CVE-2017-18038

Affected software: Atlassian Bitbucket Server (before 5.6.0). Vulnerability: repository settings resource allows path traversal via the default branch name, enabling remote attackers to read the first line of arbitrary files. Root cause: path traversal in the repository settings resource. Impact:...

Walt Disney Animation Studios PTEX Buffer Overflow Vulnerability

Walt Disney Animation Studios PTEX is a texture mapping system developed by Walt Disney Animation Studios. A buffer overflow vulnerability exists in Walt Disney Animation Studios PTEX version 2.2, which originates when the program fails to properly detect parameters when reading a file. An attack...

Out-of-bounds

An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in, is not verified to be valid and its use can lead to a buffe...

CVE-2018-3835

An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in, is not verified to be valid and its use can lead to a buffe...

QYKCMS template.php page has an arbitrary file reading vulnerability

QYKCMS is a lightweight intelligent website building system based on PHP+MySql developed by QYK. QYKCMS template.php page arbitrary file reading vulnerability. The vulnerability is caused by the system does not effectively filter parameters. Attackers can use the vulnerability to obtain sensitive...

Walt Disney Per-Face Texture Mapping faceInfoSize Code Execution Vulnerability

Summary An exploitable out of bounds write vulnerability exists in version 2.2 of the Per Face Texture mapping application known as PTEX. The vulnerability is present in the reading of a file without proper parameter checking. The value read in, is not verified to be valid and its use can lead to...

Multiple Apple Products Kernel Competition Condition Vulnerability

Apple iOS, macOS High Sierra, tvOS, and watchOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices. macOS High Sierra is a specialized operating system developed for Mac computers. tvOS is a smart TV operating system. watchOS is a smart watch operating system...

Advantech WebAccess/SCADA Directory Traversal Vulnerability

Advantech WebAccess is a browser-based HMI software package for human machine interfaces, as well as monitoring and data acquisition SCADA. A directory traversal vulnerability exists in Advantech WebAccess/SCADA, which can be exploited by an attacker to read files in the directory structure of a...

January 19, 2017 – Morning Cyber Coffee Headlines – “Puppies” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 19, 2018 - Headlines The Five Laws Of Cybersecurity - Forbes 3 things y...

CVE-2018-2650

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Hospitality Applications subcomponent: Report. Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2018-2658

Vulnerability in the JD Edwards EnterpriseOne Tools component of Oracle JD Edwards Products subcomponent: Web Runtime SEC. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

CVE-2018-2644

Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications subcomponent: Worklist. Supported versions that are affected are 7.x, 8.0.x and 8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Argus...

Confluence REST API for reading and updating wiki pages

In previous posts I wrote how to automate the work with Atlassian Jira, including automated ticket labeling. Now let's try to use REST API of another popular Atlassian product - Confluence wiki engine. What you may want to automate in Confluence? Obviously, it may be useful to read the pages that...

DEBIAN-CVE-2018-5360

LibTIFF before 4.0.6 mishandles the reading of TIFF files, as demonstrated by a heap-based buffer over-read in the ReadTIFFImage function in coders/tiff.c in GraphicsMagick 1.3.27...

The vulnerability of the ALSA/dev/snd/timer driver (sound/core/timer.c) in the Linux operating system allows a hacker to obtain confidential information.

The vulnerability of the ALSA/dev/snd/timer driver sound/core/timer.c in the Linux operating system is related to the disclosure of information during simultaneous data reading and analysis. Exploiting this vulnerability can allow an attacker, operating locally, to obtain confidential information...

[SECURITY] [DLA 1235-1] opencv security update

Package : opencv Version : 2.3.1-11+deb7u3 CVE ID : CVE-2017-17760 CVE-2017-1000450 Opencv 3.3 and earlier has problems while reading data, which might result in either buffer overflows or integer overflows. For Debian 7 "Wheezy", these problems have been fixed in version 2.3.1-11+deb7u3. We...

Aurea Jive Jive-n Arbitrary File Read Vulnerability

Aurea Jive Jive-n is a suite of enterprise collaboration solutions from Aurea USA. The solution is capable of supporting and hosting a number of different systems, devices and tools. A security vulnerability exists in the file upload functionality of the upload.jspa file in Aurea Jive Jive-n...

CVE-2017-7158

An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Screen Sharing Server" component. It allows attackers to obtain root privileges for reading files by leveraging screen-sharing access...

Xerox DC260 EFI Fiery Controller Webtools 2.0 Arbitrary File Disclosure

Summary Drive production profitability with Fiery servers and workflow products. See which Fiery digital front end is right for your current or future print engines and business needs. Manage all your printers from a single screen using this intuitive print job management interface. Description...

The vulnerability of Google Chrome’s Skia graphics library allows a hacker to perform memory-reading operations beyond the limits of the application’s memory.

The vulnerability of Google Chrome’s Skia graphics library exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform memory-walking attacks using a specially crafted HTML page...