June 21, 2018—KB4284863 (Preview of Monthly Rollup)

None None...

Adobe CreativeCloud Input Validation and Encoding Vulnerability

Adobe Creative Cloud is a digital hub that provides access to every Adobe Creative Suite 6 desktop application, online services, and other newly released applications. Adobe CreativeCloud suffers from an input validation and encoding vulnerability that allows remote attackers to inject their own...

Cross-site Scripting (XSS)

oauth2orize-fprm is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of encoding of values in parameters, allowing arbitrary html code to be executed when rendered...

Adobe CreativeCloud - (Events ) Persistent Vulnerability

Document Title: =============== Adobe CreativeCloud - Events Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1840 Release Date: ============= 2018-06-17 Vulnerability Laboratory ID VL-ID: ==================================== 1840...

UBUNTU-CVE-2018-12458

An improper integer type in the mpeg4encodegopheader function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service...

Security update for bouncycastle (moderate)

This update for bouncycastle to version 1.59 fixes the following issues: These security issues were fixed: - CVE-2017-13098: BouncyCastle, when configured to use the JCE Java Cryptography Extension for cryptographic functions, provided a weak Bleichenbacher oracle when any TLS cipher suite using...

CVE-2017-7814

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise ...

CVE-2016-1000342

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of...

OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387)

It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER...

OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449)

It was discovered that the LDAP component of OpenJDK failed to properly encode special characters in user names when adding them to an LDAP search query. A remote attacker could possibly use this flaw to manipulate LDAP queries performed by the LdapLoginModule class...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security...

CVE-2018-3718

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

CVE-2018-3718

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

Code injection

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

CVE-2018-3718

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...

CVE-2018-3718

CVE-2018-3718 affects the serve node module and is caused by improper handling of URL encoding, which can permit access to ignored/restricted files when a filename is URL encoded. Connected advisories/documentation (GHSA-5RC4-8QQH-VQ7F; OSV, NVD/CVE record) describe this as a directory traversal-...

CVE-2017-16224

st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 redirect to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a...

PT-2018-16142 · Node.Js · Serve

Name of the Vulnerable Software and Affected Versions: serve node module affected versions not specified Description: The issue is related to improper handling of URL encoding, allowing access to ignored files if a filename is URL encoded. This can potentially lead to unauthorized access to...

Bouncy Castle JCE Provider Design Vulnerability

Bouncy Castle JCE Provider is a Java-based encryption package. A security vulnerability exists in Bouncy Castle JCE Provider version 1.55 and earlier, which stems from ECDSA's failure to adequately validate signature encoding using ASN.1. An attacker can exploit the vulnerability to introduce...

Thinwire+ Support for H.264 Build-To-Lossless for transient content.

Introduction One of the features of Thinwire+ is “build to lossless” for transient content. This means that content such as3D or other moving imageryis initially displayed at low quality to improve frame rates and overall interactivity. Once user input has stopped, transient images are gradually...