Juliano Rizzo

The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request. This is related to the gadgets-integration API in Cisco Finesse.

The issue allows remote attackers to decrypt and modify encrypted View State form data via a padding oracle attack. This could possibly lead to forging cookies or reading application files. An information disclosure vulnerability exists due to improper error handling during encryption padding verification, allowing an attacker to read encrypted data, such as the view state. This vulnerability can also be used for data tampering, which could be used to decrypt and tamper with the data encrypted by the server. In Microsoft .NET Framework 3.5 Service Pack 1 and above, an attacker can retrieve the contents of any file within the ASP.NET application, including web.config.

Name of the Vulnerable Software and Affected Versions: RealOne Player versions 6.0.11.x and earlier RealPlayer 8/RealPlayer Plus 8 version 6.0.9.584 Description: The issue concerns the PNG deflate algorithm, which allows remote attackers to corrupt the heap and overwrite arbitrary memory. This is achieved through a PNG graphic file format containing compressed data using fixed trees that contain the length values 286-287, treated as a very large length. Recommendations: For RealOne Player versions 6.0.11.x and earlier, update to a version later than 6.0.11.x to resolve the issue. For RealPlayer 8/RealPlayer Plus 8 version 6.0.9.584, update to a version later than 6.0.9.584 to resolve the issue.

The issue concerns multiple vulnerabilities in the curl package and Oracle products, which can lead to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely. The SSL protocol, used in certain configurations in various products, including Microsoft Windows, Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and others, is vulnerable to a "BEAST" attack. This attack allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack on an HTTPS session, in conjunction with JavaScript code that uses the HTML5 WebSocket API, Java URLConnection API, or Silverlight WebClient API.

The issue allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, also known as a "CRIME" attack.