[SECURITY] Fedora 26 Update: python-jwt-1.5.3-1.fc26

A Python implementation of JSON Web Token draft 01. This library provides a means of representing signed content using JSON data structures, including claims to be transferred between two parties encoded as digitally signed and encrypted JSON objects...

How To Replace An Expired Self Signed SAML Certificate in XenMobile 10.x

How to renew theself-signed SAML certificate which is included inXenMobile...

Akeo Consulting Rufus fails to update itself securely

Overview Akeo Consulting Rufus fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code on a vulnerable system. Description Akeo Consulting Rufus 2.16 retrieves updates over HTTP. While Rufus does attempt to perform some basic signature...

Design/Logic Flaw

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2017-11379

Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1...

Change Token Signing Certificate Expiration Date

When using ADFS 3.0, the Token-Signing Certificate that is generated during setup is, and can be, a Self-Signed Certificate. By default, the Token-Signing Certificate will expire 1 year after it is created. It will also automatically roll-over 2 weeks before expiration if Certification roll-over ...

Code injection

Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...

ALPINE-CVE-2017-9951

The tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service segmentation fault via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerabili...

DEBIAN-CVE-2017-9951

The tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service segmentation fault via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerabili...

UBUNTU-CVE-2017-9951

The tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service segmentation fault via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerabili...

OSCI Transport Library OSCI-Transport Signature Package Vulnerability

OSCI Transport Library Java is a Java library of mandatory transport protocols for German e-government, and OSCI Transport Library .NET is its .NET version.OSCI-Transport is one of the XML-based transport protocols. A security vulnerability exists in OSCI Transport Library version 1.6.1 Java and...

WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock

range.mmaxBound range.mmaxBound = data.maddend; range.mmaxOrigin = node-origin.semantic; else if data.maddend origin.semantic; ... The problem is that the check |data.maddend range.mmaxBound| is a signed comparison. PoC: -- function f let arr = new Uint32Array10; for let i = 0; i 0x100000; i++...

March 2017 Preview of Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2

March 2017 Preview of Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2 The March 2017 Preview of Monthly Quality Rollup includes some new improvements and fixes for the Windows 8.1 and Windows Server 2012 R2 platforms. We recommend that you apply this quality rollup as part of yo...

CVE-2014-9924

Technical details about CVE-2014-9924 are not provided in the supplied connected documents. Public information appears limited to a Signed to Unsigned Conversion Error in CAF Linux kernel. Monitor for updates.

CVE-2014-9924

In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur...

J-LIS The Public Certification Service for Individuals 'The JPKI user's software' has an unspecified vulnerability

J-LIS The Public Certification Service for Individuals "The JPKI user's software" is a set of public certification service software for individuals based on the PKI Public Key Infrastructure platform from Japan Agency for Local Authority Information Systems J-LIS. The JPKI user's software" is a...

CVE-2017-8058

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

UBUNTU-CVE-2017-8419

LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service stack-based buffer overflow or heap-based buffer overflow or possibly have unspecified other impact via a crafted file, as demonstrated by...

Heap overflow

LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service stack-based buffer overflow or heap-based buffer overflow or possibly have unspecified other impact via a crafted file, as demonstrated by...