Experts Find a Way to Learn What You're Typing During Video Calls

A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the...

tomcat: Apache Tomcat HTTP/2 Request mix-up

A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - fro...

Heap overflow

A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file can trigger a heap overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this...

CVE-2020-13572

CVE-2020-13572 describes a heap overflow in the GIF LZW decoder used by Accusoft ImageGear 19.8. The vulnerability occurs while decoding LZW streams in the GIF parser, where a destination index can overflow the allocated heap buffer, potentially allowing arbitrary code execution when processing s...

PT-2021-9644

Name of the Vulnerable Software and Affected Versions Accusoft ImageGear version 19.8 Description A heap overflow issue exists in the GIF parser when decoding LZW compressed streams. This can be triggered by a specially crafted malformed file, potentially leading to arbitrary code execution. An...

CVE-2020-13572: Heap-based Buffer Overflow

A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file can trigger a heap overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this...

The vulnerability in the interface for supporting streaming audio and video data through the Media Capture and Streams API of the Mozilla Firefox browser allows attackers to perform cross-site scripting attacks.

The vulnerability of the Media Capture and Streams API for handling streaming audio and video data in the Mozilla Firefox browser is related to a request error from documents with URL addresses “data:” or “blob:”. Exploiting this vulnerability could allow an attacker to perform cross-site scripti...

CentOS 8 : git (CESA-2019:4356)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4356 advisory. - git: Arbitrary path overwriting via export-marks in-stream command feature CVE-2019-1348 - git: Recursive submodule cloning allows using git director...

Security Bulletin: IBM Event Streams affected by multiple Java SE security vulnerabilities

Summary IBM Event Streams is affected by multiple Java SE vulnerabilities. All Java components have been updated to deploy on the latest IBM SDK Vulnerability Details CVEID: CVE-2020-14792 DESCRIPTION: An unspecified vulnerability in Java SE related to the Hotspot component could allow an...

Security Bulletin: IBM Event Streams is affected by multiple Go vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the Golang Go runtime that is used in some of containers in the Event Streams deployment and for the Event Streams CLI Vulnerability Details CVEID: CVE-2020-28362 DESCRIPTION: Golang Go is vulnerable to a denial of service,...

Security Bulletin: A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas (CVE-2020-4662)

Summary A vulnerability exists in the Event Streams 10.0.0 schema registry that allows unauthorised access to create, edit and delete schemas Vulnerability Details CVEID: CVE-2020-4662 DESCRIPTION: IBM Event Streams could allow an authenticated user to perform tasks to a schema due to improper...

Security Bulletin: IBM Event Streams is affected by GNU gettext vulnerability CVE-2018-18751

Summary IBM Event Streams has addressed the following vulnerability Vulnerability Details CVEID: CVE-2018-18751 DESCRIPTION: GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the defaultaddmessage function in read-catalog.c. By persuading a victim to open a...

Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime that is used for the UI and Schema Registry Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS reco...

SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2021:0062-1)

This update for nodejs12 fixes the following issues : New upstream LTS version 12.20.1 : - CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object ...

CVE-2020-35468

The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35468

The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35468

The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password...

CVE-2020-35468

The CVE-2020-35468 entry concerns the Appbase streams Docker image 2.1.2, where a blank root password creates a remote root-access risk. The Red Hat record mirrors this description. The available documents do not provide exploitation details, affected versions beyond 2.1.2, or remediation steps. ...

PT-2020-17334

Name of the Vulnerable Software and Affected Versions Appbase streams Docker image version 2.1.2 Description The issue concerns a blank password for the root user in the Appbase streams Docker image. This could allow a remote attacker to gain root access with a blank password, potentially...

Docker Image Appbase Streams Access Control Error Vulnerability

Docker is an open source application container engine from the American company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment, and upgrading of applications...