Security Bulletin: IBM Flex System Manager (FSM) is affected by libpng vulnerabilities (CVE-2015-7981, CVE-2015-8126)

Summary Vulnerabilities have been discovered in libpng that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2015-8126 DESCRIPTION: libpng is vulnerable to a buffer overflow, caused by improper bounds checking by the pngsetPLTE and...

Security Bulletin: IBM Flex System Manager (FSM) is affected by a curl vulnerability (CVE-2016-0755)

Summary A security vulnerability has been discovered in curl that is embedded in the IBM FSM. This bulletin addresses the vulnerability. Vulnerability Details CVEID: CVE-2016-0755 DESCRIPTION: Libcurl could allow a remote attacker to bypass security restrictions, caused by the failure to check...

Security Bulletin: Multiple vulnerabilities in tiff affect IBM Flex System Manager(FSM)

Summary Multiple security vulnerabilities have been discovered in tiff that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2015-8783 DESCRIPTION: LibTIFF is vulnerable to a denial of service, caused by an out-of-bounds read in tifluv.c....

Security Bulletin: A vulnerability in Apache Commons affects IBM Flex System Manager(FSM) (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by FSM. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserializatio...

Security Bulletin: A security vulnerability with net-snmp affects IBM Flex System Manager (CVE-2015-3565)

Summary A security vulnerability has been identified in net-snmp that is used by IBM Flex System Manager FSM. This bulletin addresses this vulnerability. Vulnerability Details CVEID: CVE-2014-3565 DESCRIPTION: Net-SNMP is vulnerable to a denial of service, caused by the improper handling of SNMP...

Security Bulletin: Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)

Summary OpenStack Nova could allow a remote authenticated attacker to bypass security restrictions. By rebuilding an instance, an attacker could exploit this vulnerability to achieve Filter Scheduler bypass. Vulnerability Details CVE-ID: CVE-2017-16239 Description: OpenStack Nova could allow a...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2017-1743)

Summary WebSphere Application Server is shipped as a component of IBM Operations Analytics Predictive Insights. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427) shipped with Tivoli Netcool Performance Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the Oracle April 2016 Critical Patch Update, plus four additional vulnerabilities. These may affect some configurations of IBM...

Security Bulletin: FileNet Content Management Interoperability Services (CMIS), which is shipped with IBM Content navigator, is affected by the ability to execute remote attacker’s arbitrary code on a target machine vulnerability

Summary FileNet Content Management Interoperability Services CMIS, which is shipped with IBM Content Navigator, has addressed the following vulnerability. Ability to execute remote attacker’s arbitrary code on a target machine by leveraging the untrusted data in DiskFileItem class of FileUpload...

Session fixation

ClipperCMS 1.3.3 allows Session Fixation...

Design/Logic Flaw

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...

CVE-2018-11572

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...

CVE-2018-11571

ClipperCMS 1.3.3 allows Session Fixation...

CVE-2018-11572

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...

CVE-2018-11572

ClipperCMS 1.3.3 has an XSS vulnerability in the Module name field accessed via Modules → Manage modules → edit (manager/ URI). The issue allows injection of arbitrary web script or HTML (remote exploitation). Root cause: improper sanitization of the module name input. Impact: potential script ex...

CVE-2018-11571

CVE-2018-11571 affects ClipperCMS 1.3.3 and is described as a Session Fixation vulnerability. The connected documents confirm the affected product and vulnerability type but do not provide concrete technical details such as vulnerable components, root cause specifics, exploit vectors, affected ve...

ClipperCMS Cross-Site Scripting Vulnerability (CNVD-2018-10866)

ClipperCMS is a content management system CMS. A cross-site scripting vulnerability exists in the 'Module name' field under the 'Modules - Manage modules - edit' tag in ClipperCMS version 1.3.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2018-11572

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules - Manage modules - edit" action to the manager/ URI...

Cross site scripting

Stored cross-site scripting XSS vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/savesettings.processor.php file...

CVE-2018-11332

ClipperCMS 1.3.3 is affected by a stored XSS in the Site Name field under Configurations (site tab). The vulnerability arises because user input is not sanitized in the manager/processors/save_settings.processor.php endpoint, allowing an authenticated attacker to inject arbitrary script/HTML. Pub...