GHSA-55XH-53M6-936R Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

Impact This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth...

PT-2021-24471

Name of the Vulnerable Software and Affected Versions: Encryption SDK versions prior to 1.9 Encryption SDK versions prior to 2.2 Description: This issue affects the Encryption SDK, which supports a streaming mode for signed messages. The SDK uses AES-GCM encryption and verifies plaintext before...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated...

PT-2021-24426

Name of the Vulnerable Software and Affected Versions: Encryption SDK versions prior to 1.9 Encryption SDK versions prior to 2.2 Description: This issue concerns the Encryption SDK's handling of streaming signed messages and restricting processing of certain types of invalid messages. The SDK...

PT-2021-24401

Name of the Vulnerable Software and Affected Versions: Encryption SDK versions prior to 1.9 Encryption SDK versions prior to 2.2 Description: This issue concerns the Encryption SDK's handling of streaming signed messages and restricting processing of certain types of invalid messages. The SDK...

Improper Verification of Cryptographic Signature in aws-encryption-sdk-java

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages...

PT-2021-24353

Name of the Vulnerable Software and Affected Versions: AWS Encryption SDK for Java versions 2.0.0 through 2.2.0 AWS Encryption SDK for Java versions less than 1.9.0 Description: The issue concerns the incorrect validation of some invalid ECDSA signatures. This affects the integrity of the...

Logic Flaw Vulnerability in Streaming Media Management Server at Hangzhou Hikvision Digital Technology Co.

Hikvision is a provider of video-centric intelligent IoT solutions and big data services. A logic flaw vulnerability exists in the streaming media management server of Hangzhou Hikvision Digital Technology Co. that can be exploited by attackers to obtain sensitive information...

The Bizarro Streaming Site That Hackers Built From Scratch

BravoMovies isn’t real. But it goes to a remarkable amount of trouble to convince you that it is...

FFmpeg heap buffer overflow vulnerability (CNVD-2021-39760)

FFmpeg is a complete solution for recording, converting and streaming audio and video. A heap buffer overflow vulnerability exists in filter16complexlow in libavfilter/vfw3fdif.c in FFmpeg version 4.2. An attacker could exploit this vulnerability to cause memory corruption...

FFmpeg heap buffer overflow vulnerability (CNVD-2021-39762)

FFmpeg is a complete solution for recording, converting and streaming audio and video. A heap buffer overflow vulnerability exists in fffillrectangle in libavfilter/drawutils.c in FFmpeg version 4.2. An attacker could exploit this vulnerability to cause memory corruption...

http4s path traversal vulnerability

Http4s is an open source for Scala streaming HTTP server . Http4s has a path traversal vulnerability that can be exploited by an attacker to obtain sensitive information...

Oracle Linux 8 : brotli (ELSA-2021-1702)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1702 advisory. 1.0.6-3 - Resolves: CVE-2020-8927 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has n...

[SECURITY] Fedora 34 Update: python-starlette-0.14.2-6.fc34

Starlette is a lightweight ASGI framework/toolkit, which is ideal for build ing high performance asyncio services. It is production-ready, and gives you the following: Seriously impressive performance. WebSocket support. GraphQL support. In-process background tasks. Startup and shutdown events...

XITE Music Video Platform Amplifies Entertainment with Akamai's Help

By: Ralph Aantjes With so many people around the globe seeking socially distanced fun and solace, at-home entertainment has never been more important. XITE aims to offer the best music video experience in the world. Akamai is delighted that this exciting, interactive video platform chose to work...

How ViacomCBS Digital delivers uninterrupted content streaming to millions of fans without compromising security: Lessons for enterprise CISOs

Each day, ViacomCBS Digital sees a growing surge in digital content demand—from MTV and Comedy Central to CBS Sports, rushing across its Paramount+ formerly CBS All Access streaming platform. Delivering digital content to millions of users on a daily basis doesn’t happen on its own—it makes it to...

TeaBot Trojan Targets Banks via Hijacked Android Handsets

Researchers have discovered an Android trojan that can steal victims’ SMS messages and credentials and completely take over devices. The trojan, dubbed TeaBot, is aimed at committing fraud against at least 60 banks in Europe. Join Threatpost for “Fortifying Your Business Against Ransomware, DDoS ...

LIVE555 Streaming Media has an unspecified vulnerability

LIVE555 Streaming Media is an application from LIVE555 USA, Inc. a standards-based RTP/RTCP/RTSP/SIP multimedia streaming source code library for embedded and/or low-cost streaming applications.A security vulnerability exists in versions prior to LIVE555 Streaming Media 2021.3.16, which stems fro...

Live555 Streaming Media < 2021.03.16 RTSP Vulnerability - Windows

Live555 Streaming Media is prone to a vulnerability in subclasses of OnDemandServerMediaSubsession. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Shenzhen Skyworth RN510 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Overview ======== Title:- Authenticated XSRF in RN510 Mesh Extender. CVE-ID :- CVE-2021-25327 Author: Kaustubh G. Padwad Vendor: Shenzhen Skyworth Digital Technology Company Ltd.http://www.skyworthdigital.com/products Products: 1. RN510 with firmware V.3.1.0.4 Tested and verified Potential 2.RN62...