The vulnerability of the LPP process in the Android operating system’s CAF builds allows a perpetrator to compromise privacy, integrity, and accessibility.

The vulnerability of the LPP process in the Android operating system’s CAF builds is due to unvalidated array indexing. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

RubyGems Local Arbitrary File Rewrite Vulnerability

RubyGems is a Ruby package manager from the RubyGems organization, which is used to distribute and manage Ruby packages. A security vulnerability exists in RubyGems 2.6.12 and earlier versions that stems from the program not validating specification names. An attacker can exploit the vulnerabilit...

Advantech WebAccess HEAP Buffer Overflow Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. Advantech WebAccess suffers from a HEAP buffer overflow...

Delta Industrial Automation WPLSoft dvp file heap buffer overflow vulnerability (CNVD-2017-228165)

Delta Industrial Automation is a global industrial automation manufacturer of power management and thermal solutions. WPLSoft and PMSoft are Delta's PLC programming software. A heap buffer overflow vulnerability exists in the Delta Industrial Automation WPLSoft dvp file due to a failure to valida...

Delta Industrial Automation WPLSoft dvp file heap buffer overflow vulnerability (CNVD-2017-228238)

Delta Industrial Automation is a global industrial automation manufacturer of power management and thermal solutions. WPLSoft and PMSoft are Delta's PLC programming software. A heap buffer overflow vulnerability exists in the Delta Industrial Automation WPLSoft dvp file. Due to a failure to...

CVE-2016-5872

In all Qualcomm products with Android releases from CAF using the Linux kernel, arguments to several QTEE syscalls are not properly validated...

Advantech WebAccess RtspVapgDecoderNew2 SetPaybackFilePath Stack Buffer Overflow Remote Code Execution Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow remote code execution vulnerabilit...

Advantech WebAccess nvA1Media Connect MediaPassword Stack Buffer Overflow Remote Code Execution Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow remote code execution vulnerabilit...

Advantech WebAccess nvA1Media Connect MediaUsername Stack Buffer Overflow Remote Code Execution Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow remote code execution vulnerabilit...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

Cross site scripting

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

Flash Slideshow Maker Professional XSS / Content Forgery / Redirect

================================================================================= | | | | | | | | | | | |/' | / / / / | ' | /| | ' \ \ / | '| \ \ \ /\ / / | | | \ |/ / | | | | |./ / | | ./ /\ V V / || ||/|| || ||/ || / // C O N T A C T : Twitter: @ret2eax Email: [email protected] Blog:...

Cross-Site Scripting in PAN-OS

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting XSS attack. PAN-OS does not properly validate specific request parameters. Ref PAN-77294 / CVE-2017-9467 Successful exploitation of this issue may allow an attacker to inject arbitrar...

The vulnerability of the RW-message structure in the Aerospike Database Server of the Oracle Database database management system allows a perpetrator to execute arbitrary code.

The vulnerability of the RW-message structure in the Aerospike Database Server of the Oracle Database database management system is related to unvalidated array indexing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code read from beyond the memory limit using a...

Heap Overflow Vulnerability in WPS

WPS is an office software developed by Kingsoft Office Software. A heap overflow vulnerability exists in WPS text. The vulnerability is due to the program fails to validate the buffer length, an attacker can exploit the vulnerability by constructing a malformed XML file resulting in heap corrupti...

Trello: Unpatched (https://hackerone.com/reports/221928)- Unviladate File Upload to XSS on trello-attachment Bucket

Report no: https://hackerone.com/reports/221928 is unpatched. Poc: https://trello-attachments.s3.amazonaws.com/59663070a9025afc4b32c7c6/596641e05abfc29b1bd67ff8/9c5258c6acf27ffdf5e80d5bfabbb83b/lol.svg XSS Link...

The vulnerability of the TrustZone component of the Android operating system allows a hacker to gain access to information.

The vulnerability of the TrustZone component in the Android operating system is related to unvalidated array indexing. Exploiting this vulnerability can allow a remote attacker to gain access to sensitive information...

chromium-browser: possible command injection in mailto handling

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

Memory out-of-bounds access vulnerability in WPS text kso module

WPS is an office software developed by Kingsoft Office Software. A memory out-of-bounds access vulnerability exists in the WPS text kso module. The vulnerability is caused by the program failing to validate the buffer length and calling wcslen directly, which could be exploited by an attacker to...