DRUPAL-CORE-2019-002

A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing file operations on insufficiently validated user input, thereby being exposed to this...

drupal -- Drupal core - Arbitrary PHP code execution

Drupal Security Team reports: A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code core, contrib, and custom may be performing file operations on insufficiently validated user input, thereb...

UBUNTU-CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

MGASA-2019-0012 Updated freerdp packages fix security vulnerabilities

Eyal Itkin discovered FreeRDP incorrectly handled certain stream encodings. A malicious server could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code CVE-2018-8784, CVE-2018-8785. Eyal Itkin discovered FreeRDP incorrectly handled...

Security Bulletin: A vulnerability in RC4 stream cipher affects IBM FlashSystem 900 (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects the IBM FlashSystem 900. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FlashSystem 900 (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects the IBM FlashSystem 900. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie

A group of hackers has hijacked tens of thousands of Google's Chromecast streaming dongles, Google Home smart speakers and smart TVs with built-in Chromecast technology in recent weeks by exploiting a bug that's allegedly been ignored by Google for almost five years. The attackers, who go by...

Bento4 Excessive Memory Allocation Attempt Vulnerability

Bento4 is a C++ class library and tool for reading and writing ISO-MP4 files. The AP4StcoAtom class in Core/Ap4StcoAtom.cpp in Bento4 1.5.1-627 suffers from an excessive memory allocation attempt when called from AP4AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp! The vulnerability c...

UBUNTU-CVE-2018-20659

An issue was discovered in Bento4 1.5.1-627. The AP4StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp, as demonstrated by mp42hls...

PT-2018-17494 · Facebook · Proxygen

Name of the Vulnerable Software and Affected Versions: Proxygen versions prior to 2018.12.31.00 Description: An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. Recommendations: For versions prior to 2018.12.31.00, update to version...

The vulnerability of the xcf_load_stream function in the GIMP graphics editor, which involves reading beyond the buffer limit, allows attackers to cause service failures, compromise data integrity, and undermine data confidentiality.

The vulnerability of the xcfloadstream function /xcf/xcf.c in the GIMP graphic editor, GNU Image Manipulation Program, relates to reading beyond the buffer boundaries during string processing, especially when dealing with strings that do not contain the null character '\0'. Exploiting this...

CVE-2018-20247

In Foxit Quick PDF Library all versions prior to 16.12, issue where loading a malformed or malicious PDF containing a recursive page tree structure using the LoadFromFile, LoadFromString or LoadFromStream functions results in a stack overflow...

Remote code execution

MegaMek version v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

CVE-2018-1000824

MegaMek version v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

CVE-2018-1000824

MegaMek version v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

CVE-2018-1000824

CVE-2018-1000824 affects MegaMek for versions

CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

stream-support.ru XSS vulnerability

Open Bug Bounty ID: OBB-711866 Description| Value ---|--- Affected Website:| stream-support.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...