Industrial Light and Magic OpenEXR Code Issue Vulnerability

Industrial Light and Magic LIM OpenEXR is an image file format from Industrial Light and Magic LIM, USA, for high dynamic range HDR images. A code problem exists in the 'TiledInputFile::TiledInputFile' function of the IlmImf/ImfTiledInputFile.cpp file in versions of Industrial Light and Magic...

Security Bulletin: Multiple vulnerabilities in middleware software affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to Java, WebSphere Liberty and docker images used by IBM Cloud Pak for Automation ICP4A. More precisely these are in IBM® SDK Java™ Technology Edition, Version 8 disclosed as part of the IBM Java SDK updates in October 2019 and January 2020, and in WebSpher...

Security Bulletin: IBM API Connect V 2018 (ova) is impacted by weak cryptographic algorithms (CVE-2020-4452)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4452 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5.9 CVSS Temporal...

CVE-2020-10274

The access tokens for the REST API are directly derived sha256 and base64 encoding from the publicly available default credentials from the Control Dashboard refer to CVE-2020-10270 for related flaws. This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks...

containers/image: Container images read entire image manifest into memory

A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashi...

Low: Red Hat Security Advisory: skopeo security and bug fix update

An update for skopeo is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS

A heap-buffer out-of-bounds read flaw was found in libexif's MakerNote tag parser. This flaw allows an unauthenticated attacker or authenticated attacker with low privileges to exploit the flaw remotely in an application that uses libexif to process EXIF data from media files if the file upload i...

Reduce the Attack Surface of Your Container Images

Follow along as Chuck Losh, Solutions Architect, walks through a new way of thinking in how to construct distroless images from Google, using an example of a multi-stage Dockerfile method...

Fedora: Security Advisory for libjpeg-turbo (FEDORA-2020-f09ecf5985)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-14461

Zyxel Armor X1 WAP6806 1.00ABAL.6C0 devices allow Directory Traversal via the images/eaZy/ URI...

CVE-2020-14461

Zyxel Armor X1 WAP6806 1.00ABAL.6C0 devices allow Directory Traversal via the images/eaZy/ URI...

PT-2020-14021 · Zyxel · Zyxel Armor X1 Wap6806

Name of the Vulnerable Software and Affected Versions: Zyxel Armor X1 WAP6806 version 1.00ABAL.6C0 Description: The issue allows Directory Traversal via the images/eaZy/ URI. Recommendations: For Zyxel Armor X1 WAP6806 version 1.00ABAL.6C0, restrict access to the images/eaZy/ URI to minimize the...

[SECURITY] Fedora 32 Update: libjpeg-turbo-2.0.4-3.fc32

The libjpeg-turbo package contains a library of functions for manipulating JPEG images...

The vulnerability of the Buildah command-line tool arises from an incorrect path limitation for the restricted access directory. This allows a malicious actor to create a malicious container image and replace arbitrary files on the user’s system.

The vulnerability of the Buildah command-line tool exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to create a malicious container image and replace arbitrary files on the user’s system...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for vulnerability research and testing. The target product/service or framework is not explicitly stated, but it appears to be a collection of vulnerable environments for various...

gettyimages.ru Cross Site Scripting vulnerability OBB-1196008

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

gettyimages.co.cz Cross Site Scripting vulnerability OBB-1195967

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS

A heap-buffer out-of-bounds read flaw was found in libexif's MakerNote tag parser. This flaw allows an unauthenticated attacker or authenticated attacker with low privileges to exploit the flaw remotely in an application that uses libexif to process EXIF data from media files if the file upload i...

Microsoft Word 2013 Service Pack 1 Security Feature Bypass Vulnerability (KB4484361)

This host is missing an important security update according to Microsoft KB4484361 Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Word 2016 Security Feature Bypass Vulnerability (KB4484396)

This host is missing an important security update according to Microsoft KB4484396 Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...