FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
△ 🔃
There are new available articles, click to refresh the page.
☐ ☆ ✇ Full Disclosure

CVE-2025-59397 - Open Web Analytics SQL Injection

— October 9th 2025 at 04:30

Posted by Seralys Research Team via Fulldisclosure on Oct 08

Seralys Security Advisory | https://www.seralys.com/research
======================================================================
Title: SQL Injection Vulnerability
Product: Open Web Analytics (OWA)
Affected: Confirmed on 1.8.0 (older versions likely affected)
Fixed in: 1.8.1
Vendor: Open Web Analytics (open-source)
Discovered: August 2025
Severity: HIGH
CWE: CWE-89: SQL Injection
CVE: CVE-2025-59397...
☐ ☆ ✇ Full Disclosure

Re: [FD] Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain → Secure Enclave Key Theft, Wormable RCE, Crypto Theft

— October 7th 2025 at 18:56

Posted by josephgoyd via Fulldisclosure on Oct 07

The GitHub link has a write up on the attack-chain. Along with the CNVD certs that were issued for validation.

https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
☐ ☆ ✇ Full Disclosure

Re: Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain → Secure Enclave Key Theft, Wormable RCE, Crypto Theft

— October 7th 2025 at 18:55

Posted by full on Oct 07

Substack is down. If there is a replacement, it is appreciated.

-x9p
☐ ☆ ✇ Full Disclosure

Re: Defense in depth -- the Microsoft way (part 93): SRP/SAFER whitelisting goes black on Windows 11

— October 7th 2025 at 18:53

Posted by Stefan Kanthak via Fulldisclosure on Oct 07

On a fresh installation of the just released Windows 11 25H2 the former file
%SystemRoot%\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
is %SystemRoot%\System32\SecurityHealthHost.exe now, but the BUG persists:

| svchost.exe (PID = 9876) identified \\?\C:\Windows\System32\SecurityHealthHost.exe
| as Disallowed using default rule, Guid = {11015445-d282-4f86-96a2-9e485f593302}

stay tuned, and far away from bug-riddled Windows...
☐ ☆ ✇ Full Disclosure

Samtools v1.22.1 Uncontrolled Memory Allocation from Large BED Intervals Causes Denial-of-Service in Samtools/HTSlib

— September 30th 2025 at 15:19

Posted by Ron E on Sep 30

A denial-of-service vulnerability exists in Samtools and the underlying
HTSlib when processing BED files containing extremely large interval
values. The bed_index_core() function in bedidx.c uses the interval end
coordinate to calculate allocation size without sufficient validation. By
supplying a BED record with a crafted end coordinate (e.g., near 2^61), an
attacker can trigger uncontrolled memory allocation requests via
hts_resize_array_()....
☐ ☆ ✇ Full Disclosure

Samtools v1.22.1 Improper Handling of Excessive Histogram Bin Counts in Samtools Coverage Leads to Stack Overflow

— September 30th 2025 at 15:19

Posted by Ron E on Sep 30

In the samtools coverage subcommand, the -w / --n-bins option allows the
user to specify how many “bins” to produce in the coverage histogram. The
code computes: stats[tid].bin_width = (stats[tid].end - stats[tid].beg) /
n_bins; When the number of bins (n_bins) is extremely large relative to the
region length (end - beg), this integer division can yield zero, or lead to
unexpected behavior in subsequent arithmetic. Later in print_hist(),...
☐ ☆ ✇ Full Disclosure

libgeotiff 1.7.4 Heap Buffer Overflow in geotifcp (libgeotiff) During 8-to-4 Bit Downsample with Odd Image Width

— September 30th 2025 at 15:19

Posted by Ron E on Sep 30

A heap buffer overflow vulnerability exists in the geotifcp utility,
distributed as part of libgeotiff. The flaw occurs in the function
cpContig2ContigByRow_8_to_4 when processing TIFF images with an odd
ImageWidth and using the -d option (downsampling from 8-bit to 4-bit).
During conversion, the function iterates over pixels in pairs and always
accesses buf_in[i_in+1]. When the width is odd, the last iteration
dereferences one byte past the...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-29-2025-6 visionOS 26.0.1

— September 30th 2025 at 15:19

Posted by Apple Product Security via Fulldisclosure on Sep 30

APPLE-SA-09-29-2025-6 visionOS 26.0.1

visionOS 26.0.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125338.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

FontParser
Available for: Apple Vision Pro
Impact: Processing a maliciously crafted font may lead to unexpected app
termination...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-29-2025-5 macOS Sonoma 14.8.1

— September 30th 2025 at 15:19

Posted by Apple Product Security via Fulldisclosure on Sep 30

APPLE-SA-09-29-2025-5 macOS Sonoma 14.8.1

macOS Sonoma 14.8.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125330.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

FontParser
Available for: macOS Sonoma
Impact: Processing a maliciously crafted font may lead to unexpected app...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-29-2025-4 macOS Sequoia 15.7.1

— September 30th 2025 at 15:19

Posted by Apple Product Security via Fulldisclosure on Sep 30

APPLE-SA-09-29-2025-4 macOS Sequoia 15.7.1

macOS Sequoia 15.7.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125329.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

FontParser
Available for: macOS Sequoia
Impact: Processing a maliciously crafted font may lead to unexpected app...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-29-2025-3 macOS Tahoe 26.0.1

— September 30th 2025 at 15:19

Posted by Apple Product Security via Fulldisclosure on Sep 30

APPLE-SA-09-29-2025-3 macOS Tahoe 26.0.1

macOS Tahoe 26.0.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125328.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

FontParser
Available for: macOS Tahoe
Impact: Processing a maliciously crafted font may lead to unexpected app
termination...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-29-2025-2 iOS 18.7.1 and iPadOS 18.7.1

— September 30th 2025 at 15:19

Posted by Apple Product Security via Fulldisclosure on Sep 30

APPLE-SA-09-29-2025-2 iOS 18.7.1 and iPadOS 18.7.1

iOS 18.7.1 and iPadOS 18.7.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125327.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

FontParser
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch
3rd generation and...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-29-2025-1 iOS 26.0.1 and iPadOS 26.0.1

— September 30th 2025 at 15:19

Posted by Apple Product Security via Fulldisclosure on Sep 30

APPLE-SA-09-29-2025-1 iOS 26.0.1 and iPadOS 26.0.1

iOS 26.0.1 and iPadOS 26.0.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125326.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

FontParser
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro...
☐ ☆ ✇ Full Disclosure

SEC Consult SA-20250925-0 :: Multiple Vulnerabilities in iMonitorSoft EAM employee monitoring #CVE-2025-10540 #CVE-2025-10541 #CVE-2025-10542

— September 25th 2025 at 22:49

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 25

SEC Consult Vulnerability Lab Security Advisory < 20250925-0 >
=======================================================================
title: Multiple Vulnerabilities
product: iMonitorSoft EAM
vulnerable version: iMonitor EAM 9.6394
fixed version: -
CVE number: CVE-2025-10540, CVE-2025-10541, CVE-2025-10542
impact: Critical
homepage:...
☐ ☆ ✇ Full Disclosure

SEC Consult SA-20250923-0 :: Missing Certificate Validation leading to RCE in CleverControl employee monitoring software #CVE-2025-10548

— September 25th 2025 at 22:49

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 25

SEC Consult Vulnerability Lab Security Advisory < 20250923-0 >
=======================================================================
title: Missing Certificate Validation leading to RCE
product: CleverControl employee monitoring software
vulnerable version: 11.5.1041.6
fixed version: -
CVE number: CVE-2025-10548
impact: high
homepage: https://clevercontrol.com...
☐ ☆ ✇ Full Disclosure

CyberDanube Security Research 20250919-0 | Multiple Vulnerabilities in Novakon P series

— September 25th 2025 at 22:49

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Sep 25

CyberDanube Security Research 20250919-0
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities in Novakon HMI Series
product| Novakon Touch Screen HMI P Series
vulnerable version| P - V2001.A.c518o2
fixed version| -
CVE number| CVE-2025-9962, CVE-2025-9963, CVE-2025-9964,
| CVE-2025-9965, CVE-2025-9966...
☐ ☆ ✇ Full Disclosure

CyberDanube Security Research 20250909-0 | Cross-Site Scripting in Schneider ATV 630

— September 25th 2025 at 22:49

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Sep 25

CyberDanube Security Research 20250909-0
-------------------------------------------------------------------------------
title| Reflected XSS
product| ATV 630
vulnerable version| "see Vulnerable versions"
fixed version| none
CVE number| CVE-2025-7746
impact| Medium
homepage| https://www.se.com/
found| 2025-03-11
by| T....
☐ ☆ ✇ Full Disclosure

xpra server information disclosure

— September 25th 2025 at 22:48

Posted by Antoine Martin via Fulldisclosure on Sep 25

1) About Xpra
Xpra is known as "screen for X11".
https://xpra.org/
"Xpra forwards and synchronizes many extra desktop features, which
allows remote applications to integrate transparently into the client's
desktop environment: audio input and output, printers, clipboard, system
trays, notifications, webcams, etc."

2) Vulnerability
Using the server's "control" subsystem, a client can enable sensitive...
☐ ☆ ✇ Full Disclosure

Defense in depth -- the Microsoft way (part 94): BACKDOOR planted in AppLocker

— September 23rd 2025 at 03:35

Posted by Stefan Kanthak via Fulldisclosure on Sep 22

Hi @ll,

since several years Microsoft installs the DLLs domain_actions.dll
and well_known_domains.dll as part of their Edge browser as well as
Windows' WebView component into each and every user profile,
UNPROTECTED against tampering.

On Windows 11 24H2 their paths are currently
"%LOCALAPPDATA%\Microsoft\Edge\User Data\Domain Actions\3.0.0.16\domain_actions.dll"
"%LOCALAPPDATA%\Microsoft\Edge\User Data\Domain...
☐ ☆ ✇ Full Disclosure

Defense in depth -- the Microsoft way (part 94): BACKDOOR planted in AppLocker

— September 23rd 2025 at 03:35

Posted by Stefan Kanthak via Fulldisclosure on Sep 22

Hi @ll,

since several years Microsoft installs the DLLs domain_actions.dll
and well_known_domains.dll as part of their Edge browser as well as
Windows' WebView component into each and every user profile,
UNPROTECTED against tampering.

On Windows 11 24H2 their paths are currently
"%LOCALAPPDATA%\Microsoft\Edge\User Data\Domain Actions\3.0.0.16\domain_actions.dll"
"%LOCALAPPDATA%\Microsoft\Edge\User Data\Domain...
☐ ☆ ✇ Full Disclosure

Defense in depth -- the Microsoft way (part 93): SRP/SAFER whitelisting goes black on Windows 11

— September 23rd 2025 at 03:35

Posted by Stefan Kanthak via Fulldisclosure on Sep 22

Hi @ll,

more than 2.5 years ago I posted "Defense in depth -- the Microsoft way
(part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2"
<https://seclists.org/fulldisclosure/2023/Feb/13>

In "SRP on Windows 11" <https://seclists.org/fulldisclosure/2023/Mar/1>
Andy Ful presented a persistent correction some days later.

Since several months now (unfortunately I can't tell the exact time)...
☐ ☆ ✇ Full Disclosure

libelf 0.8.12 Stack-based buffer overflow in gmo2msg (libelf) via unbounded sprintf of lang argument

— September 23rd 2025 at 03:35

Posted by Ron E on Sep 22

gmo2msg in libelf contains a stack-based buffer overflow in po/gmo2msg.c
when constructing filenames from the first program argument (lang). The
program uses a fixed-size local buffer (char buf[1024]) and writes into it
using sprintf(buf, "%s.gmo", lang) and sprintf(buf, "%s.msg", lang) without
validating the length of lang. Supplying a sufficiently long lang argument
(e.g., ~1200 bytes) causes sprintf to write past the end of...
☐ ☆ ✇ Full Disclosure

Stored HTML Injection - flatpressv1.4.1

— September 23rd 2025 at 03:35

Posted by Andrey Stoykov on Sep 22

# Exploit Title: Stored HTML Injection - flatpressv1.4.1
# Date: 09/2025
# Exploit Author: Andrey Stoykov
# Version: 1.4.1
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/09/friday-fun-pentest-series-41-stored.html

Stored HTML Injection:

Steps to Reproduce:

- Login with admin user and visit "Main" > "New Entry" > "Write Entry" and
in the description enter the payload "[html]<div...
☐ ☆ ✇ Full Disclosure

Current Password not Required When Changing Password - flatpressv1.4.1

— September 23rd 2025 at 03:35

Posted by Andrey Stoykov on Sep 22

# Exploit Title: Current Password not Required When Changing Password -
flatpressv1.4.1
# Date: 09/2025
# Exploit Author: Andrey Stoykov
# Version: 1.4.1
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/09/friday-fun-pentest-series-42-current.html

Current Password not Required When Changing Password:

Steps to Reproduce:

- Login with admin user and visit "Main" > "Configuration" > "General...
☐ ☆ ✇ Full Disclosure

[CFP] Burning River Cyber Con '25 - Cleveland, OH

— September 23rd 2025 at 03:34

Posted by Burning River Cyber Con via Fulldisclosure on Sep 22

Burning River CyberCon is seeking submissions for our 2025 conference. We're looking for presentations on all things
infosec, from vulnerability research and exploit development to red teaming and security automation.

Key Details:

-

CFP Link: https://burningrivercybercon.com/call-for-papers

-

CFP Closes: October 1, 2025

-

Conference Date: November 15, 2025

Submit your talk today.
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-12 Xcode 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-12 Xcode 26

Xcode 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125117.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Dev Tools
Available for: macOS Sequoia 15.6 and later
Impact: Processing an overly large path value may crash a process
Description: A path...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-11 Safari 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-11 Safari 26

Safari 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125113.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Safari
Available for: macOS Sonoma and macOS Sequoia
Impact: Visiting a malicious website may lead to address bar spoofing
Description: The...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-10 visionOS 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-10 visionOS 26

visionOS 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125115.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleMobileFileIntegrity
Available for: Apple Vision Pro
Impact: An app may be able to access sensitive user data
Description: A...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-9 watchOS 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-9 watchOS 26

watchOS 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125116.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: Apple Watch Series 9 and later, Apple Watch SE 2nd
generation, Apple Watch Ultra (all models)
Impact:...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-8 tvOS 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-8 tvOS 26

tvOS 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125114.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: Apple TV 4K (2nd generation and later)
Impact: An app may be able to cause unexpected system termination...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-7 macOS Sonoma 14.8

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-7 macOS Sonoma 14.8

macOS Sonoma 14.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125112.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AMD
Available for: macOS Sonoma
Impact: An app may be able to cause unexpected system termination
Description: A buffer...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-6 macOS Sequoia 15.7

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-6 macOS Sequoia 15.7

macOS Sequoia 15.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125111.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AMD
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination
Description: A buffer...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-5 macOS Tahoe 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-5 macOS Tahoe 26

macOS Tahoe 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125110.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Airport
Available for: Mac Studio (2022 and later), iMac (2020 and later), Mac
Pro (2019 and later), Mac mini (2020 and later),...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-4 iOS 15.8.5 and iPadOS 15.8.5

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-4 iOS 15.8.5 and iPadOS 15.8.5

iOS 15.8.5 and iPadOS 15.8.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125142.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

ImageIO
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st generation), iPad...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-3 iOS 16.7.12 and iPadOS 16.7.12

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-3 iOS 16.7.12 and iPadOS 16.7.12

iOS 16.7.12 and iPadOS 16.7.12 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125141.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

ImageIO
Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation,
iPad Pro 9.7-inch,...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-2 iOS 18.7 and iPadOS 18.7

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-2 iOS 18.7 and iPadOS 18.7

iOS 18.7 and iPadOS 18.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125109.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Audio
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch
3rd generation and later, iPad...
☐ ☆ ✇ Full Disclosure

APPLE-SA-09-15-2025-1 iOS 26 and iPadOS 26

— September 16th 2025 at 03:01

Posted by Apple Product Security via Fulldisclosure on Sep 15

APPLE-SA-09-15-2025-1 iOS 26 and iPadOS 26

iOS 26 and iPadOS 26 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125108.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro 11-inch...
☐ ☆ ✇ Full Disclosure

libwmf v0.2.13 Integer Overflow in libwmf Left-Shift Operations (wmf.c, fig.c, svg.c)

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

libwmf is vulnerable to an integer overflow / undefined behavior condition
in multiple code paths. The affected source files (wmf.c, fig.c, svg.c) use
left-shift operations on signed integers that shift into the sign bit
(e.g., 1 << 31). According to the C standard, shifting a signed integer
into the sign bit is undefined behavior and may lead to incorrect values or
unexpected execution paths. When a crafted WMF file is processed with tools...
☐ ☆ ✇ Full Disclosure

CHMLib 0.40a Integer Overflow in _unmarshal_int32 / _unmarshal_uint32 During CHM Header Parsing

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

A vulnerability exists in CHMLib (latest release 0.40) when parsing
malformed CHM (Compiled HTML Help) files. The functions _unmarshal_int32
and _unmarshal_uint32 reconstruct 32-bit values using left shifts on signed
integers without proper type casting: *dest = (*pData)[0] | (*pData)[1]<<8
| (*pData)[2]<<16 | (*pData)[3]<<24; If an attacker supplies crafted input
such that the most significant byte is 0xFF, this triggers a left...
☐ ☆ ✇ Full Disclosure

CHMLIB 0.40a Integer Overflow in LZX Decompression of CHMLib

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

An integer overflow vulnerability exists in the LZX decompression routines
of CHMLib (tested in version 0.40, latest release as of 2025). The issue
occurs within lzx.c during bitstream parsing (lzx_read_lens and
LZXdecompress), where crafted CHM files can supply values that cause
left-shift operations to exceed the representable range of 32-bit signed
integers. When processing malformed compressed blocks, operations such as:
leaf = pos >>...
☐ ☆ ✇ Full Disclosure

libvips v8.18.0 Function Pointer Type Confusion in libvips Callback Dispatch

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

Multiple functions in libvips invoke callbacks through incorrectly cast
function pointers, resulting in Undefined Behavior (UB). During
runtime, callbacks
such as search_package, vips_class_map_all, vips_foreign_find_load_sub,
vips_object_real_postbuild, and vips_area_free_cb are called through
function pointer types that do not match their actual signatures. This is
benign on x86-64, where calling conventions tolerate mismatches, but on
stricter...
☐ ☆ ✇ Full Disclosure

gbsplay 0.0.100-18 Heap Buffer Overflow in update_status_on_subsong_change in gbsplay

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

A heap buffer overflow vulnerability exists in gbsplay 0.0.100-18-g50352f3
(latest development snapshot at the time of testing). When opening a
crafted GBS file with inconsistent subsong metadata, the function
update_status_on_subsong_change (gbs.c:501) reads past the bounds of a
heap-allocated structure. The bug is triggered during subsong status update
when the reported total_songs or subsong indices are malformed.
AddressSanitizer (ASan)...
☐ ☆ ✇ Full Disclosure

libicns v0.8.1 Out-of-Bounds Read in libicns icns_family.c when parsing malformed .icns files

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

libicns fails to validate element size fields in .icns files properly. A
crafted file can cause the library to allocate insufficient memory for an
icns_family_t structure. When icns_family.c treats this undersized memory
as a complete struct, it dereferences members that lie beyond the allocated
space. This results in an Out-of-Bounds Read (CWE-125). Depending on
subsequent code paths, these invalid member references may also be written
to,...
☐ ☆ ✇ Full Disclosure

libicns v0.8.1 Signed Integer Overflow in libicns during .icns file parsing

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

libicns incorrectly handles certain byte values when parsing .icns files.
Specifically, shifting a byte with value 255 by 24 bits in a signed 32-bit
integer causes an integer overflow, as the resulting value exceeds the
maximum representable value for a signed int.

*Impact:*

- Applications using libicns may crash or terminate parsing when
processing a malicious .icns file.
- Overflow may propagate to other computations or data...
☐ ☆ ✇ Full Disclosure

libicns v0.8.1 Heap Buffer Overflow in libicns ICNS Parsing (icns2png)

— September 16th 2025 at 03:01

Posted by Ron E on Sep 15

libicns, a library used for parsing Apple ICNS image files, contains a
heap-based buffer overflow in the icns2png utility and associated library
components (icns_image.c). The vulnerability occurs when parsing malformed
ICNS files where element sizes are crafted to exceed the allocated heap
buffer. Specifically, the function icns_get_image_from_element() performs a
memcpy() using a length field read from the ICNS element without proper
bounds...
☐ ☆ ✇ Full Disclosure

SEC Consult SA-20250911-0 :: Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider (SP) (ODBC interface)

— September 16th 2025 at 03:01

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 15

SEC Consult Vulnerability Lab Security Advisory < 20250911-0 >
=======================================================================
title: Unauthenticated SQL Injection Vulnerability
product: Shibboleth Service Provider (SP) (ODBC interface)
vulnerable version: <=3.5.0
fixed version: 3.5.1
CVE number: CVE-2025-9943
impact: High
homepage:...
☐ ☆ ✇ Full Disclosure

Re: [FD] Apple’s A17 Pro Chip: Critical Flaw Causes Dual Subsystem Failure & Forensic Log Loss

— September 16th 2025 at 03:00

Posted by josephgoyd via Fulldisclosure on Sep 15


☐ ☆ ✇ Full Disclosure

User Enumeration in IServ Schoolserver Web Login

— September 11th 2025 at 02:37

Posted by naphthalin via Fulldisclosure on Sep 10

“I know where your children go to school.”
The web front end of the IServ school server from IServ GmbH allows user
enumeration. Responses during failed login attempts differ, depending on
if the user account exists, does not exist and other conditions. While
this does not pose a security risk in many applications, it has to be
considered extremely problematic in software designed for schools. Due
to the widespread use of IServ in...
☐ ☆ ✇ Full Disclosure

Re: Apple’s A17 Pro Chip: Critical Flaw Causes Dual Subsystem Failure & Forensic Log Loss

— September 11th 2025 at 02:36

Posted by Matthew Fernandez on Sep 10

Can you elaborate on why you consider this high severity? From the
description, it sounds as if this behaviour is fail-closed. That is, the
effects are limited to DoS, with security properties preserved.
☐ ☆ ✇ Full Disclosure

Defense in depth -- the Microsoft way (part 92): more stupid blunders of Windows' File Explorer

— September 8th 2025 at 22:33

Posted by Stefan Kanthak via Fulldisclosure on Sep 08

Hi @ll,

this extends the two previous posts titled Defense in depth --
the Microsoft way (part 90): "Digital Signature" property sheet
missing without "Read Extended Attributes" access permission
<https://seclists.org/fulldisclosure/2025/Jul/39> and Defense
in depth -- the Microsoft way (part 91): yet another 30 year
old bug of the "Properties" shell extension
<https://seclists.org/fulldisclosure/2025/Aug/2...
☐ ☆ ✇ Full Disclosure

Critical Security Report – Remote Code Execution via Persistent Discord WebRTC Automation

— September 8th 2025 at 22:33

Posted by Taylor Newsome on Sep 08

Reporter: [Taylor Christian Newsome / SleepRaps () gmail com]
Date: [8/21/2025]
Target: Discord WebRTC / Voice Gateway API
Severity: Critical

1. Executive Summary
A proof-of-concept (PersistentRTC) demonstrates remote code execution (RCE)
capability against Discord users. The PoC enables
Arbitrary JavaScript execution in a victim’s browser context via WebRTC
automation.
Persistent access to Discord voice channels without user consent.
Optional...
☐ ☆ ✇ Full Disclosure

Submission of Critical Firmware Parameters – PCIe HCA Cards

— September 8th 2025 at 22:33

Posted by Taylor Newsome on Sep 08

*To:* support () mellanox com, networking-support () nvidia com

*From:* Taylor Christian Newsome

*Date:* August 20, 2025

*Dear Mellanox/NVIDIA Networking Support Team,*

I am writing to formally submit the critical firmware parameters for
Mellanox PCI Express Host Channel Adapter (HCA) cards, as detailed in the
official documentation available here:
https://content.mellanox.com/firmware/critical_params.txt.

This document specifies essential...
☐ ☆ ✇ Full Disclosure

SEC Consult SA-20250908-0 :: NFC Card Vulnerability Exploitation Leading to Free Top-Up in KioSoft "Stored Value" Unattended Payment Solution (Mifare)

— September 8th 2025 at 22:33

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 08

SEC Consult Vulnerability Lab Security Advisory < 20250908-0 >
=======================================================================
title: NFC Card Vulnerability Exploitation Leading to Free Top-Up
product: KioSoft "Stored Value" Unattended Payment Solution (Mifare)
vulnerable version: Current firmware/hardware as of Q2/2025
fixed version: No version numbers available
CVE number:...
☐ ☆ ✇ Full Disclosure

FFmpeg 7.0+ Integer Overflow in FFmpeg cache: Protocol (CacheEntry::size)

— September 8th 2025 at 22:28

Posted by Ron E on Sep 08

An integer overflow vulnerability exists in the FFmpeg cache: URL protocol
implementation. The CacheEntry structure uses a 32-bit signed integer to
store cache entry sizes (int size), but the cache layer can accumulate
cached data exceeding 2 GB. Once entry->size grows beyond INT_MAX and new
data is appended, an overflow occurs. This results in corrupted cache
metadata and can lead to logic errors, incorrect data reads, and possible...
☐ ☆ ✇ Full Disclosure

FFmpeg 7.0+ Integer Overflow in DSCP Option Handling of FFmpeg UDP Protocol

— September 8th 2025 at 22:28

Posted by Ron E on Sep 08

A vulnerability exists in the FFmpeg UDP protocol implementation (
libavformat/udp.c) where the dscp parameter is parsed from a URI and
left-shifted without bounds checking. Supplying a maximum 32-bit signed
integer (2147483647) triggers undefined behavior due to a left shift that
exceeds the representable range of int. This results in abnormal process
termination (DoS) and may lead to miscompiled logic or further memory
corruption depending on...
☐ ☆ ✇ Full Disclosure

FFmpeg 7.0+ Integer Overflow in UDP Protocol Handler (fifo_size option)

— September 8th 2025 at 22:28

Posted by Ron E on Sep 08

A signed integer overflow exists in FFmpeg’s udp.c implementation when
parsing the fifo_size option from a user-supplied UDP URL. The overflow
occurs during multiplication, which is used to compute the size of the
circular receive buffer. This can result in undefined behavior, allocation
failures, or potentially memory corruption depending on compiler
optimizations and downstream usage. (FFmpeg 7.0-8.0))
*Impact:*

-

Denial of Service...
☐ ☆ ✇ Full Disclosure

FFmpeg 7.0+ LADSPA Filter Arbitrary Shared Object Loading via Unsanitized Environment Variables

— September 8th 2025 at 22:28

Posted by Ron E on Sep 08

The ladspa audio filter implementation (libavfilter/af_ladspa.c) in FFmpeg
allows unsanitized environment variables to influence dynamic library
loading. Specifically, the filter uses getenv("LADSPA_PATH") and
getenv("HOME") when resolving the plugin shared object (.so) name provided
through the file option. These values are concatenated into a filesystem
path and passed directly into dlopen() without validation or...
☐ ☆ ✇ Full Disclosure

FFmpeg 7.0+ NULL Pointer Dereference in FFmpeg String Handling (avstring.c)

— September 8th 2025 at 22:28

Posted by Ron E on Sep 08

Improper validation in libavutil/avstring.c allows a NULL pointer
dereference when processing certain strings in HLS contexts. UBSan reports
"applying zero offset to null pointer." Triggers denial of service (DoS)
when FFmpeg processes malicious playlists or malformed URLs. (FFmpeg 7.0 –
8.0)

*Impact:*

-

Consistently crashes the process (DoS).
-

Exploitation beyond denial of service is unlikely on modern OSes.

*Proof...
❌