gnutls: DTLS client hello contains a random value of all zeroes

A cryptographic weakness was found in the way DLTS implementation of GnuTLS, used zeros in place of random numbers. This flaw can break the security guarantee of the DTLS protocol...

oniguruma:fuzzer: Use-of-uninitialized-value in gbNUMBER_mbc_enc_len

Detailed Report: https://oss-fuzz.com/testcase?key=5674954193633280 Project: oniguruma Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzermsanoniguruma Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gbNUMBERmbcenclen onigencmb4codetombc parseex...

PHP Object Injection

intelliants/subrion is vulnerable to PHP object injection. The vulnerability exists through the serialized data in the subpages value within admin/blocks.php to block/edit...

CVE-2020-12469

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection with resultant file deletion via serialized data in the subpages value within a block to blocks/edit...

CVE-2020-12467

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...

CVE-2020-12468

Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/...

Session fixation

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...

Input validation

Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/...

CVE-2020-12467

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie...

The vulnerability of the SyncImageSettings function in the console-based ImageMagick graphics editor allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the SyncImageSettings function MagickCore/image.c in the ImageMagick console-based graphics editor involves the use of an uninitialized value. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protecte...

exiv2: null pointer dereference in the Exiv2::DataValue::toLong function in value.cpp

Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file...

exiv2: NULL pointer dereference in Exiv2::DataValue::copy in value.cpp leading to application crash

An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference...

CVE-2019-18223

ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...

Unolabo has a flawed logic vulnerability

Unolabo UNLB is an Ether-based digital currency. An integer overflow vulnerability exists in the 'mint' function in UNLB's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

CVE-2020-10911

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-11828

CVE-2020-11828 concerns ColorOS (Android-based OS by OPPO) where RGB is defined on the stack in surfaceflinger.CPP and remains uninitialized. The screenShot RGB assignment may return uninitialized values, causing stack information leakage and enabling a bypass of address space layout randomizatio...

cryptofuzz:cryptofuzz-nss: Use-of-uninitialized-value in selftest_basic_128

Detailed Report: https://oss-fuzz.com/testcase?key=5749776827285504 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-nss Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: selftestbasic128 selftest dosetkey...

kimageformats:kimgio_xcf_fuzzer: Use-of-uninitialized-value in fetchARGB32ToRGBA64PM_avx2

Detailed Report: https://oss-fuzz.com/testcase?key=5700723099828224 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioxcffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: fetchARGB32ToRGBA64PMavx2...

imagemagick:encoder_psd_fuzzer: Use-of-uninitialized-value in PerceptibleReciprocal

Detailed Report: https://oss-fuzz.com/testcase?key=5671531362910208 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: PerceptibleReciprocal...

cryptofuzz:cryptofuzz-nss: Use-of-uninitialized-value in _gcry_camellia_encrypt128

Detailed Report: https://oss-fuzz.com/testcase?key=5190522215071744 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-nss Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: gcrycamelliaencrypt128...