Resources(82)

Brian McDermott

The Tang open source software is used to bind data to network presence. It is commonly used along with Clevis clients to provide for unattended LUKS decryption of server storage volumes within the realms of a network, where a trusted Tang server is situated. CENSUS identified that the Tang software in versions 11, 12...

Ioannis Christodoulakos

Reflected XSS vulnerabilities were discovered in Squidex (versions before 7.4.0) in the "/squid.svg" endpoint. Attackers can craft malicious links containing injected JavaScript that executes in victims' browsers when opened, potentially leading to session hijacking and account takeover. The issue was fixed in version...

George Poulios

CENSUS identified a buffer overflow vulnerability in the atcab_sign_base function of the cryptoauthlib library. This library is part of the standard SDK provided by Microchip and is used to drive the operation of cryptographic co-processors sold by the vendor, such as the ATECC608A.

Anestis Bechtsoudis

Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats. Stagefright features for audio and video playback include integration with OpenMAX codecs, session management, time-synchronized rendering, transport...

Anestis Bechtsoudis

Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats.CENSUS engineers have discovered that the libavcodec H.264 software decoder invoked by libstagefright has an OOB write heap overflow at the...

Anestis Bechtsoudis

Android provides a media playback engine at the native level called Stagefright that comes built-in with software-based codecs for several popular media formats. CENSUS engineers have discovered that the MPEG-2 software decoder invoked by libstagefright has an out-of-bounds read at the impeg2d_dec_user_data()...

CENSUS

An information exposure flaw in Oracle WebCenter (Fusion Middleware 11.1.1.7 and 11.1.1.8) allows an unauthenticated attacker to access user profile data — including usernames, emails, phone numbers, and files — by abusing a default WebCenter account. Tracked as CVE‑2014‑0450, the issue enables full enumeration of...

CENSUS

A design flaw in libpurple causes the plaintext of OTR messages to be broadcast over DBus, exposing private conversations to any process running under the same user account. Because libpurple does not propagate "no‑log" or privacy flags to third‑party listeners, applications such as widgets or notification systems may...

CENSUS

A blind SQL injection flaw in Netvolution v2.5.8 (ASP) allows attackers to inject arbitrary SQL commands through the HTTP Referer header. Because the CMS fails to sanitize this header, an unauthenticated attacker can extract database contents, modify site data, inject malicious JavaScript, harvest CMS usernames and...

Patroklos Argyroudis

.3‑RELEASE, and 8.0Short description:** Two improper input‑validation flaws in the FreeBSD NFS client (versions 7.2‑RELEASE, 7.3‑RELEASE, and 8.0‑RELEASE) allow local unprivileged users to trigger kernel stack and kernel heap overflows through crafted arguments to the mount(2) and nmount(2) system calls when...

Patroklos Argyroudis

A flaw in Monkey HTTPd versions 0.9.2 and earlier allows remote attackers to crash worker threads by sending HTTP requests with malformed Connection headers. Due to improper input validation and incorrect buffer‑end calculations in Request_Find_Variable(), certain crafted request bodies trigger signedness and...

Patroklos Argyroudis

A flaw in the CoreHTTP web server (versions 0.5.3.1 and earlier) allows remote attackers to trigger an off‑by‑one stack buffer overflow during parsing of malformed HTTP method names or URIs. Because the server's sscanf() call writes a full 256 bytes into 256‑byte buffers without ensuring NULL‑termination, crafted...

Patroklos Argyroudis

An off‑by‑two stack buffer overflow in the Linux SUNRPC subsystem (kernel versions 2.6.32 through 2.6.32‑rc7) allows out‑of‑bounds writes in the function rpc_uaddr2sockaddr() when processing universal address strings of maximum length. Because the function writes two bytes past the end of a fixed‑size stack buffer, a...

Patroklos Argyroudis

A stack‑based buffer overflow in gif2png (versions 2.5.1 and earlier) allows attackers to overwrite memory by supplying an overly long filename on the command line. Because the program uses an unsafe strcpy() into a fixed‑size buffer, crafted input can cause a crash or potentially enable remote code execution when...

CENSUS

A path‑sanitization flaw in Rasterbar libtorrent (versions 0.14.3 and earlier) allows attackers to craft malicious multi‑file .torrent metadata that includes directory components containing embedded relative paths (e.g., "../../"). Because libtorrent only checks for exact ".." matches, these malformed elements bypass...

CENSUS

A vulnerability in older Debian GNU libc (libc6 ≤ 2.7) caused stack protection (SSP / -fstack-protector) to use a fixed, predictable canary value (0xff0a0000) instead of a random one. Normally, stack canaries are randomized at runtime to prevent attackers from guessing them during buffer overflow attacks. However,...