Security Bulletin: Multiple Vulnerabilities discovered in libraries used by TCRtoolkit in ITNM

Summary Multiple vulnerabilities CVE-2009-4521; CVE-2015-0250; CVE-2017-5662; CVE-2018-8013; CVE-2019-17566; CVE-2020-11987; CVE-2009-4269; CVE-2009-4521; CVE-2009-4521; CVE-2009-4521; CVE-2009-4521; CVE-2009-4521; CVE-2021-41033 found in TCRtoolkit component present in IBM Tivoli Network Manager...

K82851041: TMM vulnerability CVE-2017-6137

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0 HF4, and 12.1.0 through 12.1.2, undisclosed traffic patterns received while software SYN cookie protection i...

K91229003: Side-channel processor vulnerabilities CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754

Security Advisory Description The following three side-channel attacks were publicly disclosed on January 3, 2018: CVE-2017-5715 Spectre-BTB previously known as Spectre Variant 2 Branch target injection Systems with microprocessors utilizing speculative execution and indirect branch prediction ma...

Security Bulletin: Multiple vulnerabilities within Jackson JSON library affect IBM Business Automation Workflow (CVE-2017-17485, CVE-2018-5968, CVE-2018-7489)

Summary Multiple security vulnerabilities have been reported for Jackson JSON library that is used by IBM Business Automation Workflow. Vulnerability Details CVEID: CVE-2018-7489 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused ...

CVE-2017-20161

CVE-2017-20161 affects rofl0r MacGeiger; the vulnerability is in the function dump_wlan_at of macgeiger.c (ESSID Handler). It enables injection under local-network access with high impact on confidentiality, integrity, and availability per sources. A patch is available: patch hash 57f1dd50a4821b8...

CVE-2017-20160

creationtimestamp| type| source ---|---|--- 2022-12-31 22:14:58+00:00| seen| https://t.me/cibsecurity/55676...

CVE-2017-20160

A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0...

CVE-2017-20160

CVE-2017-20160 affects flitto express-param up to 0.x, due to improper handling of extra parameters in lib/fetchParams.js. The issue can be exploited remotely, and upgrading to version 1.0.0 addresses it; the patch is identified as db94f7391ad0a16dcfcba8b9be1af385b25c42db (VDB-217149).

CVE-2017-20158

creationtimestamp| type| source ---|---|--- 2022-12-31 14:15:19+00:00| seen| https://t.me/cibsecurity/55674...

CVE-2017-20159

creationtimestamp| type| source ---|---|--- 2022-12-31 14:14:40+00:00| seen| https://t.me/cibsecurity/55673...

CVE-2017-20158

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The...

CVE-2017-20159

CVE-2017-20159 affects rf Keynote up to 0.x on Rails. The vulnerability is in lib/keynote/rumble.rb, where manipulation of the argument value leads to cross-site scripting. The attack may be launched remotely. Upgrading to version 1.0.0 addresses the issue; patch: 05be4356b0a6ca7de48da926a9b997be...

CVE-2017-20158 vova07 Yii2 FileAPI Widget UploadAction.php run cross site scripting

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The...

CVE-2017-20158

The CVE-2017-20158 entry concerns vova07 Yii2 FileAPI Widget up to 0.1.8. The vulnerability affects the run() function in actions/UploadAction.php, where manipulation of the file parameter enables a Cross-Site Scripting (XSS) vulnerability. It can be exploited remotely. A fix is available in vers...

CVE-2017-20157

Ariadne Component Library (versions up to 2.x) contains a server-side request forgery (SSRF) in an unknown function of src/url/Url.php. The vulnerability is classified as critical and is triggered by manipulated input; impact is documented as SSRF with potential access to internal resources. A fi...

CVE-2017-20156

CVE-2017-20156 affects the Exciting Printer project, specifically the Argument Handler component. The vulnerability targets the file lib/printer/jobs/prepare_page.rb where manipulation of the URL argument enables command injection. Impact is described as critical with an attacker able to execute ...

CVE-2017-20155

CVE-2017-20155 affects Sterc Google Analytics Dashboard for MODX up to 1.0.5. The vulnerability resides in the Internal Search widget: file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl, enabling cross-site scripting. An attacker can exploit it remotely. A fix is avai...

CVE-2017-20155 Sterc Google Analytics Dashboard for MODX Internal Search widget.analytics.tpl cross site scripting

A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal...

CVE-2017-12073

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

CVE-2017-20154

The CVE-2017-20154 issue affects Ghostlander Phoenixcoin (src/main.cpp) in the CTxMemPool::accept function. The vulnerability allows denial of service due to a manipulation in the mempool acceptance logic. Affected versions are prior to 0.6.6.1-pxc; upgrading to 0.6.6.1-pxc addresses the issue (p...