CVE-2017-1654: Exposure of Sensitive Information to an Unauthorized Actor

IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements. IBM X-Force ID: 133378...

CVE-2018-2606

Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications subcomponent: Base. Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitalit...

CVE-2017-1336

CVE-2017-1336 affects IBM BigInsights 4.2 (and IBM Open Platform 4.2). The description in the connected IBM bulletin and NVD entry states a remote code injection vulnerability that could allow an attacker to inject code and access restricted data and files. Root cause is a vulnerability in the Te...

CVE-2017-1554

IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

Cross site scripting

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...

Cross site scripting

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 13139...

CVE-2017-1553

IBM Infosphere BigInsights exposes a cross‑site scripting vulnerability (CVE-2017-1553) in Web UI affecting versions 4.2.0 and 4.2.5. The issue allows embedding arbitrary JavaScript in the UI, potentially leading to credentials disclosure within a trusted session. Public details in connected sour...

CVE-2017-1554

IBM Infosphere BigInsights 4.2.0 and 4.2.5 are affected by CVE-2017-1554, a UI vulnerability where a remote attacker could hijack a victim’s click actions by enticing them to visit a malicious Web site. The issue is described as a click/action hijack that could enable further attacks within the v...

CVE-2017-1553: Improper Neutralization of Input During Web Page Generation

IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 13139...

CVE-2017-10372

Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications subcomponent: Base. Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

Subrion CMS Cross-Site Request Forgery Vulnerability

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a variety of extensions plug-ins and more. A cross-site request forgery vulnerability exists in Subrion CMS versions prior to 4.2.0 that stems from a...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-1591

The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges...

DEBIAN-CVE-2015-1591

The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges...

Pivotal Spring Security Deserialization Remote Code Execution Vulnerability

Pivotal Spring Security is a suite of security frameworks from Pivotal Software that provide illustrative security protection for Spring-based applications. A remote code execution vulnerability exists in Pivotal Spring Security versions 4.2.0 through 4.2.2 and 5.0.0.M1. A remote attacker could...

Information disclosure

OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information...

UBUNTU-CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

CVE-2017-6429

Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet...

Pivotal Spring Security Security Bypass Vulnerability

Pivotal Software Spring Security is a suite of security frameworks from Pivotal Software, Inc. that provide illustrative security protection for Spring-based applications. A security bypass vulnerability exists in Spring Security versions 3.2.0 - 3.2.9, 4.0.x - 4.1.3 and 4.2.0. An attacker can...

Mezzanine 4.2.0 - Cross-Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Mezzanine 4.2.0 Fixed in: 4.2.1 Fixed Version Link: https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1 Vendor Website: http://mezzanine.jupo.org/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor:...