Airsonic XXE Vulnerability

Airsonic is a free and open source community-driven media server that provides access to music. Airsonic versions prior to 10.1.2 are vulnerable to an XXE XML External Entity Injection vulnerability during parsing. No detailed vulnerability details are provided at this time...

CVE-2018-20222

XXE issue in Airsonic before 10.1.2 during parse...

CVE-2018-20222

XXE issue in Airsonic before 10.1.2 during parse...

CVE-2017-1265

IBM Security Guardium versions 10.0–10.5 contain an improper certificate validation flaw that can enable MITM-style spoofing of trusted entities. The issue affects the Guardium service components that handle certificate validation, enabling an attacker to present forged certificates under network...

Security Bulletin: Password disclosure via instrumentation log file in IBM Spectrum Protect Plus (CVE-2018-1768)

Summary IBM Spectrum Protect Plus may display the user id and password in plain text within the instrumentation log file. Vulnerability Details CVEID: CVE-2018-1768 DESCRIPTION: IBM Spectrum Protect Plus could disclose sensitive information when an authorized user executes a test operation, the...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Insufficient Authorization Checks vulnerability (CVE-2018-1368 )

Summary IBM Security Guardium Database Activity Monitor has addressed the following vulnerability Vulnerability Details CVEID: CVE-2018-1368 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a local user with low privileges to view report pages and perform some actions that...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by SQL Injection - gimservlet Vulnerability(CVE-2017-1757 )

Summary IBM Security Guardium Database Activity Monitor has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1757 DESCRIPTION: IBM Security Identity Governance Virtual Appliance is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL...

Security Bulletin: IBM Security Guardium is affected by XML External Entity vulnerability (CVE-2017-1254)

Summary IBM Security Guardium is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM Security Guardium has fixed this vulnerability Vulnerability...

Security Bulletin: IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerability (CVE-2017-3302)

Summary Multiple Oracle products are vulnerable to a denial of service, caused by a use-after-free vulnerability in the libmysqlclient.so. An attacker could exploit this vulnerability to cause the application to crash. IBM Security Guardium addressed this issue Vulnerability Details CVEID:...

Security Bulletin: IBM Security Guardium is affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the in the Triple-DES on 64-bit block cipher, used as a part of the SSL/TLS protocol. This vulnerability is known as the SWEET32 Birthday attack. IBM Security Guardium has fixed this vulnerability...

VMware Fusion 10.x < 10.1.2 Multiple Vulnerabilities (VMSA-2018-0013) (macOS)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.2. It is, therefore, missing a security update that fixes multiple flaws that allow local privilege escalation and multiple denial of service attacks. C Tenable Network Security, Inc...

VMware Workstation and Fusion Denial of Service Vulnerability (CNVD-2018-10313)

VMWare Workstation and Fusion are both desktop virtual computer software from VMware. The former provides virtual machine functionality that allows you to run several different operating systems at the same time, while the latter is virtual machine software used to run Windows applications on App...

CVE-2018-6962

VMware Fusion 10.x before 10.1.2 contains a signature bypass vulnerability which may lead to a local privilege escalation...

CVE-2018-6963

VMware Workstation 14.x before 14.1.2 and Fusion 10.x before 10.1.2 contain multiple denial-of-service vulnerabilities that occur due to NULL pointer dereference issues in the RPC handler. Successful exploitation of these issues may allow an attacker with limited privileges on the guest machine...

Security feature bypass

VMware Fusion 10.x before 10.1.2 contains a signature bypass vulnerability which may lead to a local privilege escalation...

CVE-2018-6963

CVE-2018-6963 affects VMware Workstation 14.x (pre-14.1.2) and VMware Fusion 10.x (pre-10.1.2). The root cause is a NULL pointer dereference in the RPC handler, enabling a local attacker with limited guest privileges to cause a denial of service on the guest OS. Connected advisories corroborate m...

Red Hat Wildfly Server Anonymous Login Vulnerability

Red Hat Wildfly formerly known as JBoss Application Server is a U.S. Red Hat Red Hat company based on JavaEE open source application server. A security vulnerability exists in Red Hat WildFly version 10.1.2.Final. An attacker could exploit the vulnerability to access the server without...

CVE-2018-10682

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment permits an...

PT-2018-10050 · Red Hat · Wildfly

Name of the Vulnerable Software and Affected Versions: WildFly version 10.1.2.Final Description: An issue allows an attacker to access the administration panel without authentication using anonymous access. Once logged in, a misconfiguration permits an anonymous user to deploy a malicious .war...

PT-2018-10051 · Red Hat · Wildfly

Name of the Vulnerable Software and Affected Versions: WildFly version 10.1.2.Final Description: An issue was discovered where an attacker can access the server without authentication in the case of a default installation without a security realm reference. This is because the configuration is...