Security Bulletin: Cacheable HTTPS Response vulnerability affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition (CVE-2019-4461)

Summary IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise has identified and addressed the Cacheable HTTPS Response vulnerability. Vulnerability Details CVEID: CVE-2019-4461 DESCRIPTION: IBM Cloud Orchestrator is vulnerable to HTTP Response Splitting caused by improper caching of...

Debian DSA-4461-1 : zookeeper - security update

Harrison Neil discovered that the getACL command in Zookeeper, a service for maintaining configuration information, did not validate permissions, which could result in information disclosure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

CVE-2018-4461

CVE-2018-4461 is a memory corruption issue that affects Apple platforms prior to updated versions (iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2). Root cause: improper input validation leading to memory corruption. Impact and exploit details in the provided documents indicate a hig...

Apple Xcode Arbitrary Code Execution Vulnerability (HT209606)

Apple Xcode is prone to an arbitrary code execution vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:xcode";...

About the security content of Xcode 10.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

About the security content of Xcode 10.2

About the security content of Xcode 10.2 This document describes the security content of Xcode 10.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

About the security content of watchOS 5.1.2

About the security content of watchOS 5.1.2 This document describes the security content of watchOS 5.1.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

Deja-XNU

Posted by Ian Beer, Google Project Zero This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2. State of the art An idea I've wanted to play with for a while is to revisit old...

Security Bulletin: Vulnerability in Apache Struts affects the IBM FlashSystem models 840 and 900

Summary There is a vulnerability in Apache Struts to which the IBM® FlashSystem™ 840 and FlashSystem™ 900 are susceptible. An exploit of this vulnerability CVE-2016-4461 could allow an attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2016-4461 DESCRIPTION: Apache...

Security Bulletin: Vulnerability in Apache Struts affects the IBM FlashSystem model V840

Summary There is a vulnerability in Apache Struts to which the IBM® FlashSystem™ V840 is susceptible. An exploit of this vulnerability CVE-2016-4461 could allow an attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2016-4461 DESCRIPTION: Apache Struts could allow a...

CVE-2017-4461

...

CVE-2017-4461

CVE-2017-4461 is rejected/not used and does not represent an active vulnerability entry.

eFront CMS 3.6.15.4 Multiple Vulnerabilities

eFront CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only Info: There is an EOL detection for this produ...

CVE-2015-4461

Absolute path traversal in Epignosis/ eFront CMS 3.6.15.4 and earlier allows remote access to sensitive information via the other parameter. Affected component is the application’s path handling, enabling exposure of full pathnames. Documents consistently describe the vulnerability as a path trav...

Sql injection

Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'productid' to addtocart.php, a different vulnerability than CVE-2008-4461...

CVE-2016-4461

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785...

CVE-2016-4461

CVE-2016-4461: Apache Struts vulnerability causing remote code execution via forced double OGNL evaluation. IBM/security bulletins show affected IBM FlashSystem products (V840, V900, Storwize/SAN volumes) with vulnerable VRMFs and the need to upgrade to fixed code levels. IBM Bulletins list affec...

scamadviser.com XSS vulnerability

Vulnerable URL: http://www.scamadviser.com/check-website/%22%20onmouseover=alert%28/XSSPOSED/%29%20%22?abc== Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4461 Google Pagerank| 3 VIP website status:| Yes Check...

Oracle: Security Advisory (ELSA-2013-2503)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2013-0223)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...