Author: Jeremy

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the “next” parameter which then redirects to any domain irrespective of the Host header.

The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8698.

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

In Moodle 3.x, XSS can occur via evidence of prior learning.

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

In Moodle 3.2.x, global search displays user names for unauthenticated users.

With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information.

Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.

Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter.

Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter.