May 26, 2017—KB4023680 (OS Build 14393.1230)

None None...

Weblate: Improper validation of unicode characters

There are validation issues server side causing a server error when saving the account. Please specify what characters are permited...

Important: Red Hat Security Advisory: ansible and openshift-ansible security and bug fix update

An update for ansible and openshift-ansible is now available for Red Hat OpenShift Container Platform 3.2, Red Hat OpenShift Container Platform 3.3, Red Hat OpenShift Container Platform 3.4, and Red Hat OpenShift Container Platform 3.5. Red Hat Product Security has rated this update as having a...

Nextcloud: RTLO character allowed in shared files

SUMMARY ------------- Hello, I have notices that you do not properly strip the RTLO right to left override character in the sharing page of the file, thus allowing someone to mask the real extension of a file and if the user downloads, then opens the file something may be executed on his machine...

Joomla! Information Disclosure and XSS Vulnerabilities

Joomla is prone to information disclosure and cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-0247

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and...

PostgreSQL vulnerabilities

The PostgreSQL project reports: Security Fixes nested CASE expressions + database and role names with embedded special characters CVE-2017-7484: selectivity estimators bypass SELECT privilege checks. CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable CVE-2017-7486: pgusermappings view...

Cross-site Scripting (XSS)

haml is vulnerable to cross-site scripting XSS attacks. The library does not escape characters like \ " ' properly, meaning that a malicious user can prepend these characters to inject and execute arbitrary code...

Weblate: Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register

Hi there Vulnerability Title: Meta characters are not filtered into full name on registration page Description You haven't filtered control meta characters such as %00 etc in full name field on registration page which allows an attacker to impersonate or hide their real identity within the...

Denial Of Service (DoS)

github.com/minio/minio is vulnerable to denial of service DoS attacks. A malicious user can pass special a file to with special characters in its name to cause an infinite loop in the system. This can lead to the system running out of resources and crashing...

EulerOS 2.0 SP1 : mercurial (EulerOS-SA-2016-1019)

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository...

IrfanView 4.44 Denial Of Service

Exploit Title: Irfanview - OtherExtensions Input Overflow Date: 29-04-2017 Software Link: http://download.cnet.com/IrfanView/?part=dl-&subj=dl&tag=button Exploit Author: Dreivan Orprecio Version: Irfanview 4.44 Irfanview is vulnerable to overflow in "OtherExtensions" input field Debugging Machine...

httpd: Apache HTTP Request Parsing Whitespace Defects

It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a...

CVE-2017-7985

In Joomla! 1.5.0 through 3.6.5 fixed in 3.7.0, inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...

Cross site scripting

In Joomla! 1.5.0 through 3.6.5 fixed in 3.7.0, inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...

Faking Domain Names with Unicode Characters

It's things like this that make phishing attacks easier. News article...

Weblate: You can simply just use passwords that simply are as 123456

This may not be a issue but is a flaw for many websites because passwords should contain letters and characters like - and much more. Uppercase, lowcase. as it makes it much more secure it will be acceptable. this might scare your customers away feeling unsecure...

This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera

A Chinese infosec researcher has reported about an "almost impossible to detect" phishing attack that can be used to trick even the most careful users on the Internet. He warned, hackers can use a known vulnerability in the Chrome, Firefox and Opera web browsers to display their fake domain names...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...