was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data action passed to the 'Gazelle-master/sections/tools/finances/bitcoinbalance.php' URL. An attacker could execute arbitrary HTML and script code in a...

CVE-2017-7247

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data torrents, size passed to the 'Gazelle-master/sections/tools/managers/multiplefreeleech.php' URL. An attacker could execute arbitrary HTML...

Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule EOS def initializeinfo= superupdateinfoinfo, 'Name' = "MS13-022 Microsof...

jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation

It was discovered that the jboss init script performed unsafe file handling which could result in local privilege escalation...

jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation

It was discovered that the jboss init script performed unsafe file handling which could result in local privilege escalation...

Shopify: Setting Arbitrary Cookie at kitcrm.com

Hey The src parameter of Image is not being sanitized which allows me to set cookies at kitcrm.com Proof of Concept 1. Create a post at https://kitcrm.com/pages/ID/manualposts/new 2. Select Schedule for Later 3. Go to Scheduled Posts https://kitcrm.com/pages/ID/manualposts 4. Click Edit on your...

DEBIAN-CVE-2017-6949

An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory, the vector size would be used in unsanitised form as an argument to malloc. With an unexpected size, the impact may have been a segfault ...

UBUNTU-CVE-2017-5033

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline...

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation...

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation...

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation...