SIPP 3.3 - Stack-Based Buffer Overflow

Exploit Author: Juan Sacco - http://exploitpack.com Tested on: Kali i686 GNU/Linux Description: SIPP 3.3 is prone to a local unauthenticated stack-based overflow The vulnerability is due to an unproper filter of user suppliedinput while reading the configuration file and parsing the malicious...

Stack overflow

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can...

CVE-2018-3916

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can...

CVE-2018-3916

An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 136 bytes. An attacker can...

CVE-2018-3895

An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 Firmware version 0.20.17. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily...

WUZHI CMS SQL Injection Vulnerability (CNVD-2018-18142)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in the /coreframe/app/admin/pay/admin/index.php file in WUZHI CMS version 4.1.0. A remote attacker can exploit this...

OpenSSL 1.0.2 < 1.0.2p Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2p. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2p advisory. - During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the...

poppler/pdf_fuzzer: Use-of-uninitialized-value in SampledFunction::transform

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5728147954204672 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz targ...

imagemagick/encoder_label_fuzzer: Use-of-uninitialized-value in GetNextUTFCode

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5653291170529280 Project: imagemagick Fuzzer: libFuzzerimagemagickencoderlabelfuzzer Fuzz target binary: encoderlabelfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

CVE-2018-14059

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

Design/Logic Flaw

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_decode_generic_template3

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5645021143891968 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

poppler/pdf_fuzzer: Use-of-uninitialized-value in clip01

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed report: https://oss-fuzz.com/testcase?key=5647387350532096 Project: poppler Fuzzer: libFuzzerpopplerpdffuzzer Fuzz targ...

CVE-2018-3917

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process insecurely extracts the fields from the "shard" table of its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. The...

CVE-2018-3863

On Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17, the video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability. A strcpy overflows t...

PT-2018-16257 · Samsung · Samsung Smartthings Hub

Name of the Vulnerable Software and Affected Versions: Samsung SmartThings Hub STH-ETH-250 version 0.20.17 Description: The issue arises from the incorrect extraction of fields from a user-controlled JSON payload by the video-core process, leading to a buffer overflow on the stack. This can be...

graphicsmagick/coder_MAT_fuzzer: Use-of-uninitialized-value in WriteBlob

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=4847485762666496 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderMATfuzzer Fuzz target binary: coderMATfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

Microsoft Edge Chakra JIT InlineArrayPush Type Confusion

Microsoft Edge: Chakra: JIT: Type confusion with InlineArrayPush This is similar to issue 1531 . The patch seems to prevent type confusion triggered from StElemIA instructions. But the SetItem method can also be invoked through the Array.prototype.push method which can be inlineed. We can achieve...

CVE-2018-12056

The maxRandom function of a smart contract implementation for All For One, an Ethereum gambling game, generates a random value with publicly readable variables because the seed value can be retrieved with a getStorageAt call. Therefore, it allows attackers to always win and get rewards...

kernel: kvm: vmx: host GDT limit corruption

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cp...