Security Bulletin: Vulnerability in Zlib affects IBM Integrated Analytics System [CVE-2018-25032]

Summary Redhat provided Zlib is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE CVE-2018-25032 Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate...

CVE-2018-6556

creationtimestamp| type| source ---|---|--- 2023-01-01 12:15:46+00:00| seen| https://t.me/cibsecurity/55723...

CVE-2018-25063

creationtimestamp| type| source ---|---|--- 2023-01-01 12:15:44+00:00| seen| https://t.me/cibsecurity/55721...

CVE-2018-25062

A vulnerability classified as problematic has been found in flar2 ElementalX up to 6.x on Nexus 9. Affected is the function xfrmdumppolicydone of the file net/xfrm/xfrmuser.c of the component ipsec. The manipulation leads to denial of service. Upgrading to version 7.00 is able to address this...

CVE-2018-25063

The CVE-2018-25063 issue affects Zenoss Dashboard up to version 1.3.4, caused by an XSS vulnerability in ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js where manipulating the HTMLString argument enables cross-site scripting. The vulnerability can be triggered remotely. Remediat...

CVE-2018-25062

CVE-2018-25062 affects flar2 ElementalX up to 6.x on Nexus 9. The issue is in the ipsec component, specifically the function xfrm_dump_policy_done in net/xfrm/xfrm_user.c, whose manipulation can cause a denial of service. A fix is available: upgrade to ElementalX 7.00 (patch 1df72c9f0f61304437f4f...

Path traversal

lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates...

CVE-2018-25061

creationtimestamp| type| source ---|---|--- 2022-12-31 23:38:32+00:00| seen| https://t.me/cibsecurity/55678...

svg-sketch-pdf (>=1.0.12, <=1.0.28) potentially affected by CVE-2018-25061 via rgb2hex (0.1.0)

rgb2hex NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on rgb2hex and may be impacted: - svg-sketch-pdf =1.0.12, =1.0.28 Source cves: CVE-2018-25061 Source advisory: OSV:GHSA-7599-FQGM-V84P...

CVE-2018-25061

CVE-2018-25061 affects rgb2hex up to 0.1.5, where an inefficient regular-expression pattern leads to a ReDoS risk. The vulnerability reportedly allows remote initiation and is addressed by upgrading to version 0.1.6. The patch is identified as 9e0c38594432edfa64136fdf7bb651835e17c34f. Multiple so...

Security Bulletin: IBM Tivoli Monitoring Basic Services is vulnerable to a denial of service attack in zlib component (CVE-2018-25032)

Summary Fixes a vulnerability reported in the zlib that is used by IBM Tivoli Monitoring for historical data collection CVE-2018-25032. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By usi...

CVE-2018-25060

creationtimestamp| type| source ---|---|--- 2022-12-30 14:14:12+00:00| seen| https://t.me/cibsecurity/55560...

CVE-2018-25059

creationtimestamp| type| source ---|---|--- 2022-12-30 14:14:01+00:00| seen| https://t.me/cibsecurity/55552...

CVE-2018-25060

CVE-2018-25060 affects the Macaron csrf component (go-macaron/csrf) via the csrf.go Generate path. Affects cookies created by Generate: the Secure attribute is not applied, allowing cookies to be sent over non-SSL connections. The vulnerability can be exploited remotely; the attack complexity is ...

CVE-2018-25059

CVE-2018-25059 affects pastebinit up to 0.2.2. The vulnerability is in the pasteHandler function of server.go, where modifying the r.URL.Path enables path traversal. A fix is available in pastebinit 0.2.3, with patch 1af2facb6d95976c532b7f8f82747d454a092272. Advises upgrading the affected compone...

CISA Warns of Active exploitation of JasperReports Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added two years-old security flaws impacting TIBCO Software's JasperReports product to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The flaws, tracked as CVE-2018-5430 CVSS score: 7.7 an...

Huawei EulerOS: Security Advisory for mariadb-connector-c (EulerOS-SA-2022-2937)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for mariadb-connector-c (EulerOS-SA-2022-2911)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-25058

creationtimestamp| type| source ---|---|--- 2022-12-29 12:12:59+00:00| seen| https://t.me/cibsecurity/55520...

CVE-2018-25058

The CVE-2018-25058 issue affects Twitter-Post-Fetcher up to version 17.x, specifically the js/twitterFetcher.js component of the Link Target Handler. The vulnerability enables a web link to an untrusted target via window.opener access and can be triggered remotely. A fix is available in version 1...