aSc Timetables 2017 is vulnerable to a buffer overflow vulnerability in the input field. An attacker can exploit this vulnerability by sending a specially crafted input to the application, which can lead to code execution. The exploit code and documentation can be found at http://saptech-erp.com.au/resources/Timetables.zip and http://saptech-erp.com.au/resources/TimeTables_2017.pdf respectively. The proof of concept can be found at https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41031.zip.
The vulnerability exists in the Opcodes 03h and 04h of SAPlpd 7.40, which are vulnerable to bad characters 00h and 0ah. An attacker can send a payload of 800 A's to crash the SAPlpd 7.40.
An attacker can bypass authentication by setting the username to '1' or 1=1 -- - and any password.
By setting the username as 'admin' and the password as ' or '1'='1', an attacker can bypass the authentication of Job Portal Script v9.11.
An attacker can exploit this vulnerability to read from the database.
In modules/codec/adpcm.c, VLC can be made to perform an out-of-bounds write with user-controlled input. The function DecodeAdpcmImaQT at adpcm.c:595 allocates a buffer which is filled with bytes from the input stream. However, it does not check that the number of channels in the input stream is less than or equal to the size of the buffer, resulting in an out-of-bounds write. The number of channels is clamped at <= 5. The mangling of the input p_buffer above and in AdpcmImaWavExpandNibble() makes this difficult to exploit, but there is a potential for remote code execution via a malicious media file.
The vulnerability exists in the Movie Portal Script v7.35, allowing an attacker to inject malicious SQL queries via the 'a' and 'f' parameters in the 'artist.php' and 'movie.php' files respectively. Other files may also be vulnerable.
Travel Portal Script v9.33 is vulnerable to SQL Injection. Attackers can exploit this vulnerability to gain access to sensitive information stored in the database. The vulnerable parameters are 'pages.php?id', 'hotel.php?hid' and 'holiday.php?hid'. Other files may also be vulnerable. Attackers can also use this vulnerability to add, edit or delete data from the database.
A TOCTOU (Time of Check to Time of Use) vulnerability was discovered in Firejail, a Linux sandboxing tool, when testing access permissions with access() and then calling copy_file(). This vulnerability could be exploited by a local attacker to gain root privileges.
Cemu is a closed-source Wii U emulator developed by Exzap. It HLEs the Wii U OS APIs. A function at `0x1400AEDC0` is used to set up the API exports. A debug `printf` is used to print out the library name and exported function name. 620 functions were labeled by hand. The emulated API functions do the grunt work of endianness conversion of arguments and return values.
Services By CQR