Security Bulletin: A security vulnerability has been identified in the WebSphere Application Server where the Rational Asset Manager is deployed (CVE-2018-1777,CVE-2018-1767,CVE-2014-7810, and CVE-2018-1567)

Summary In the WebSphere Application Server Admin console where the Rational Asset Manager is deployed, a potential Cross-site scripting, Security bypass and Code execution vulnerabilities are observed. Information about these security vulnerabilities affecting WebSphere Application Server have...

Security Bulletin: WAS traditional and liberty vulnerable to CVE-2014-7810 affects IBM Spectrum LSF Application Center

Summary WAS traditional and liberty vulnerable to CVE-2014-7810 affects IBM Spectrum LSF Application Center. Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use of expression language. An attacker...

GHSA-FWX5-5FQJ-JV98 Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

Security Bulletin: A vulnerability in IBM WebSphere Application Server and WebSphere Liberty affects IBM Operations Analytics Predictive Insights (CVE-2014-7810)

Summary There is a vulnerability in IBM WebSphere Application Server and WebSphere Liberty that are used by IBM Operations Analytics Predictive Insights 1.3.6 and earlier versions. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. This issue was also addressed by IBM...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Case Manager (CVE-2014-7810)

Summary IBM WebSphere Application Server is shipped as a component of IBM Case Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...

CVE-2018-16253

CVE-2018-16253 describes a flaw in axTLS 2.1.3 and earlier where PKCS#1 v1.5 signature verification in sig_verify() of x509.c does not properly verify ASN.1 metadata, enabling a remote attacker to forge signatures under small public exponents and impersonate via fake X.509 certificates. The issue...

Oracle Linux 7 : zsh (ELSA-2018-3073)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3073 advisory. - fix defects detected by Coverity related to CVE-2017-18206 and CVE-2018-1083 - fix stack-based buffer overflow in utils.c:checkmailpath CVE-2018-1100...

GHSA-R3VR-PRWV-86G9 python-gnupg's shell_quote function does not properly quote strings

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

python-gnupg's shell_quote function does not properly quote strings

The shellquote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$" command-substitution sequences, a different vulnerability than CVE-2014-1928...

CVE-2014-9772

creationtimestamp| type| source ---|---|--- 2018-11-06 23:12:49+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-79mx-88w7-8f7q...

CVE-2014-10077

creationtimestamp| type| source ---|---|--- 2018-11-06 19:23:35+00:00| seen| https://t.me/cibsecurity/1069...

CVE-2014-10077

Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...

CVE-2014-10077

Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...

CVE-2014-10077

CVE-2014-10077 – i18n gem (Ruby): The vulnerability is in Hash#slice implemented in lib/i18n/core_ext/hash.rb, affecting i18n before 0.8.0. A remote attacker can trigger a denial of service (application crash) when a key (:some_key) is present in keep_keys but absent from the hash. This is due to...

CVE-2014-10077

Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...

CVE-2014-10077

Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...

CVE-2014-10077

Hashslice in lib/i18n/coreext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service application crash via a call in a situation where :somekey is present in keepkeys but not present in the hash...

lighttpd < 1.4.35 Multiple Vulnerabilities

According to its banner, the version of lighttpd running on the remote host is prior to 1.4.35. It is, therefore, affected by the following vulnerabilities : - A SQL injection flaw exists in the 'modmysqlvhost' module where user input passed using the hostname is not properly sanitized. A remote...

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud

Summary There is a potential bypass security vulnerability in the expression language library used by WebSphere Application Server CVE-2014-7810. Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use ...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2014-7810)

Summary IBM WebSphere Application Server is shipped with IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin, Security Bulletin:...