CVE-2018-1539

CVE-2018-1539 affects IBM Rational Engineering Lifecycle Manager versions 5.0–5.02 and 6.0–6.0.6. The issue allows remote attackers to bypass authentication via a direct request or forced browsing to a URL outside the intended page. Public details in connected IBM advisories describe this as an a...

Security Bulletin: privilege escalation in IBM Business Process Manager (BPM) - CVE-2017-1539

Summary Synchronization between the user registry and the IBM BPM database lead to invalid memberships in case there is an internal group in the IBM BPM database and a group in the user registry with the same name. Vulnerability Details CVEID: CVE-2017-1539 DESCRIPTION: IBM Business Process Manag...

CVE-2017-1539

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807...

CVE-2017-1539

IBM BPM is affected by CVE-2017-1539 for privilege escalation caused by failing to distinguish internal group memberships from user registry group memberships; manipulating LDAP group membership can grant privileged access. Affected versions include BPM 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8...

Oracle Linux 7 : kernel (ELSA-2016-1539)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1539 advisory. - security keys: potential uninitialized variable David Howells 1345935 1341352 CVE-2016-4470 - infiniband security: Restrict use of the write interfac...

CVE-2015-1539

Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493...

CVE-2015-1539

The CVE-2015-1539 issue is a remote-code-execution vulnerability in Android’s libstagefright, caused by integer underflows in ESDS::parseESDescriptor during MP4 atom processing. It affects Android releases prior to 5.1.1 LMY48I; the Android bulletins (e.g., Nexus/Android security bulletin) note t...

Heap overflow

Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to...

CVE-2015-4493

CVE-2015-4493 describes a heap-based buffer overflow in libstagefright’s stagefright::ESDS::parseESDescriptor within Firefox before 40.0 and Firefox ESR 38.x before 38.2, exploitable via an invalid size in an esds chunk of MPEG-4 video data that could allow remote code execution. Connected CVE-20...

Google Android Stagefright MP4 Multiple Atoms Integer Underflow (CVE-2015-1539; CVE-2015-3827)

A remote code execution vulnerability, known as Stagefright Vulnerability, has been reported in Android devices core. The vulnerability is due to an integer underflow condition in multiple MP4 atoms. Successful exploitation would allow an attacker to execute arbitrary code on the target system...

CVE-2015-1539

Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493...

Mozilla Thunderbird clickjacking Vulnerability-01 (Jul 2014) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2014-1539

Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image...

CVE-2014-1539

Technical details for CVE-2014-1539 are not publicly available in the provided documents. Please monitor for official updates or vendor advisories to obtain affected products, impact, and fixes.

CVE-2013-1539

CVE-2013-1539 concerns an unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Software . Affected versions are 2.8.0–3.1.0, 5.0.2–5.0.5, and 5.3.0–5.3.4 . The issue allows remote authenticated users to affect confidentiality via vectors related t...

CVE-2012-1539

Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreePos Use After Free Vulnerability."...

CVE-2012-1539

CVE-2012-1539 is a use-after-free vulnerability in Microsoft Internet Explorer 9 (CTreePos/CTreeNode) that could allow remote code execution via a crafted web page. Technical details across connected sources indicate memory corruption from accessing objects that were not properly initialized or a...

Ubuntu: Security Advisory (USN-1539-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-1539

CVE-2011-1539 affects HP Proliant Support Pack (PSP) prior to version 8.7. The vulnerability is described as an information disclosure vulnerability that allows remote attackers to obtain sensitive data via unknown vectors. Public records show a CVSS v2 base score of 5.0 (Medium) with network att...

CVE-2010-1539

The CVE-2010-1539 entry concerns a Cross-site scripting (XSS) vulnerability in Drupal’s Workflow module when used with the Token module. Affected versions are Workflow 5.x-2.x prior to 5.x-2.6 and 6.x-1.x prior to 6.x-1.4. The issue allows remote authenticated users to inject arbitrary web script...