[SECURITY] Fedora 27 Update: recode-3.6-46.fc27

The recode' converts files between character sets and usages. It recognizes or produces nearly 150 different character sets and is able to transliterate files between almost any pair. When exact transliteration are not possible, it may get rid of the offending characters or fall back on...

Out of character: Homograph attacks explained

In April, Xudong Zheng, a security enthusiast based in New York, found a flaw in some modern browsers in the way they handle domain names. While Chrome, Firefox, and Opera already have security measures in place to cue users that they might be visiting a destination they thought was legitimate, a...

CVE-2017-14979

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...

Code injection

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...

CVE-2017-14979

Gxlcms (enterprise website creation system) is affected by CVE-2017-14979. The vulnerability arises from an unsafe character-replacement method intended to restrict access, enabling remote attackers to read arbitrary files by altering the s parameter in index.php. Affected components include Lib/...

CVE-2017-14979

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...

[SECURITY] Fedora 25 Update: oniguruma-6.1.3-3.fc25

Oniguruma is a regular expressions library. The characteristics of this library is that different character encoding for every regular expression object can be specified. supported APIs: GNU regex, POSIX and Oniguruma native...

SQL Injection

opencart is vulnerable to SQL injection attacks. It is possible because it uses improper character set in mysql.php at the server level, allowing the attackers to perform multi-byte attack...

CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

Bento4 Core/Ap4HdlrAtom.cpp File Heap Buffer Overflow Vulnerability Vulnerability

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in the AP4HdlrAtom class of the Core/Ap4HdlrAtom.cpp file in Bento4, which stems from the program using an incorrect character data type. An attacker could exploit this vulnerability to cause a...

CVE-2017-14639

AP4VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617 uses incorrect character data types, which causes a stack-based buffer underflow and out-of-bounds write, leading to denial of service application crash or possibly unspecified other impact...

Legal Robot: Missing homograph filter character

A security researcher pointed out that while fixing report 260938, we missed one homograph of a latin l character...

CVE-2017-14176

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117...

WordPress Cool Flickr Slideshow 1.0 Cross Site Scripting Vulnerability

WordPress Cool Flickr Slideshow plugin version 1.0 suffers from a cross site scripting vulnerability. | Exploit Title: Wordpress cool-flickr-slideshow Plugin Cross Site Scriptingxss | Exploit Author: Ashiyane Digital security Team | Vendor...

Khan Academy: Possible to join any class without coache's knowledge & Little Information Disclosure

Students could join a class using only a 6-character class code. We have increased the codes to 8 characters to make them a bit harder to guess and provide a better balance between security and usability. /...

CVE-2017-12868

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation...

CVE-2017-12868

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation...

CVE-2017-12868

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation...

CVE-2017-12868

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation...

CVE-2017-12868

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation...