Re: [FD] Text injection on https://www.google.com/sorry/index via ?q parameter (no XSS)

2025-02-16 Thread David Fifield
Today at about 2025-02-13 19:00 I noticed the "≠" is back, but now the type 0x12 payload of the ?q query parameter gets formatted into the string representation of an IP address, rather than being copied almost verbatim into the page. If the payload length is 4 bytes, it gets formatted as an IPv4 a

[FD] Netgear Router Administrative Web Interface Lacks Transport Encryption By Default

2025-02-16 Thread Ryan Delaney via Fulldisclosure
___ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

[FD] Monero 18.3.4 zero-day DoS vulnerability has been dropped publicly on social network.

2025-02-16 Thread upper.underflow via Fulldisclosure
Hello, About an hour ago, a group appearing to be named WyRCV2 posted a note on the nostr social network, which can be found at the following link: https://primal.net/e/note1vzh0mj9rcxax9cgcdapupyxeehjprd68gd9kk9wrv939m8knulrs4780x7 >Monero Zero-day vulnerability and exploit > >Take down the XM

[FD] [CVE-2024-54756] GZDoom <= 4.13.1 Arbitrary Code Execution via Malicious ZScript

2025-02-16 Thread Gabriel Valachi via Fulldisclosure
In GZDoom 4.13.1 and below, there is a vulnerability involving array sizes in ZScript, the game engine's primary scripting language. It is possible to dynamically allocate an array of 1073741823 dwords, permitting access to the rest of the heap from the start of the array and causing a second ar