Security Bulletin: Server path disclosure pattern is present in IBM Workload Scheduler

Summary Server path disclosure pattern is present in IBM Dynamic Workload Console 9.5 Vulnerability Details CVEID: CVE-2020-4674 DESCRIPTION: IBM Workload Automation stores sensitive information in URLs that could aid in further attacks against the system. CVSS Base score: 4.3 CVSS Temporal Score...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Dovecot vulnerabilities (USN-4674-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4674-1 advisory. It was discovered that Dovecot incorrectly handled certain imap hibernation commands. A remote authenticated attacker could...

Debian DSA-4674-1 : roundcube - security update

It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform either a Cross-Site Request Forgery CSRF forcing an authenticated user to be logged out, or a Cross-Side...

CVE-2019-4674

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 171510...

CVE-2019-4674

CVE-2019-4674 affects IBM Security Identity Manager 7.0.1, where a remote attacker could traverse directories by sending a URL with dot-dot (../) sequences to view arbitrary files. The vulnerability is a directory traversal in ISIM, enabling partial confidentiality impact. IBM’s related advisory ...

CVE-2017-4674

This CVE entry is rejected/not used and does not represent an active vulnerability.

CVE-2016-4674

CVE-2016-4674 is a macOS Sierra/OS X ATS memory corruption vulnerability reported in Apple’s advisory: it allowed a local user to gain privileges or cause a denial of service via memory corruption in the ATS component. Apple addressed this in macOS 10.12.1 / Security Update 2016-002 El Capitan / ...

CVE-2015-4674

The CVE relates to TimeDoctor Pro (Windows) 1.4.72.3, where the autoupdate mechanism relies on unsigned installer files fetched without SSL, enabling potential MITM manipulation to run arbitrary code. This describes a supply-chain/update integrity flaw in the autoupdate component, with the underl...

CVE-2013-4674

Cross-site scripting XSS vulnerability in the Web Email Protection component in Symantec Encryption Management Server formerly Symantec PGP Universal Server before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment...

CVE-2013-4674

CVE-2013-4674 is an XSS vulnerability in Symantec Encryption Management Server (formerly PGP Universal Server), specifically in the Web Email Protection component. The issue affects versions before 3.3.0 MP2 where remote authenticated users could inject arbitrary web script or HTML via a crafted ...

CVE-2012-4674

PluXml before 5.1.6 is vulnerable: remote attackers can obtain the installation path via the PHPSESSID. Root cause is improper handling of PHPSESSID leading to path disclosure. Affected software: PluXml (versions prior to 5.1.6). Impact stated: potential information disclosure of installation pat...

Zabbix < 1.8.9 SQLi Vulnerability

Zabbix is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zabbix:zabbix";...

Fedora Update for zabbix FEDORA-2011-16712

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora 15 : zabbix-1.8.9-1.fc15 (2011-16712)

update to 1.8.9 - upstream changelog at http://www.zabbix.com/rn1.8.9.php Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2011-4674

SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the onlyhostid parameter...

CVE-2011-4674

CVE-2011-4674 is an SQL injection vulnerability in Zabbix popup.php that affects Zabbix 1.8.3/1.8.4 and possibly earlier than 1.8.9. The issue arises via the only_hostid parameter, allowing a remote attacker to execute arbitrary SQL statements (impact: remote code/data exposure). Connected adviso...

CVE-2011-4674

SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the onlyhostid parameter...

CVE-2011-4674

creationtimestamp| type| source ---|---|--- 2011-11-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18155...

CVE-2010-4674

CVE-2010-4674 affects Cisco ASA 5500 series devices running software 8.2(4) and earlier. The vulnerability allows remote attackers to cause a denial of service (block exhaustion) via multicast traffic (Bug ID CSCtg63992). Impact details are conveyed across sources: affected product is ASA 5500 se...

CVE-2009-4674

The CVE-2009-4674 entry affects Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script. The flaw in admin/admin.php allows remote attackers to change an arbitrary password by modifying a user_id field, indicating an authentication/configuration weakness in the user management func...