CVE-2021-21377 Open Redirect in OMERO.web

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL...

CVE-2021-21377

Summary: CVE-2021-21377 affects OMERO.web up to version 5.9.0, where redirects after login or group context switch could be sent to untrusted external URLs due to missing URL validation. The vulnerability is mitigated in 5.9.0 by added URL validation; external URLs are rejected unless explicitly ...

CVE-2021-21376

CVE-2021-21376 affects OMERO.web (Django-based web interface for OMERO). The vulnerability arises because before version 5.9.0, the main webclient pages load and expose various information about the current user (e.g., user id, name, and group memberships). Some additional loaded information is n...

[SECURITY] Fedora 33 Update: python2-pillow-6.2.2-5.fc33

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. This is a minimal compatibility package for https://pagure.io/fesco/issue/2 266...

Pillow Denial of Service Vulnerability (CNVD-2021-14763)

Python Imaging Library PIL is a free library for the Python programming language that supports opening, manipulating, and saving a wide range of image file formats.Pillow is a PIL branch. A denial of service vulnerability exists in Pillow versions prior to 8.1.1. The vulnerability stems from not...

Pillow Denial of Service Vulnerability (CNVD-2021-14762)

Python Imaging Library PIL is a free library for the Python programming language that supports opening, manipulating, and saving a wide range of image file formats.Pillow is a PIL branch. A denial of service vulnerability exists in Pillow versions prior to 8.1.1. The vulnerability stems from not...

Vulnerability Spotlight: Memory corruption vulnerability in Accusoft ImageGear

Emmanuel Tacheau discovered this vulnerability. Blog by Jon Munshaw. Accusoft ImageGear contains a vulnerability that could allow an attacker to corrupt the software's memory, potentially allowing them to execute arbitrary code on the victim machine. The ImageGear library is a document-imaging...

Vulnerability Spotlight: Accusoft ImageGear vulnerabilities could lead to code execution

Marcin Towalski, Emmanuel Tacheau and another Cisco Talos team member discovered these vulnerabilities. Blog by Jon Munshaw. Accusoft ImageGear contains two remote code execution vulnerabilities. ImageGear is a document and imaging library from Accusoft that developers can use to build their...

Accusoft ImageGear PSD Header processing out-of-bounds write vulnerability

Summary An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions Accusoft ImageGear 19.8...

EVOLUCARE ECS Imaging SQL Injection (CVE-2021-3118)

An SQL injection vulnerability exists in EVOLUCARE ECS Imaging. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2021-3118

EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form such as /reqpassworduser.php?email=. This allows an attacker to steal data in the database and obtain access to the application. The database component runs as...

PT-2021-19199 · Evolucare · Evolucare Ecsimaging

Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions 6.21.5 and earlier Description: The issue affects the login form and the password-forgotten form, such as /req password user.php?email=, allowing an attacker to steal data in the database and obta...

Pillow: Multiple vulnerabilities

Background Python Imaging Library fork Description Multiple vulnerabilities have been discovered in Pillow. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this time...

PT-2021-18698 · Evolucare · Evolucare Ecsimaging

Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions 6.21.5 and earlier Description: The issue is related to an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The file parameter on the webpage "/showfile.php" ca...

Evolucare Ecsimaging 操作系统命令注入漏洞

Evolucare Ecsimaging, a mobile application for viewing medical radiology images from the French company Evolucare, has a security vulnerability in Evolucare Ecsimaging version 6.21.5, which allows an attacker to exploit the parameter "file" in the web page showfile.php to gain root access. " in...

A week in security (December 14 – December 20)

Last week on Malwarebytes Labs we kept you updated on the SolarWinds attack, we warned about the special dangers that come with the Christmas season, published a threat profile for the Egregor ransomware, warned how a lead generation scam was targeting potential Malwarebytes MSP partners, and...

CVE-2020-25179

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network...

CVE-2020-25175

CVE-2020-25175 affects GE Healthcare Imaging and Ultrasound Products. The flaw is unprotected transport of credentials (CWE-523), enabling credentials to be exposed over the network. Connected documentation confirms affected GE product lines across modalities (MR, Ultrasound, X-Ray, etc.) and lis...

CVE-2020-25179

CVE-2020-25179 affects GE Healthcare Imaging and Ultrasound Products. The issue involves unprotected transport of credentials and exposure of sensitive system information to an unauthorized control sphere, enabling credential exposure during network transport. Impact described in ICS advisory inc...

General Electric Healthcare Imaging and General Electric Healthcare Ultrasound Security Vulnerabilities

General Electric Healthcare Imaging and General Electric Healthcare Ultrasound are both products of General Electric, Inc.General Electric Healthcare Imaging is a medical imaging device. General Electric Healthcare Ultrasound is a medical sonography device. GE Imaging and Ultrasound Products have...