CVE-2018-3745

atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below...

java-1.8.0-openjdk security update

1:1.8.0.171-3.b10 - Cleanup from previous commit. - Resolves: rhbz1559766 1:1.8.0.171-2.b10 - Backported from fedora: aarch64BuildFailure.patch, rhbz1536622-JDK8197429-jdk8.patch, rhbz1540242.patch - Resolves: rhbz1559766 1:1.8.0.171-0.b10 - Update to aarch64-jdk8u171-b10. - Resolves: rhbz1559766...

CMS Made Simple Physical Path Disclosure Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS 2.2.7 and...

Convert Forms, 2.0.3, CSV Injection

Convert Forms by Tassos.gr, versions 2.0.3 and previous, CSV Injection resolution: update to 2.0.4 update notice: https://www.tassos.gr/blog/convert-forms-2-0-4-security-release...

March 15, 2018—KB4090912 Update for Windows 10 Mobile (OS Build 15254.313)

March 15, 2018—KB4090912 Update for Windows 10 Mobile OS Build 15254.313 Improvements and fixes This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include: This build includes all the improvements from KB4088782. Addresses...

March 2018 security update release

Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...

CVE-2018-7675

In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log out but does go idle for a period of time. This in turn causes the interface to timeout so that it requires the user to re-authenticate. If...

JMS Music,1.1.1,SQL Injection

JMS Music by Joomasters, versions 1.1.1 and previous, SQL Injection...

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisti...

ALPINE-CVE-2018-7263

The maddecoderrun function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service SIGABRT because of double free or corruption or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552...

Mozilla Firefox Security Bypass Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 58. An attacker can exploit the vulnerability to bypass the sandbox protection mechanism and obtain local data...

January 2018 security update release

Today, we released security updates to provide additional protections against malicious attackers. By default, Windows 10 receives these updates automatically, and for customers running previous versions, we recommend they turn on automatic updates as a best practice. More information about this...

CMS Made Simple has an unspecified vulnerability (CNVD-2017-37769)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple...

OpenDaylight Karaf Information Disclosure Vulnerability

OpenDaylight, a project of the Linux Foundation in the United States, is a set of community-driven open source software-defined networking frameworks that contain an ensemble of modules capable of performing networking tasks that need to be done quickly.Karaf is an OSGi-based runtime environment...

ZH Yandex Map, 6.1.1.0, SQL Injection

ZH Yandex Map, 6.1.1.0 and previous versions, SQL Injection Resolution: update to 6.2.0.0 Update notice: http://zhuk.cc/2017/10/05/zh-yandexmap-security-update/...

August 30, 2017—KB4039884

None None...

DEBIAN-CVE-2017-6594

The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets...

Announcing the Fourth Annual Flare-On Challenge

The fourth annual Flare-On Challenge – the FireEye Labs Advanced Reverse Engineering FLARE team’s yearly reverse engineering contest – is scheduled to kick off on Sept. 1, 2017, at 8pm ET. This is a CTF-style challenge for all active and aspiring reverse engineers, malware analysts, and security...

Unspecified Vulnerability in Mozilla Firefox for Android

Mozilla Firefox for Android is an open source web browser based on the Android platform from the US-based Mozilla Foundation. A security vulnerability exists in previous versions of Mozilla Firefox 53 for Android. An attacker can exploit the vulnerability to spoof the contents of the address bar...

The vulnerability of the Android operating system, which allows a perpetrator to gain access to the data of the previous owner

The vulnerability of the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to the data of the previous owner, as a result of resetting the settings to the factory defaults...