DEBIAN-CVE-2017-9130

The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder FAAC 1.28 allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted wav file...

Apache NiFi Cross-Frame Scripting Vulnerability

Apache NiFi is a data-flow based data processing and distribution system of the Apache Apache Software Foundation, USA. The system supports the configuration and transformation of data routing indicator maps and system intermediary logic. A security vulnerability exists in Apache NiFi versions...

CVE-2017-7667

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin...

DEBIAN-CVE-2017-9123

The lqtframeduration function in lqtquicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted mp4 file...

PT-2017-2984

Name of the Vulnerable Software and Affected Versions Broadcom BCM4355C0 Wi-Fi chips version 9.44.78.27.0.1.56 Description The issue is caused by a buffer overflow in the Wi-Fi firmware. An attacker can craft a malformed RRM neighbor report frame to trigger this overflow. Exploitation of the issu...

PT-2017-17873

Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 0.7.4 Apache NiFi 1.x versions prior to 1.3.0 Description The issue arises from Apache NiFi's failure to establish a response header that instructs browsers to only allow framing from the same origin. This could...

PT-2017-18707

Name of the Vulnerable Software and Affected Versions libquicktime version 1.2.4 Description The issue allows remote attackers to cause a denial of service, specifically a heap-based buffer over-read, by providing a crafted mp4 file. This is related to the lqt frame duration function in lqt...

PT-2017-18705

Name of the Vulnerable Software and Affected Versions libquicktime version 1.2.4 Description The issue allows remote attackers to cause a denial of service, resulting in an invalid memory read and application crash, via a crafted mp4 file. This is due to a problem in the lqt frame duration functi...

libquicktime Denial of Service Vulnerability (CNVD-2017-11756)

libquicktime is a library for reading and writing files in quicktime, avi and mp4 formats. A security vulnerability exists in the 'lqtframeduration' function of the lqtquicktime.c file in libquicktime version 1.2.4. A remote attacker can exploit this vulnerability to cause a denial of service hea...

libquicktime Denial of Service Vulnerability (CNVD-2017-11758)

libquicktime is a library for reading and writing files in quicktime, avi and mp4 formats. A security vulnerability exists in the 'lqtframeduration' function of the lqtquicktime.c file in libquicktime version 1.2.4. A remote attacker can exploit this vulnerability to cause a denial of service...

Cisco NX-OS Software Denial of Service Vulnerability (CNVD-2017-13747)

Cisco NX-OS Software is the United States Cisco Cisco company's set of data center-oriented operating system. A denial of service vulnerability exists in the Fibra Channel over Ethernt FCoE protocol implementation in Cisco NX-OS Software, which arises from a program that fails to perform adequate...

Cisco NX-OS Software Fibre Channel over Ethernet Denial of Service Vulnerability (cisco-sa-20170607-nxos)

A vulnerability in the Fibre Channel over Ethernet FCoE protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition when an FCoE-related process unexpectedly reloads. Copyright C 2017 Greenbone Networks GmbH Some tex...

PT-2017-17220

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions 8.30CV0.833 Description A vulnerability in the Fibre Channel over Ethernet FCoE protocol implementation could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition when an...

http-security-headers NSE Script

Checks for the HTTP response headers related to security given in OWASP Secure Headers Project and gives a brief description of the header and its configuration value. The script requests the server for the header with http.head and parses it to list headers founds with their configurations. The...

Coinbase: X-Frame-Options

Report noted that status.coinbase.com is embed-able due to its current X-Frame-Options. As there was not a demonstrated link susceptible to clickjacking, this was not a security issue, but notification of the lack of this header was considered Informative. Note: per our policy, reports for...

[SECURITY] Fedora 26 Update: libvncserver-0.9.11-2.fc26

LibVNCServer makes writing a VNC server or more correctly, a program expor ting a frame-buffer via the Remote Frame Buffer protocol easy. It hides the programmer from the tedious task of managing clients and compression schemata...

WebKit Document::prepareForDestruction / CachedFrame Universal XSS

WebKit: UXSS via Document::prepareForDestruction and CachedFrame Here's a snippet of Document::prepareForDestruction void Document::prepareForDestruction if mhasPreparedForDestruction return; ... detachFromFrame; mhasPreparedForDestruction = true; Document::prepareForDestruction is called on the...

Apple WebKit Document::prepareForDestruction/CachedFrame Cross-Site Scripting Vulnerability

Apple WebKit is the open source web browser engine. A cross-site scripting vulnerability in Apple WebKit Document::prepareForDestruction/CachedFrame allows an attacker to construct a malicious web page that can be tricked into parsing and executing arbitrary code...

WebKit - Document::prepareForDestruction CachedFrame Universal Cross-Site Scripting

WebKit - Document::prepareForDestruction CachedFrame Universal Cross-Site Scripting Click anywhere. function createURLdata, type = 'text/html' return URL.createObjectURLnew Blobdata, type: type; function waitForcheck, cb let it = setInterval = if check clearIntervalit; cb; , 10; window.onclick = ...

WebKit CachedFrame Universal Cross Site Scripting

WebKit: UXSS: CachedFrame doesn't detach openers CVE-2017-2528 When a document loads "about:blank" or "about:srcdoc", it tries to inherit the security origin from its parent frame, or its opener frame if the parent frame doesn't exist. Normally, it doesn't happen that a subframe's document inheri...