A vulnerability has been discovered in Apache Struts which could allow for remote code execution. This vulnerability exists because the REST Plugin is using a XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. Successful exploitation of this vulnerability could allow […]
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could result in arbitrary code execution. These vulnerabilities can be exploited if a user visits, or is redirected to, a specially crafted web page. Details of the vulnerabilities are as follows: a) Use after free in PDFium – (CVE-2017-5111) b) Heap buffer […]
Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow an attacker to execute arbitrary code: a)Fixed bug #74947 (Segfault in scanner on INF number). b) Fixed bug #74954 (null deref and segfault in zend_generator_resume()). c) Fixed bug #74725 (html_errors=1 breaks unhandled exceptions). d) Fixed bug #74125 (Fixed finding CURL on […]
Adobe has released a security updates stating that Adobe Flash Player is prone to the following vulnerabilities: a) A security bypass vulnerability that could lead to information disclosure. b) A type confusion vulnerability that could lead to code execution (CVE-2017-3106) Successful exploitation of the most severe of these vulnerabilities could result in the attacker gaining […]
HP has released a security update to address a potential security vulnerability that has been identified in HPE Integrated Lights-out which could be exploited remotely to allow authentication bypass and execution of code. Further information on this vulnerability and how it can be fixed can be found on the HP Website at http://h20565.www2.hpe.com/hpsc/doc/public/display?docId=hpesbhf03769en_us
Drupal has released an advisory to address several vulnerabilities in Drupal 8.x: a) CVE-2017-6924 – REST API can bypass comment approval – when using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only […]
Cisco has released updates to address vulnerabilities affecting multiple products: a) Cisco Application Policy Infrastructure Controller Vulnerability – could allow an authenticated remote attacker to gain higher privileges than the account is assigned. The attacker will be granted the privileges of the last user to log in, regardless of whether those privileges are higher or […]
Symantec has released a security update to address the following security vulnerabilities in Symantec Messaging Gateway: a) Remote Code Execution – an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt […]
Juniper Networks has released a security advisory for Junos OS stating that an integer signedness vulnerability exists in libgd 2.1.1 which may result in a heap overflow when processing compressed gd2 data. Further information on this vulnerability and how it can be fixed can be found on the Juniper Website at https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10798&cat=SIRT_1&actp=LIST
Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR: a) Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. b) A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is […]
