11403 matches found
search.birminghamimages.org.uk Cross Site Scripting vulnerability OBB-1379313
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
305 CVEs and Counting: Bug-Hunting Stories From a Security Engineer
Larry Cashdollar, senior security response engineer at Akamai, has been finding CVEs since the 1990s, around when MITRE was first being established. Since then, he’s found 305 CVEs – as well as various security findings, such an IoT bricking malware called Silex, and cybercriminals targeting poor...
[SECURITY] Fedora 32 Update: podman-2.1.1-7.fc32
podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...
Fedora: Security Advisory for podman (FEDORA-2020-76fcd0ba34)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
search.birminghamimages.org.uk Cross Site Scripting vulnerability OBB-1373665
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
openSUSE Security Update : roundcubemail (openSUSE-2020-1516)
This update for roundcubemail fixes the following issues : roundcubemail was upgraded to 1.3.15 This is a security update to the LTS version 1.3. boo1175135 - Security: Fix cross-site scripting XSS via HTML messages with malicious svg content CVE-2020-16145 - Security: Fix cross-site scripting XS...
python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images
An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read...
USN-4549-1 imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain specially crafted image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or other unspecified impact. CVE-2019-1994...
search.birminghamimages.org.uk Cross Site Scripting vulnerability OBB-1360553
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Unauthorized Access Vulnerability in Jetwing's Intelligent Terminal Operation Platform
JetWise Intelligent Terminal Operation Platform is a full-featured intelligent recognition tool for license plate images. Unauthorized access vulnerability exists in JWT Intelligent Terminal Operation Platform, which can be exploited by attackers to obtain sensitive information...
Heap Overflow Vulnerability in Light and Shadow Magic Hand of Shenzhen Xunlei.com Culture Limited (CNVD-2020-58817)
LightShadow Magic Hand is a software for improving and enhancing image quality and effect processing. Shenzhen Xunlei.com Culture Co., Ltd LightShadow Magic Hand has a heap overflow vulnerability that allows an attacker to construct a special picture to cause the software to crash, which can also...
Arbitrary Code Execution
graphicsmagick is vulnerable to arbitrary code execution. The vulnerability exists through a NULL pointer dereference in the WritePCLImage function in coders/pcl.c during writes of monochrome images...
USN-4513-1: apng2gif vulnerability
Dileep Kumar Jallepalli discovered that apng2gif incorrectly handled loading APNG files. An attacker could exploit this with a crafted APNG file to access sensitive information. CVE-2017-6960...
Mozilla Rust rand_core number handling error vulnerability
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A number handling error vulnerability exists in Mozilla Rust versions prior to 0.4.2 in randcore, which arises from an error in the handling of bytes converted to integers, and can be exploited to execute...
About the security content of watchOS 7.0
About the security content of watchOS 7.0 This document describes the security content of watchOS 7.0. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
USN-4497-1 OpenJPEG vulnerabilities
It was discovered that OpenJPEG incorrectly handled certain image files. A remote attacker could possibly use this issue to cause a denial of service. CVE-2016-9112 It was discovered that OpenJPEG did not properly handle certain input. If OpenJPEG were supplied with specially crafted input, it...
OPENSUSE-SU-2020:1433-1 Security update for docker-distribution
This update for docker-distribution fixes the following issues: - Enable build on %arm which include armv6, not only on armv7 - Enable ppc64le - Use correct URL to project - Remove fillup, we don't ship a sysconfig file - Correct systemd requires - Enable build on ARM - Upgraded to 2.7.1 - Suppor...
GitLab: Able to view hackerone reports attachments
Summary Hi team, I accidentally found this bug. While reading one of hackerone public report https://hackerone.com/reports/446238 about gitlab, I found a link posted by gitlab member which is related to internal tracking of the report. I clicked that link...
Android Security Bulletin—September 2020Stay organized with collectionsSave and categorize content based on your preferences.
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-09-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...
CVE-2020-14382
A flaw was found in the way cryptsetup parses encrypted images with invalid segments. This flaw allows a local attacker to crash an application compiled with cryptsetup, or in some cases, cause arbitrary code execution when parsing specially crafted encrypted images. The highest threat from this...