[SECURITY] Fedora 28 Update: python-markdown2-2.3.6-1.fc28

Markdown is a text-to-HTML filter; it translates an easy-to-read / easy-to-write structured text format into HTML. Markdown's text format is most similar to that of plain text email, and supports features such as headers, emphasis, code blocks, blockquotes, and links. This is a fast and complete...

CVE-2018-5548

On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for origuri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts...

DEBIAN-CVE-2018-16413

ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function...

DEBIAN-CVE-2018-16412

ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function...

PT-2018-3205 · Imagemagick +2 · Imagemagick +2

Name of the Vulnerable Software and Affected Versions: ImageMagick versions 7.0.8 through 7.0.11 Description: The issue is caused by a heap-based buffer over-read in the PushShortPixel function, located in MagickCore/quantum-private.h, which can be exploited by a remote attacker to execute...

Integer Overflow

pycryptodome is vulnerable to integer overflows. The library does not properly check if it is decrypting any incomplete blocks, allowing a malicious user to pass a message encrypted in AES with the ECB mode, causing the application to crash...

PT-2018-2297 · Imagemagick +2 · Imagemagick +2

Name of the Vulnerable Software and Affected Versions: ImageMagick version 7.0.8-11 Q16 Description: The issue is related to a heap-based buffer over-read in the ParseImageResourceBlocks function, located in coders/psd.c. This can be exploited by a remote attacker to cause a denial of service or...

PYSEC-2018-45

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to...

Remote Code Execution (RCE)

YARD is affected by a remote code execution vulnerability. This is due to the usage of eval to parse and evaluate defined? blocks for complex expressions, which allows arbitrary execution of code...

FFmpeg vc1_put_blocks_clamped function out-of-bounds access vulnerability

FFmpeg is a set of open source computer programs that can be used to record, convert digital audio and video to streams under the LGPL or GPL license. An array out-of-bounds access vulnerability exists in the vc1putblocksclamped function in libavcodec/vc1block.c in FFmpeg 4.0.1 when converting a...

Firewall and Privatizing Proxy: macOS Fortress

macOS-Fortress is a Firewall, Blackhole, and Privatizing Proxy for Trackers, Attackers, Malware, Adware, and Spammers. It is Kernel-level, OS-level, and client-level security for macOS. Built to address a steady stream of attacks visible on snort and server logs, as well as blocks ads, malicious...

Moodle Design Vulnerability (CNVD-2018-10648)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in version 3.x of Moodle. An attacker could exploit th...

CVE-2018-1136

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

CVE-2018-1136

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

UBUNTU-CVE-2018-1136

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

CVE-2018-1136

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

Hardcoded credentials

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

CVE-2018-1136

CVE-2018-1136 concerns Moodle 3.x where an authenticated user can add HTML blocks containing scripts to their Dashboard. The vulnerability allows moving such blocks to other pages, enabling visibility to other users (cross-page exposure). The description does not provide patch/version details or ...

CVE-2018-1136: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...

Absolute Computrace Agent Code Execution Vulnerability

Absolute Computrace Agent is an agent program for monitoring computer systems. A security vulnerability exists in Absolute Computrace Agent versions 80.845 and 80.866 that stems from the program's failure to use digital signatures for configuration blocks. An attacker could exploit the...