41 matches found
Vulnerabilities fixed in IBM Cognos Controller
IBM has fixed vulnerabilities in Cognos Controller. The vulnerabilities potentially enable a malicious person to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution Use...
CVE-2020-4879
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847...
CVE-2020-4877
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 190843...
Xxe
IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190838...
CVE-2020-4877
The CVE-2020-4877 issue affects IBM Cognos Controller 10.4.0, 10.4.1 and 10.4.2, where public fields in public classes could be misuse by an attacker to cause unauthorized modifications. The underlying root cause is an authorization issue that stems from not applying proper permissions to public ...
CVE-2020-4875
IBM Cognos Controller (versions 10.4.0, 10.4.1, 10.4.2) is affected by CVE-2020-4875: an XML External Entity Injection (XXE) when processing XML data, enabling a remote attacker to expose sensitive information or exhaust memory. Remediation is to upgrade to fixed builds: 10.4.0 IF11, 10.4.1 IF12,...
Security Bulletin: IBM Cognos Controller 10.4.2 IF17: Apache Log4j vulnerability (CVE-2021-45105 & CVE-2021-44832)
Summary IBM Cognos Controller is affected by security vulnerabilities. Apache Log4j is used by IBM Cognos Controller as part of its logging infrastructure. This bulletin addresses the exposure to the Apache Log4j vulnerabilities: CVE-2021-45105 and CVE-2021-44832. IBM Cognos Controller has upgrad...
Security Bulletin: IBM Cognos Controller is vulnerable to privilege escalation (CVE-2020-4685)
Summary IBM Cognos Controller is vulnerable to privilege escalation. This has been addressed. Vulnerability Details CVEID: CVE-2020-4685 DESCRIPTION: A low level user of Cognos Controller who has Administration rights to the server where the application is installed, can escalate their privilege...
TYPO3 9.5.12 < 9.5.17 / 10.2 < 10.4.2 XSS (TYPO3-CORE-SA-2020-003)
The version of TYPO3 installed on the remote host is 9.5.12 prior to 9.5.17 or 10.2 prior to 10.4.2. It is, therefore, affected by a cross-site scripting XSS vulnerability in its link handling component due to improper validation of user-supplied input before returning it to users. An...
CVE-2020-11067
In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings in $BEUSER-uc are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user...
GHSA-4J77-GG36-9864 Cross-Site Scripting in TYPO3 CMS Link Handling
It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly. Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described. References...
CVE-2020-11063
In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2...
PT-2020-12524 · Typo3 · Typo3/Cms
Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 10.4.0 through 10.4.1 Description: The issue allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts using time-based attacks with the password reset functionality for backend...
PT-2020-12526 · Typo3 · Typo3/Cms
Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.5.12 through 9.5.16 TYPO3 CMS versions 10.2.0 through 10.4.1 Description: The issue concerns link tags generated by typolink functionality, which are vulnerable to cross-site scripting. Properties being assigned as HTML...
CVE-2005-2512
Mail.app in Mac OS 10.4.2 and earlier, when printing or forwarding an HTML message, loads remote images even when the user's preferences state otherwise, which could result in a privacy leak...
CVE-2005-2508
dsidentity in Directory Services in Mac OS X 10.4.2 allows local users to add or remove user accounts...
CVE-2005-2512
The CVE-2005-2512 entry concerns Mail.app on macOS 10.4.2 and earlier. The issue: when printing or forwarding an HTML message, Mail.app loads remote images even if the user’s preferences say otherwise, creating a potential privacy leak. The connected documents confirm the affected product and the...
CVE-2005-2508
The CVE-2005-2508 entry concerns Mac OS X 10.4.2, where dsidentity in Directory Services allows local users to add or remove user accounts. The vulnerability is a local privilege-abuse issue affecting the Directory Services component; exploitation would occur on systems with local access. Remedia...
CVE-2005-2513
The CVE-2005-2513 entry concerns HItoolbox for Mac OS X 10.4.2 where VoiceOver can read secure input fields, implying a UI/input security bypass. The exact root cause and vulnerable components are not fully detailed in the provided documents, but the NVD entry assigns a Medium severity (CVSSv2 ba...