Security Bulletin: Ldaptive as used in IBM QRadar SIEM is vulnerable to spoofing (CVE-2014-3607)

Summary Ldaptive as used in IBM QRadar SIEM is vulnerable to spoofing Vulnerability Details CVEID: CVE-2014-3607 DESCRIPTION: Ldaptive could allow a remote attacker to conduct spoofing attack in DefaultHostnameVerifier, caused by the failure to properly verify that the server hostname matches a...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-3607. Reason: This candidate is a reservation duplicate of CVE-2013-3607. Notes: All CVE users should reference CVE-2013-3607 instead of this candidate. All references and descriptions in this candidate have been removed to...

Ubuntu 14.04 LTS / 16.04 LTS : Screen Resolution Extra vulnerability (USN-3607-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3607-1 advisory. It was discovered that Screen Resolution Extra was using PolicyKit in an unsafe manner. A local attacker could potentially exploit this issue to bypas...

CVE-2018-3607

XXXTreeNode method SQL injection remote code execution RCE vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2018-3607

CVE-2018-3607 relates to Trend Micro Control Manager 6.0 with a SQL injection in the XXXTreeNode method that enables remote code execution. ZDI advisories detail specific vulnerable paths (InsertSelectedTreeNodeWithACL, sp_DeleteSelectedTreeNodesByRefKey, ClearSelectedTreeNode) and note that expl...

CVE-2018-3607

XXXTreeNode method SQL injection remote code execution RCE vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-3607

CVE-2014-3607 affects Ldaptive (formerly vt-ldap) and its DefaultHostnameVerifier, which fails to ensure the server hostname matches a domain name in the X.509 certificate’s CN. This allows remote attackers to perform a MITM spoofing attack by using an arbitrary valid certificate. The issue is ob...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3607)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3607 advisory. - l2tp: fix racy SOCKZAPPED flag check in l2tpip,6bind Guillaume Nault Orabug: 26586050 CVE-2016-10200 - xfs: fix two memory leaks in xfsattrlist.c...

CVE-2017-3607

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

CVE-2017-3607

CVE-2017-3607 affects the Data Store component of Oracle Berkeley DB; affected versions are prior to 6.2.32. The vulnerability is exploitable with logon to the infrastructure where Data Store executes and requires user interaction, potentially allowing takeover of the Data Store. CVSS 3.0 base sc...

CVE-2016-3607

CVE-2016-3607 affects Oracle GlassFish Server within Oracle Fusion Middleware 3.0.1 and 3.1.2. Public sources cite remote code execution through the Web Container: a critical issue enabling full compromise of confidentiality, integrity, and availability. VERACODE details describe an RCE path via ...

CVE-2016-3607

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container...

Oracle GlassFish Server 3.1.2.x < 3.1.2.15 Multiple Vulnerabilities (July 2016 CPU)

According to its self-reported version number, the Oracle GlassFish Server running on the remote host is 3.1.2.x prior to 3.1.2.15. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the bundled version of libcurl in the smbrequeststate...

Debian DSA-3607-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140 Ralf Spenneberg...

Oracle: Security Advisory (ELSA-2012-0323)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2012-0128)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...