Security Bulletin: Vulnerabilities in IBM Java Runtime affect Rational Publishing Engine

Summary There are multiple vulnerabilities in IBM Java Runtime Environment, Versions 7 and 8 that are used by Rational Publishing Engine. Vulnerability Details CVEID: CVE-2018-2663 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit...

Security Bulletin: Vulnerabilities in IBM Java Runtime affects Rational Publishing Engine

Summary There are multiple vulnerabilities in IBM Java Runtime Environment, Versions 7 and 8 that are used by Rational Publishing Engine. Vulnerability Details CVEID: CVE-2017-10295 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit...

Security Bulletin: Multiple Security Vulnerabilities fixed in Java shipped as a component of IBM Security Privileged Identity Manager

Summary There are several Security Vulnerabilities in the Java runtime that are fixed and shipped with IBM Security Privileged Identity Manager. Vulnerability Details CVEID: CVE-2016-5548 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Libraries...

Security Bulletin: OpenSSL vulnerability in IBM Algo Audit and Compliance (CVE-2015-3197)

Summary OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks. OpenSSL is used by IBM Algo Audit and Compliance. Vulnerability Details CVEID: CVE-2015-3197 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by an error related to t...

Security Bulletin: OpenSSL vulnerabilities in IBM Algo Audit and Compliance (CVE-2015-3194, CVE-2015-3195, CVE-2015-3196)

Summary OpenSSL is vulnerable to denial of service attacks and OpenSSL could allow a remote attacker to obtain sensitive information. OpenSSL is used by IBM Algo Audit and Compliance. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a...

PT-2018-16166 · Node · Html-Pages

Name of the Vulnerable Software and Affected Versions: html-pages versions prior to 2.1.0 Description: The issue allows an attacker to read any file from the server, potentially using tools like cURL. This is due to a path traversal vulnerability in the html-pages node module. Recommendations:...

PT-2018-16167 · Node.Js · Atob

Name of the Vulnerable Software and Affected Versions: atob versions 2.0.3 and earlier Description: The issue arises when the atob function allocates uninitialized Buffers upon receiving a number as input on Node.js versions 4.x and below. Recommendations: Update to version 2.1.0 or later...

Path Traversal

Overview Versions of html-pages before 2.1.0 are vulnerable to path traversal. Recommendation Update to version 2.1.0 or later. References - HackerOne Report - GitHub Advisory...

Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

GHSA-HWHH-2FWM-CFGW Doorkeeper is vulnerable to stored XSS and code execution

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...

CVE-2018-5977

SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&pricetype=range&price= request...

Affiligator 2.1.0 - SQL Injection

Affiligator 2.1.0 - SQL Injection Exploit Title: Affiligator - Affiliate Webshop Management System 2.1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: https://www.getaffiligator.com/ Software Link: https://codecanyon.net/item/affiligator-affiliate-webshop-management-system/21214946...

Mautic Load Page Cross-Site Scripting Vulnerability

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in the Mautic loading page in Mautic versions 2.1.0 through 2.11.0. A remote attacker can exploit the...

Next Gen Editor,2.1.0,SQL Injection

Next Gen Editor, 2.1.0, SQL Injection and multiple other vulnerabilities resolution: update to version 2.2.0 update notice: http://nextgeneditor.com/index.php/en/support/forum/installation-issues/3957-new-security-release...

CVE-2017-6679

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Unspecified Vulnerability in Ipsilon

Ipsilon is a server and toolkit for configuring Apache-based service providers to provide federated authentication SSO to web applications with pluggable standalone modwsgi applications. An unspecified vulnerability exists in versions of Ipsilon prior to 2.1.0. No detailed vulnerability details a...

Cisco Umbrella Virtual Appliance 2.0.3 Undocumented Support Tunnel Vulnerability

Cisco Umbrella Virtual Appliance versions 2.0.3 and below contain an undocumented, auto-initiated reverse SSH tunnel which allows the Cisco Umbrella support team to have persistent and unrestricted access to the virtual appliance. Cisco Umbrella Virtual Appliance - Undocumented Support Tunnel...

Denial of service

A vulnerability in the web console of the Cisco Cloud Services Platform CSP 2100 could allow an authenticated, remote attacker to interact maliciously with the services or virtual machines VMs operating remotely on an affected CSP device. The vulnerability is due to weaknesses in the generation o...

Command injection

An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL...

Eclipse Kura Command Execution Vulnerability

Eclipse Kura is an OSGi-based M2M service gateway application framework from the Eclipse Foundation. A security vulnerability exists in versions of Eclipse Kura prior to 2.1.0. An attacker could exploit the vulnerability to log in to the device, execute commands, or take control of the device...