Description of the security update for Office 2010: August 14, 2018

Description of the security update for Office 2010: August 14, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow information disclosure if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

Description of the Security and Quality Rollup for .NET Framework 2.0 SP2 and 3.0 SP2 for Windows Server 2008 SP2 (KB 4344151)

Description of the Security and Quality Rollup for .NET Framework 2.0 SP2 and 3.0 SP2 for Windows Server 2008 SP2 KB 4344151 Summary This update resolves an information disclosure vulnerability in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant...

Security Bulletin: Security vulnerabilities in IBM Java Runtime affect IBM RLKS Administration and Reporting Tool Admin

Summary There are multiple vulnerabilities related to IBM® Runtime Environment Java™ Technology Edition which is used and shipped by different versions of IBM Rational License Key Server Administration and Reporting Tool Admin ART. Vulnerability Details CVEID: CVE-2018-2796 DESCRIPTION: An...

Black Hat 2018: Update Mechanisms Allow Remote Attacks on UEFI Firmware

LAS VEGAS – Researchers said they found buffer overflow flaws in the firmware for ASRock and ASUS, potentially enabling bad actors to remotely launch man-in-the-middle MITM attacks. The findings, which will be presented Wednesday at Black Hat USA this week by researchers from Eclypsium, show that...

Red Hat keycloak infinite loop vulnerability

Red Hat keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An infinite loop vulnerability exists in session replacement in Red Hat Keycloak versions prior to 4.0.0.final, which stems from the failure of...

Apache OpenWhisk Remote Code Execution Vulnerability (CNVD-2018-14727)

Apache OpenWhisk is an open source FaaS cloud platform from the Apache Software Foundation in the U.S. Docker Skeleton Runtime for Apache OpenWhisk is its Docker-based version. A security vulnerability exists in Docker Skeleton Runtime for Apache OpenWhisk. The vulnerability can be exploited to...

Apache OpenWhisk Remote Code Execution Vulnerability

Apache OpenWhisk is an open source FaaS cloud platform from the Apache Software Foundation in the U.S. PHP Runtime for Apache OpenWhisk is its PHP-based version. A security vulnerability exists in PHP Runtime for Apache OpenWhisk. The vulnerability can be exploited to replace the source code of a...

UBUNTU-CVE-2017-9118

PHP 7.1.5 has an Out of bounds access in phppcrereplaceimpl via a crafted pregreplace call...

GHSA-2P69-GXPM-5469 Downloads Resources over HTTP in alto-saxophone

Affected versions of alto-saxophone insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

Need to reset the SSL listener certificate on XenMobile

Need to reset the SSL listener certificate on XenMobile. Scenario : After accidentally replacing the SSL Listener certificate with another certificate, we would be unable to access the XenMobile GUI. To gain access to the XenMobile GUI to replace the SSL certificate, we need to reset the SSL...

Denial Of Service (DoS) Through Infinite Loop

keycloak-model-infinispan is vulnerable to denial of service DoS attacks through an infinite loop. The vulnerability exists due to an infinite loop that could occur during the replacement of a session where the replacement could fail, causing a DoS...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

Code injection

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

Keycloak before 4.0.0.final is vulnerable to an infinite loop in session replacement, which could allow a malicious authenticated user to cause a Denial of Service on a multi-node cluster. Red Hat advisories reference CVE-2018-10912 and list a fix in later releases (e.g., Red Hat SSO 7.2.4) and a...

GHSA-XJ3H-VC9J-J823 Directory Traversal in nodeaaaaa

Affected versions of nodeaaaaa resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

CVE-2018-11756

In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 or earlier may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation...

Multiple Echelon Products Information Disclosure Vulnerability (CNVD-2018-18306)

Echelon SmartServer 1 and others are products of Echelon Corporation of the United States. echelon SmartServer 1 is a multifunctional controller, which supports building automation control and enterprise energy management, etc. i.LON 100 is a network server, which is mainly used to configure and...