Category Archives: Advisories

APPLE-SA-10-28-2024-1 iOS 18.1 and iPadOS 18.1

Read Time:26 Second

Posted by Apple Product Security via Fulldisclosure on Oct 28

APPLE-SA-10-28-2024-1 iOS 18.1 and iPadOS 18.1

iOS 18.1 and iPadOS 18.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/121563.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone XS and later
Impact: An attacker with physical access to a locked device…

Read More

Open Redirect / Reflected XSS – booked-schedulerv2.8.5

Read Time:24 Second

Posted by Andrey Stoykov on Oct 28

# Exploit Title: Open Redirect / Reflected XSS – booked-schedulerv2.8.5
# Date: 10/2024
# Exploit Author: Andrey Stoykov
# Version: 2.8.5
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2024/10/friday-fun-pentest-series-13-reflected.html
https://msecureltd.blogspot.com/2024/10/friday-fun-pentest-series-12-open.html

Open Redirect:

Steps to Reproduce:

1. Login and intercept HTTP request with a proxy such as Burpsuite or ZAP
2….

Read More

php-tcpdf-6.7.7-1.fc41

Read Time:46 Second

FEDORA-2024-b00678c08a

Packages in this update:

php-tcpdf-6.7.7-1.fc41

Update description:

Version 6.7.7 (2024-10-26)

Update regular expression to avoid ReDoS (CVE-2024-22641)
[PHP 8.4] Fix: Curl CURLOPT_BINARYTRANSFER deprecated #675
SVG detection fix for inline data images #646
Fix count svg #647
Since the version 6.7.4, the “0” is considered like empty string and not displayed
Fixed handling of transparency in PDF/A mode in addExtGState method
Encrypt /DA string when document is encrypted
Improve quality of generated seed, avoid potential security pitfall
Try to use random_bytes() first if it’s available
Do not include the server parameters in the generated seed, as they might contain sensitive data
Fix bug on _getannotsrefs when there are empty signature appearances but not other annot on a page
Fix SVG coordinate parser that caused drawing artifacts
Remove usage of xml_set_object() function

Read More