Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS vulnerability.

Summary Rational Asset Analyzer RAA has addressed the following vulnerability in WAS. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that...

CVE-2014-4860

Multiple integer overflows in the Pre-EFI Initialization PEI boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase...

CVE-2014-4859

Integer overflow in the Drive Execution Environment DXE phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data...

CVE-2014-4859

Integer overflow in the Drive Execution Environment DXE phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data...

CVE-2014-4859

CVE-2014-4859 is an integer overflow in the Drive Execution Environment (DXE) capsule processing of the UEFI Capsule Update mechanism in the open-source EDK2 UEFI implementation; CVE-2014-4860 covers overflow in the PEI phase during capsule coalescing. Impact: potential bypass of access restricti...

CVE-2014-4860

CVE-2014-4860 is an integer overflow vulnerability in the Pre-EFI Initialization (PEI) capsule update coalescing phase of the UEFI/EDK2 implementation. The issue arises when the capsule update is coalesced back to its original form, enabling a write-what-where condition and potential bypass of ac...

CVE-2014-3719

CVE-2014-3719 describes multiple SQL injection vulnerabilities in the Ex Libris ALEPH 500 system (Integrated Library Management System), affecting versions 18.1 and 20. The flaw resides in the CGI script cgi-bin/review_m.cgi and can be triggered via the find, lib, or sid parameters to cause execu...

CVE-2014-3718

CVE-2014-3718 affects Ex Libris ALEPH 500 (Integrated library management system) where multiple XSS vulnerabilities exist in the CGI script cgi-bin/tag_m.cgi. The affected components are the web interface parameters (1) find, (2) lib, and (3) sid, enabling remote attackers to inject arbitrary web...

CVE-2014-3445

creationtimestamp| type| source ---|---|--- 2020-01-28 19:37:44+00:00| exploited| https://t.me/cveNotify/516...

CVE-2014-2581

creationtimestamp| type| source ---|---|--- 2020-01-28 19:37:43+00:00| seen| https://t.me/cveNotify/515...

CVE-2014-8490

CVE-2014-8490 is a Cross-Site Scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927. The issue allows an attacker to inject arbitrary web script or HTML through the pid parameter to index.cfm, as documented in the NVD entry. Public write-ups (PacketStorm) provide an example exploit titl...

CVE-2014-3230

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the 1 HTTPSCADIR or 2 HTTPSCAFILE environment variable...

CVE-2014-3856

The funced function in fish aka fish-shell 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name...

CVE-2014-2906

The psub function in fish aka fish-shell 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name...

CVE-2014-3856

The funced function in fish aka fish-shell 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name...

CVE-2014-2898

wolfSSL CyaSSL before 2.9.4 is affected by an out-of-bounds read in CyaSSL_read triggered when an error occurs, due to not checking the return code and MAC verification failure. Vulnerable component: CyaSSL_read (wolfSSL/CyaSSL). Impact: remote attackers could cause unspecified effects; the CVE n...

CVE-2014-2897

The CVE-2014-2897 issue affects wolfSSL/CyaSSL 2.5.0 prior to 2.9.4 where the SSL 3 HMAC padding length is not checked on verification, enabling a remote attacker to trigger an out-of-bounds read via a crafted HMAC. This is a network-accessible vulnerability with potential confidentiality, integr...

CVE-2014-2897

The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attackers to have unspecified impact via a crafted HMAC, which triggers an out-of-bounds read...

CVE-2014-2896

The DoAlert function in the 1 TLS and 2 DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and vectors, which trigger memory corruption or an out-of-bounds read...

CVE-2014-2896

The DoAlert function in wolfSSL/CyaSSL TLS and DTLS implementations is affected by CVE-2014-2896 prior to version 2.9.4. The vulnerability allows remote attackers to trigger memory corruption or an out-of-bounds read over the network, with the impact described as unspecified in the primary entry....