Security Bulletin: A vulnerability in NetworkManager affects PowerKVM

Summary PowerKVM is affected by a vulnerability in NetworkManager. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-0764 DESCRIPTION: Red Hat NetworkManager could allow a local attacker to obtain sensitive information, caused by a race condition vulnerability that...

Security Bulletin: Vulnerabilities in postgresql affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in postgresql. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-5423 DESCRIPTION: PostgreSQL is vulnerable to a denial of service. By sending specially crafted SQL statements containing CASE/WHEN commands, a remote...

Security Bulletin: A vulnerability in nettle affects PowerKVM

Summary PowerKVM is affected by a vulnerability in nettle. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-6489 DESCRIPTION: Nettle could allow a remote attacker to obtain sensitive information, caused by a cache-related side channel attack in the RSA and DSA...

Security Bulletin: A vulnerability in wget affects PowerKVM

Summary PowerKVM is affected by a vulnerability in wget. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-4971 DESCRIPTION: GNU wget could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted HTTP redirect message...

Security Bulletin: A vulnerability in nss-util affects PowerKVM (CVE-2016-1950)

Summary PowerKVM is affected by a vulnerability in nss-util. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2016-1950 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when the Network Security Services NSS libraries...

Security Bulletin: Vulnerability in Net-SNMP affects PowerKVM (CVE-2014-3565)

Summary PowerKVM is affected by a vulnerability in Net-SNMP. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2014-3565 DESCRIPTION: Net-SNMP is vulnerable to a denial of service, caused by the improper handling of SNMP traps when started with the "-OQ" option. By sending an SNMP...

Security Bulletin: Vulnerability in netcf affects PowerKVM (CVE-2014-8119)

Summary PowerKVM is affected by a vulnerability in netcf. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2014-8119 DESCRIPTION: The netcfg package in Linux is vulnerable to a denial of service, caused by the improper processing of XPath expressions by the findifcfgpath function...

Security Bulletin: Vulnerability in Linux Kernel affects PowerKVM (CVE-2016-0728)

Summary A Linux Kernel privilege escalation vulnerability affects PowerKVM. Vulnerability Details CVEID: CVE-2016-0728 DESCRIPTION: Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a use-after-free in the joinsessionkeyring function in...

Security Bulletin: Vulnerability in rpcbind affects PowerKVM (CVE-2015-7236)

Summary A denial of service vulnerability in rpcbind CVE-2015-7236 affects PowerKVM. Vulnerability Details CVEID: CVE-2015-7236 DESCRIPTION: rpcbind is vulnerable to a denial of service, caused by a use-after-free in PMAPCALLIT. By sending specially crafted packets, a remote attacker could exploi...

Security Bulletin: A security vulnerability identified in IBM WebSphere Application Server affecting IBM Tivoli Storage Manager FastBack Reporting (CVE-2015-2017)

Summary IBM Tivoli Storage Manager FastBack Reporting requires the dependent product IBM WebSphere Application Server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bullet...

Security Bulletin: InfoSphere Streams is affected by libxml2 vulnerability (CVE-2014-0191)

Summary The Open Source libxml2 library is shipped with InfoSphere Streams. A denial of service vulnerability has been discovered in libxml2. Vulnerability Details CVE-ID: CVE-2014-0191 Description: Libxml2 is vulnerable to a denial of service attack. A remote attacker could exploit this...

Security Bulletin: Vulnerabilities in Open Source GNU glibc affect IBM Workload Deployer (CVE-2014-9761, CVE-2015-8778, CVE-2015-8779)

Summary Vulnerabilities in Open Source GNU glibc affect IWD Workload Deployer. Vulnerability Details CVEID: CVE-2014-9761 DESCRIPTION: GNU C Library glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the nan function. By sending an overly long string, a...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Workload Deployer (CVE-2016-2105, CVE-2016-2106, CVE-2016-2108, CVE-2016-2109)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM Workload Deployer. IBM Workload Deployer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2105 DESCRIPTION: OpenSSL is vulnerable to a heap-based buffer overflow,...

OECMS Cross-Site Scripting Vulnerability

OEcms is an enterprise content management system CMS. A cross-site scripting vulnerability exists in the 'mod' parameter of the info.php file in OEcms version 3.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2018-12090

There is unauthenticated reflected cross-site scripting XSS in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change...

IBM Security Guardium Big Data Intelligence Information Disclosure Vulnerability (CNVD-2018-16540)

IBM Security Guardium is the comprehensive data security platform. An information disclosure vulnerability exists in IBM Security Guardium Big Data Intelligence SonarG version 3.1. It allows an attacker to gain access to data related to the environment, users, and more...

Cross site scripting

IBM Security Guardium Big Data Intelligence SonarG 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-For...

CVE-2018-1370

IBM Security Guardium Big Data Intelligence SonarG 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769...

CVE-2018-1376

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting in the Web UI, potentially allowing an attacker to embed arbitrary JavaScript and lead to credentials disclosure within a trusted session. The CVE is identified as CVE-2018-1376 with a CVSS v3 base scor...

[SECURITY] Fedora 27 Update: mosquitto-1.4.15-1.fc27

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...