GHSA-93JQ-624G-4P9P Improper Input Validation in async-http-client

Async Http Client aka async-http-client before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL CVE-2016-8624 and Oracle Java 8 java.net.URL...

UBUNTU-CVE-2018-18385

Asciidoctor in versions 1.5.8 allows remote attackers to cause a denial of service infinite loop. The loop was caused by the fact that Parser.nextblock was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detect...

chromium-browser: Function signature mismatch in WebAssembly

An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Path is DEAD between Branch SDWAN devices

Virtual Path is showing DEAD between the Branch SDWAN devices after adding a device as Secondary MCN and pushed the configuration. You will see the following highlighted message getting incremented in SDWANDiagnostic logs : Command: dropcounts Index Count File Name Function Name Line Reason text...

CVE-2018-6051

XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page...

UBUNTU-CVE-2018-6051

XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page...

jhead Denial of Service Vulnerability

jhead is a tool for modifying JPEG file information. A denial of service vulnerability exists in the 'ProcessGpsInfo' function of the gpsinfo.c file in jhead version 3.00, which originates from a difference between a single-precision floating-point type and a double-precision floating-point type ...

DEBIAN-CVE-2018-17098

The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service heap corruption from size inconsistency or possibly have unspecified other impact, as demonstrated by SoundStretch...

UBUNTU-CVE-2018-17098

The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service heap corruption from size inconsistency or possibly have unspecified other impact, as demonstrated by SoundStretch...

DEBIAN-CVE-2018-16554

The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAGGPSALT handling...

UBUNTU-CVE-2018-16554

The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAGGPSALT handling...

Security update for chromium (moderate)

This update for Chromium to version 69.0.3497.92 fixes the following issues: Security issues fixed boo1108114: - Function signature mismatch in WebAssembly - URL Spoofing in Omnibox The following tracked packaging issues were fixed: - the chromium package incorrectly provied swiftshader resolvabl...

async-http-client: Invalid URL parsing with '?'

Async Http Client aka async-http-client before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL CVE-2016-8624 and Oracle Java 8 java.net.URL...

Event: 1020 Connection Validation failed on Domain "for user" for reason 'Deny'

SSL Certificate handshake is not successful for ICA sessions since the VDA's are not enabled with SSL communication. Mismatch of License edition configured under Studio Licensing...

Event: 1050 Connection validation failed on domain for user for reason 'Deny'

SSL Certificate handshake is not successful for ICA sessions since the VDA's are not enabled for SSL communications. Mismatch of License edition configured on Studio...

vertx-web: Incomplete CSRF validation by CSRFHandler

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet...

PT-2018-7154 · Red Hat · Openshift +2

Name of the Vulnerable Software and Affected Versions: CloudForms affected versions not specified Description: The issue arises from CloudForms not verifying that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization RH...

Unspecified Vulnerability in Eclipse Vert.x

Eclipse Vert.x is an Eclipse Foundation toolkit for building responsive applications on the JVM , which is mainly used to build applications such as network utilities , Web applications , HTTP/REST microservices and so on. A security vulnerability exists in Eclipse Vert.x versions 3.0.0 through...

procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues

A flaw was found where procps-ng provides wrappers for standard C allocators that took unsigned int instead of sizet parameters. On platforms where these differ such as x8664, this could cause integer truncation, leading to undersized regions being returned to callers that could then be overflowe...

CVE-2018-14563

An issue was discovered in libthulac.so in THULAC through 2018-02-25. "operator delete" is used with "operator new" in the TaggingLearner class in include/cbtagginglearner.h, possibly leading to memory corruption...