CVE-2018-18966

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but Internet Explorer render HTML elements in a .eml file...

Android Security Bulletin—November 2018Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2018-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

LibRaw: Out-of-bounds read in kodak_radc_load_raw function internal/dcraw_common.cpp

An out-of-bounds read flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images...

LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp

A NULL pointer dereference flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images...

Dual NIC Support for Images Published to PVS

Images published to PVS particularly on Hyper-V that use 2 NICs will blue-screen on boot. This article describes how to correctly create images to support dual NICs with PVS...

Oracle WebLogic Server Multiple Vulnerabilities (October 2018 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - Vulnerabilities in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Easily exploitable vulnerabilities allow unauthenticated attacker wi...

CVE-2018-3213

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Docker Images. The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2018-3213

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Docker Images. The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Docker Images. The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2018-3213

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Docker Images. The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2018-3213

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Docker Images. The supported version that is affected is prior to Docker 12.2.1.3.20180913. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise...

CVE-2018-3213

Oracle WebLogic Server vulnerability CVE-2018-3213 affects the Docker Images subcomponent of Oracle Fusion Middleware. The issue is exploitable via network access using T3 and can lead to unauthorized access to data or complete access to Oracle WebLogic Server data. Affected versions are those pr...

Unspecified Vulnerability in Oracle WebLogic Server (CNVD-2018-24318)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. WebLogic Server is one of the application server components for cloud and traditional...

Privacy for Tigers

Ross Anderson has some new work: As mobile phone masts went up across the world's jungles, savannas and mountains, so did poaching. Wildlife crime syndicates can not only coordinate better but can mine growing public data sets, often of geotagged images. Privacy matters for tigers, for snow...

Apple iOS VoiceOver Information Disclosure Vulnerability

Apple iOS is an operating system developed by Apple Inc. for mobile devices, of which VoiceOver is a voice-assisted component. An information disclosure vulnerability exists in the VoiceOver component in Apple iOS versions prior to 12.0.1. A local attacker can exploit the vulnerability to view...

gettyimages.com XSS vulnerability

Open Bug Bounty ID: OBB-684784 Description| Value ---|--- Affected Website:| gettyimages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Foxit Reader ConvertToPDF BMP File Parsing Out-of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

DEBIAN-CVE-2018-18023

In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file...

[SECURITY] Fedora 27 Update: gmic-2.3.6-1.fc27

G'MIC is an open and full-featured framework for image processing, providing several different user interfaces to convert/manipulate/filter/visualize generic image datasets, from 1d scalar signals to 3d+t sequences of multi-spectral volumetric images...

CVE-2018-15370

A vulnerability in Cisco IOS ROM Monitor ROMMON Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to the presence of a...