Remote Exploitation of the NeoCoolcam IP Cameras and Gateway

Foreword The Internet of Connected Things has become a massive phenomenon during the past few years and will continue to grow at an incredible pace. More than 26 billion smart devices will be on the market by 2020, Gartner estimates. We’re looking at an explosive growth, as IoT opportunities...

[SECURITY] Fedora 24 Update: jackson-databind-2.6.3-3.fc24

General data-binding functionality for Jackson: works on core streaming API...

Don't Say Goodbye to Your OTT Viewers

Takes a second to say goodbye Say goodbye, oh, oh, oh It takes a second to say goodbye Say goodbye, oh, oh, oh, say bye bye Where you going to now When U2 penned the lyrics to its song, "Seconds," in 1983, there was no such thing as online video. In fact, video had killed the radio star only four...

Hacking Spotify

Some of the ways artists are hacking the music-streaming service Spotify...

VLC: Multiple vulnerabilities

Background VLC is a cross-platform media player and streaming server. Description Multiple vulnerabilities have been discovered in VLC. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to open a specially crafted subtitles file, could...

TP-LINK NC250 Certification Bypass Vulnerability

TP-Link NC250 is a network camera product from China P&L TP-LINK. An authentication bypass vulnerability exists in the TP-LINK NC250. The vulnerability is exploited by 攻击者可借助rtsp://admin@yourip:554/h264hd.sdp URL to view video and audio without authorization...

Denial Of Service (DoS)

Undertow is vulnerable to denial of service DoS attacks. The library does not close its streaming websocket properly, leading to an infinite loop. A malicious user can use this behavior to cause multiple infinite loops that lead to the system running out of resources and crashing...

Information Disclosure

FFmpeg is vulnerable to information disclosure. The library does not properly handle HTTP Live Streaming filename extensions and demuxer names. A malicious user can pass playlist files to the system to obtain sensitive information...

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

ALPINE-CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

UBUNTU-CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

Code injection

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

DEBIAN-CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

CVE-2017-9993

FFmpeg vulnerability CVE-2017-9993 allows reading arbitrary files via crafted HLS playlists by not properly restricting HTTP Live Streaming filename extensions and demuxer names. Affected are FFmpeg releases prior to 2.8.12, 3.0.x (3.0.0–3.0.x with 3.1.x before 3.1.9), 3.2.x before 3.2.6, and 3.3...

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

Ffmpeg Arbitrary File Read Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg because the program fails to properly restrict HTTP Live Streaming filename extensions and demuxer names. The vulnerability can be exploited to rea...