IBM WebSphere MQ GSKit Information Disclosure Vulnerability

IBM WebSphere MQ is a messaging middleware product from IBM Corporation. It provides a reliable and proven messaging backbone for Service Oriented Architecture SOA, for which GSKit Global Security Toolkit is a set of security management tools. An information disclosure vulnerability exists in GSK...

Asterisk 13.17.2 - 'chan_skinny' Remote Memory Corruption

Exploit Author: Juan Sacco - http://exploitpack.com Vulnerability found using Exploit Pack v10 - Fuzzer module CVE-2017-17090 - AST-2017-013 Tested on: Asterisk 13.17.2dfsg-2 Description: Asterisk is prone to a remote unauthenticated memory exhaustion The vulnerability is due to an error when the...

Dojo Toolkit Cross-Site Scripting Vulnerability

Dojo Toolkit is the Dojo Foundation an open source DHTML toolkit implemented in the JavaScript language . The toolkit is easy to build interactive user interface , Dojo's extension package can make the user's code easier to maintain , less coupling , etc. dijit.Editor is one of the WYSIWYG editor...

openSUSE Security Update : translate-toolkit (openSUSE-2018-130)

This update for translate-toolkit to 2.2.4 fixes several issues. This security issue was fixed : - Prevent inclusion of external ressources XXE boo1073535 These non-security issues were fixed : - Added support for nested and WebExtension JSON dialects. - po2txt no longer converts non-translatable...

CVE-2018-6561

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

CVE-2018-6561

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

UBUNTU-CVE-2018-6561

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

CVE-2018-6561

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

Cross site scripting

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

CVE-2018-6561

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

DEBIAN-CVE-2018-6561

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...

CVE-2018-6561

CVE-2018-6561 affects dojo-dijit.Editor in Dojo Toolkit 1.13, enabling cross-site scripting via the onload attribute of an SVG element. The IBM/OSV records confirm the vulnerability details, including the XSS risk in Dijit.Editor and a base score of 6.1 (IBM X-Force vector: CVSS3.0), with exploit...

A week in security (January 15 – January 21)

Last week on Labs, we gave you some background information about cookies, specifically which ones to worry about and why. We also warned you about scams surrounding the Mega Millions winner, who promised to donate his money to good causes. We analyzed a cryptocurrency miner using a very old...

OpenJDK: GTK library loading use-after-free (AWT, 8185325)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2018-2677

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

OpenJDK: GTK library loading use-after-free (AWT, 8185325)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

UBUNTU-CVE-2018-2677

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

Unspecified Vulnerability in Oracle Java SE and Java SE Embedded (CNVD-2018-02213)

Oracle Java SE is a standard version of Oracle's Java platform for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments. both Java SE and Java SE Embedded are components of Java SE Embedded is a Java platform for embedded systems. Java...

[SECURITY] Fedora 26 Update: mupdf-1.12.0-1.fc26

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...