Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt

Summary Oracle Database Server Publicly disclosed vulnerability affects IBM Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2019-2734 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Core RDBMS component could allow an authenticated attacker to...

Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Sourcing

Summary Oracle Database Server Publicly disclosed vulnerability affects IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2019-2734 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Core RDBMS component could allow an authenticated attacker to cause no...

CVE-2020-2875

Removed by vendor...

CVE-2020-2875

CVE-2020-2875 affects MySQL Connector/J (Oracle MySQL Connectors). Affected are Connector/J and MySQL Connectors versions: 8.0.14 and earlier, and 5.1.48 and earlier. The vulnerability is network-facing across multiple protocols and can allow an unauthenticated attacker to perform unauthorized re...

Oracle MySQL Connectors (Apr 2020 CPU)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerabilities as referenced in the April 2020 CPU advisory: - A vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported...

Code injection

The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

Code injection

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2014-10400

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875...

CVE-2014-2875

CVE-2014-2875 refers to the session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2, which uses weak session IDs generated from OS time. This allows remote attackers to hijack arbitrary sessions via brute-force guessing. The issue is documented as a split from CVE-2014-10399 and CVE-2014-10400....

CVE-2014-2875

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID...

CVE-2018-2875

Oracle Database Server CVE-2018-2875 affects the Core RDBMS component in Oracle Database Server and targets 12.2.0.1, 18c, and 19c. A low-privilege attacker with Create Session and network access via OracleNet can read a subset of Core RDBMS data. The vulnerability’s CVSS v3.0 base score is 5.0 (...

openSUSE Security Update : virtualbox (openSUSE-2019-1814)

This update for virtualbox to version 6.0.10 fixes the following issues : Security issues fixed : - CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864 CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848 CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875 CVE-2019-2876 CVE-2019-2850...

openSUSE: Security Advisory for virtualbox (openSUSE-SU-2019:1814-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2019-2875

CVE-2019-2875 affects Oracle VM VirtualBox (Core). Affected: VirtualBox versions prior to 5.2.32 and prior to 6.0.10. The vulnerability is exploitable by a low-privilege, local attacker with logon to the infrastructure running VirtualBox, potentially leading to a partial denial of service against...

CVE-2017-2875

CVE-2017-2875 affects Foscam C1 Indoor HD Camera (firmware 2.52.2.43). The vulnerability resides in the devMng Multi-Camera port 10000 command 0x0002 handling, where lack of bounds checking on the username field can cause a buffer overflow, enabling remote code execution. The described exploit pa...

Security Bulletin: IBM QRadar SIEM is vulnerable to OS command injection. (CVE-2016-2875)

Summary It is possible to inject a payload with OS Commands in QRadar which are run as root on the host OS. Vulnerability Details CVE-ID: CVE-2016-2875 Description: IBM QRadar could allow an authenticated user to inject operating system commands that would be executed with root privileges. CVSS...

CVE-2016-2875

IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspecified vectors...

CVE-2016-2875

CVE-2016-2875 affects IBM QRadar SIEM 7.1.x and 7.2.x up to 7.2.7. An authenticated user can inject and execute operating system commands with root privileges via unspecified vectors. The IBM bulletin confirms the vulnerability class as OS command injection and lists affected versions as 7.1.n an...

Ubuntu 14.04 LTS : libxml2 vulnerabilities (USN-2875-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2875-1 advisory. It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially craft...

CVE-2015-2875

CVE-2015-2875 describes an absolute path traversal in Seagate/LaCie wireless storage firmware prior to 3.4.1.105. A remote attacker with wireless access could read arbitrary files by supplying a full pathname in a download request during a Wi‑Fi session. Affected devices include: Seagate GoFlex S...