>> AUTHOR: deepcore

Yahoo Gemini suffers from a cross site request forgery vulnerability.

Magento suffered from a cross site scripting vulnerability.

Shopify suffered from an input validation vulnerability.

Silver Peak VX virtual appliance running VXOA before version 6.2.11 contains a number of security vulnerabilities, including command injection, unauthenticated file read, mass assignment, shell upload, and hardcoded credentials. By…

OpenLDAP versions 2.4.42 and below suffer from a remote denial of service vulnerability.

Magento versions 1.9.2 and below suffer from an autoloaded file inclusion vulnerability.

IKEView.exe is vulnerable to local stack based buffer overflow when parsing an malicious (internet key exchange) “.elg” file.

Monsta FTP version 1.6.2 suffers from cross site request forgery and cross site scripting vulnerabilities.

Install.framework has a suid root binary at /System/Library/PrivateFrameworks/Install.framework/Resources/runner that allows for arbitrary mkdir, unlink, and chown.

The private Install.framework has a few helper executables in /System/Library/PrivateFrameworks/Install.framework/Resources, one of which is suid root and exploitable.