Solaris 10 (x86) : 150401-62

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris...

Bypassing Passcodes in iOS

Last week, a story was going around explaining how to brute-force an iOS password. Basically, the trick was to plug the phone into an external keyboard and trying every PIN at once: We reported Friday on Hickey's findings, which claimed to be able to send all combinations of a user's possible...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to privilege escalation

Summary A privilege escalation vulnerability was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-1350 DESCRIPTION: IBM InfoSphere Information Server could allow a user to escalate their privileges to administrator due to improper access controls. CVSS Base...

Security Bulletin: A vulnerability in Eclipse Jetty affects the IBM InfoSphere Information Server installers

Summary A vulnerability in Eclipse Jetty was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-9735 DESCRIPTION: Jetty could allow a remote attacker to obtain sensitive information, caused by a timing channel flaw in util/security/Password.java. By observing...

Security Bulletin: Vulnerability in IBM InfoSphere Information Server installer could expose sensitive information (CVE-2015-7493)

Summary IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information. Vulnerability Details CVEID:CVE-2015-7493 DESCRIPTION: IBM InfoSphere Information Server could allow a local us...

Security Bulletin: IBM InfoSphere Information Governance Catalog is vulnerable to XXE Injection Attack (CVE-2016-0250)

Summary IBM InfoSphere Information Governance Catalog could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on th...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to privilege escalation (CVE-2015-5021)

Summary IBM InfoSphere Information Server could allow an authenticated user of DataStage to view sensitive information or execute jobs even though the user does not have the proper privileges to do so. Vulnerability Details CVEID: CVE-2015-5021 DESCRIPTION: IBM InfoSphere Information Server could...

Security Bulletin: Vulnerability in IBM InfoSphere Information Server installer could expose sensitive information (CVE-2015-1901)

Summary IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information. Vulnerability Details CVE-ID: CVE-2015-1901 DESCRIPTION: IBM InfoSphere Information Server could allow a local...

Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901)

Summary Multiple components of IBM InfoSphere Information Server may be affected by a denial of service attack triggered by a specially crafted XML document being parsed by the XML4C parser. Vulnerability Details CVEID: CVE-2014-8901 DESCRIPTION: IBM XML4J and XML4C contains a denial of service...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to a privilege escalation

Summary IBM InfoSphere Information Server could allow a local user to gain elevated privileges by placing arbitrary files in installation directories. Vulnerability Details CVEID: CVE-2017-1468 DESCRIPTION: IBM InfoSphere Information Server could allow a local user to gain elevated privileges by...

Security Bulletin: A vulnerability in XStream affects IBM InfoSphere Information Governance components

Summary A vulnerability in XStream was addressed by IBM InfoSphere Information Governance Catalog, IBM InfoSphere Information Server Business Glossary, and IBM InfoSphere Information Server Business Glossary Client for Eclipse. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to Cross-Site Scripting (XSS)

Summary IBM InfoSphere Information Server Framework is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context...

Security Bulletin: IBM InfoSphere DataStage is vulnerable to Cross-Frame Scripting issue (CVE-2016-9000)

Summary IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. Vulnerability Details CVEID: CVE-2016-9000 DESCRIPTION: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server (CVE-2016-0475 CVE-2016-0466 CVE-2015-7575 CVE-2016-0448)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin: Privilege escalation vulnerability in IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-3063)

Summary A vulnerability in IBM® InfoSphere® Master Data Management - Collaborative Edition might allow an escalation of privilege attack. Vulnerability Details CVE ID: CVE-2014-3063 Description: IBM® InfoSphere® Master Data Management - Collaborative Edition contains a vulnerability that might...

WhatsApp 2.18.31 - Memory Corruption

WhatsApp 2.18.31 - Memory Corruption !/usr/bin/env python -- coding: utf-8 -- Exploit Author: Juan Sacco at Exploit Pack - http://www.exploitpack.com This vulnerability has been discovered and exploited using Exploit Pack - Framework Tested on: iPhone 5/6s/X iOS 10 and 11.3 Latest release of iOS ...

CVE-2018-4121

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit"...

Apple iOS and macOS High Sierra Mail Man-in-the-Middle Attack Vulnerability

Apple iOS and macOS High Sierra are products of Apple Inc. Apple iOS is an operating system for mobile devices; macOS High Sierra is a specialized operating system for Mac computers. mail is one of the email components. A security vulnerability exists in the Mail component of Apple iOS before 11....

Oracle Solaris Critical Patch Update : apr2018_SRU11_3_27_4_0

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: LDAP Library. Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows low...

Oracle Solaris Critical Patch Update : apr2018_SRU11_3_29_5_0

This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Python modules. The supported version that is affected is 11.3. Difficult to exploit vulnerability allows low...