PT-2019-18183 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 11.5.1 through 11.5.8 BIG-IP versions 11.6.1 through 11.6.3.2 BIG-IP versions 12.1.0 through 12.1.3.7 BIG-IP version 13.0.0 Description: The Application Acceleration Manager AAM wamd process in BIG-IP fails to drop group...

USN-3906-1 tiff vulnerabilities

It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges...

Azure SSH Keypairs Security Feature Bypass Vulnerability

A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init. Extraneous Microsoft service public keys can be unexpectedly added to the VM authorized keys file in the limited scenarios described in 4491476. For more...

Extraneous SSH Public Keys added to Authorized Keys file on Linux VM

None None...

Memory Corruption Vulnerability in Photo Lab's Processing of BMP Images

Photo Lab is a foreign photo viewing tool. Photo Lab suffers from a memory corruption vulnerability in the handling of BMP images, which can be exploited by an attacker to cause a program crash and execute arbitrary code by constructing a malformed BMP image...

The vulnerability of the `gdImageBmpPtr` function in the GD Graphics Library allows a hacker to execute arbitrary code.

The vulnerability of the gdImageBmpPtr function in the GD Graphics Library involves the repeated release of memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code using specially created JPEG-formatted images...

50m-ctf: `Cody trolled us all` h1-702 CTF write-up

Premise I use not to play CTF challenges because they usually absorb me entirely. I cannot think of anything else but "I want that flag!". That said, this is going to be a long story: no princess, no dragoons, only a tweet. https://twitter.com/Hacker0x01/status/1100543680383832065 Level 0 - Nothi...

Zomato: Open AWS S3 bucket leaks all Images uploaded to Zomato chat

Hey, Summary: The vulnerable bucket is ████images and we can use aws s3 ls s3://$bucketname/2019/1/ to retreive all images uploaded in 2019 and in January. Similarly we can use different years and months to retreive all images uploaded to Zomato Chat! The images can be accessed at...

Google Discloses Unpatched 'High-Severity' Flaw in Apple macOS Kernel

Cybersecurity researcher at Google's Project Zero division has publicly disclosed details and proof-of-concept exploit of a high-severity security vulnerability in macOS operating system after Apple failed to release a patch within 90 days of being notified. Discovered by Project Zero researcher...

Nextcloud: Uploading large avatar images cause excessive CPU usage

How to reproduce: - Create an account on any server running Nextcloud 13 or 14. - Open the personal settings. - Upload a large image as avatar tested with a 4032x3024 PNG image of about 14.5 MB. - Keep the selected area in the popup and save the avatar. - Notice that the avatar area shows the...

Design/Logic Flaw

Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI...

CVE-2019-9552

CVE-2019-9552 affects Eloan V3.0 (through 2018-09-20). The vulnerability allows remote attackers to list files by directly requesting the p2p/api/, p2p/lib/, or p2p/images/ URIs. The documents do not provide a root-cause analysis, affected software versions beyond the stated release window, or re...

Android Security Bulletin — March 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-03-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Memory Corruption Vulnerability in CloudPulse Card Recognition Software

Xiamen Cloud Pulse Technology Co., Ltd. was founded in June 2002, Cloud Pulse Technology is in the leading position in cell phone photo text recognition, document recognition, bank card recognition, business card recognition, cell phone information network/PC synchronization and management...

Memory Corruption Vulnerability in CloudPulse Driving License Recognition Software

Xiamen Cloud Pulse Technology Co., Ltd. was founded in June 2002, Cloud Pulse Technology is in the leading position in cell phone photo text recognition, document recognition, bank card recognition, business card recognition, cell phone information network/PC synchronization and management...

The vulnerability of the JBIGDecode function in the library for viewing, editing, and converting TIFF files into LibTIFF files, related to writing beyond the buffer memory, allows attackers to cause service failures or execute arbitrary code.

The vulnerability of the JBIGDecode function “tifjbig.c” in the library for viewing, editing, and converting TIFF files related to LibTIFF is associated with errors that allow the execution of write operations beyond the buffer memory. Exploiting this vulnerability can enable an attacker to cause...

CVE-2018-18498

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird 60.4, Firefox ESR 60.4, and Firefox 64...

Robert Bosch Smart Camera App for Android Privilege Permission and Access Control Vulnerability

Robert Bosch Smart Camera App for Android is an Android-based smart camera management application from Robert Bosch, Germany. A privilege-granting and access control vulnerability exists in versions of the Bosch Smart Camera App for Android prior to 1.3.1, which stems from a failure to set securi...

OSFClone - Open Source Utility To Create And Clone Forensic Disk Images

OSFClone is a free, self-booting solution which enables you to create or clone exact raw disk images quickly and independent of the installed operating system. In addition to raw disk images, OSFClone also supports imaging drives to the open Advance Forensics Format AFF , AFF is an open and...

Design/Logic Flaw

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. The Bosch Smart Home App is not affected. iOS Apps ar...