Title Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Identity Governance and Intelligence 5.2

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version1.7 that is used by Identity Governance and Intelligence 5.2. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin: Vulnerabilities in Open Source glibc affect IBM Security Identity Governance (CVE-2014-8121)

Summary Vulnerabilities in Open Source glibc that is used by IBM Security Identity Governance. GNU C Library glibc is vulnerable to a denial of service, caused by the failure to properly check if a file is open by DBLOOKUP in nssfiles/files-XXX.c in the Name Service Switch NSS. By performing a...

Security Bulletin: Vulnerabilities in Kerberos (krb5) affect IBM Security Network Protection (CVE-2014-5352, CVE-2014-5353, CVE-2014-5355, CVE-2014-9421, and CVE-2014-9422)

Summary IBM Security Network Protection uses Kerberos krb5 to provide network authentication. The Kerberos krb5 version that is shipped with IBM Security Network Protection contains multiple security vulnerabilities. Vulnerability Details CVE-ID: CVE-2014-5352 Description: MIT krb5 could allow a...

Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Protection (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 )

Summary The unzip utility is used to list, test, or extract files from a zip archive. Security vulnerabilities have been discovered in unzip used with IBM Security Network Protection. Vulnerability Details CVE ID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a heap-based buffer...

Security Bulletin: IBM Security Network Protection is vulnerable to Cross-Site Scripting. (CVE-2014-6189)

Summary IBM Security Network Protection contains a Cross-Site Scripting vulnerability. Vulnerability Details CVEID:CVE-2014-6189 DESCRIPTION: IBM Security Network Protection is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploi...

Security Bulletin: IBM Sterling B2B Integrator is affected by Click jacking vulnerability (CVE-2015-4992)

Summary A Click jacking also known as a "UI redress attack" vulnerability has been discovered in IBM Sterling B2B Integrator. Vulnerability Details CVEID: CVE-2015-4992 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to hijack the clicking action of the...

Security Bulletin: Vulnerability found in IBM Sterling B2B Integrator (CVE-2014-6099)

Summary IBM Sterling B2B Integrator is affected by a security vulnerability in the Change Password screens which could result in a brute force attack. Vulnerability Details CVEID:CVE-2014-6099 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition allows for an attacker to attempt login reques...

Fortinet FortiGate <= 5.2.x / 5.4.x < 5.4.9 / 5.6.x < 5.6.3 Multiple Vulnerabilities (FG-IR-17-231, FG-IR-17-245 and FG-IR-17-172)

The remote host is running FortiOS 5.2.x or prior, 5.4.x prior to 5.4.9, or 5.6.x prior to 5.6.3. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid110415; scriptversion"1.9";...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 5.2 (RHSA-2018:1607)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1607 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a...

ILIAS Cross-Site Scripting Vulnerability (CNVD-2018-10348)

ILIAS is a Web-based learning management system developed by the ILIAS team. The system contains modules for course management, file sharing, and live chat. ILIAS version 5.3.x before 5.3.4 and version 5.2.x have Services/Form/classes/class.ilDateDurationInputGUI.php and...

CVE-2018-10307

error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception...

CVE-2018-11119

ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the returntourl parameter...

NagiosXI <= 5.4.12 info.php SQL injection(CVE-2018-10736)

NagiosXI = 5.4.12 info.php SQL injectionCVE-2018-10736 Description A SQL injection issue was discovered in Nagios XI via the admin/info.php key1 parameter. Affected Version Nagios XI 5.2.x Nagios XI 5.4.x before 5.4.13 Proof of concept...

CVE-2018-8736

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root...

CVE-2018-8736

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root...

CVE-2018-8735

Remote command execution RCE vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection...

Synology DiskStation Manager Directory Traversal Vulnerability

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology. The operating system manages information such as data, files, photos, music and more. A directory traversal vulnerability exists in SYNO.FileStation.Extract in Synology DSM versions 6.0.x...

CVE-2017-1481

CVE-2017-1481 affects IBM Sterling B2B Integrator Standard Edition 5.2. The IBM Security Bulletin confirms an information-disclosure vulnerability where a user can view sensitive information belonging to another user. The CVSS base score is low-to-moderate (3.1 base on the IBM bulletin, with CVSS...

CVE-2017-15889

Command injection vulnerability in smart.cgi in Synology DiskStation Manager DSM before 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via disk field...

Synology StorageManager smart.cgi Remote Command Execution

Vulnerability Summary The following advisory describes a remote command execution vulnerability found in Synology StorageManager. Storage Manager is “a management application that helps you organize and monitor the storage capacity on your Synology NAS. Depending on the model and number of...