Security Bulletin: IBM MQ Appliance potential execution of arbitrary commands (CVE-2016-5879)

Summary There is potential for malicious users to execute arbitrary commands due to improper validation of the input parameters. Vulnerability Details CVEID: CVE-2016-5879 DESCRIPTION: IBM MQ Appliance could allow a local attacker to execute arbitrary commands on the system, caused by improper...

CVE-2017-5879

CVE-2017-5879 affects Exponent CMS 2.4.1. The issue is a blind SQL injection in the file/source_selector.php, targeting the src parameter, that can be exploited by unauthenticated users via an HTTP GET request and may allow dumping of database data to a malicious server using an out-of-band techn...

CVE-2016-5879

IBM MQ Appliance (M2000 and M2001) is affected by CVE-2016-5879 where MQCLI input to Disaster Recovery and High Availability commands is improperly validated, enabling a local attacker to inject and execute arbitrary shell commands. Impact is local, with potential for full command execution and d...

CVE-2016-5879

MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted 1 Disaster Recovery or 2 High Availability command...

CVE-2015-5879

CVE-2015-5879 affects Apple iOS XNU kernel prior to iOS 9, where TCP header validation could be bypassed, enabling remote DoS through crafted headers. The issue is tied to XNU TCP header validation and was addressed via improved TCP packet header validation. Impact per sources is a TCP connection...

CVE-2014-5879

The tvguide aka kenneth.tvguide application 1.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5879

The tvguide (Kenneth.tvguide) Android app 1.9.14 does not verify X.509 certificates from SSL servers, enabling MITM attacks to spoof servers and obtain sensitive information via a crafted certificate. According to the NVD entry, impact includes partial confidentiality, integrity, and availability...

CVE-2013-5879

CVE-2013-5879 concerns an unspecified vulnerability in the Oracle Outside In Technology Outside In Maintenance component within Oracle Fusion Middleware 8.4.0/8.4.1. The vulnerability could allow a denial of service or, potentially, remote code execution on server installations. The reported CVSS...

McAfee Virtual Technician ActiveX Control Insecure Method Exposure (CVE-2012-5879)

An insecure method exposure vulnerability has been reported in McAfee Virtual Technician...

McAfee Virtual Technician (MVT) 6.5.0.2101 - Insecure ActiveX Method

Advisory ID: HTB23128 Product: McAfee Virtual Technician MVT 6.5.0.2101 Vendor: McAfee Vulnerable Versions: 6.5.0.2101 and probably prior Tested Version: 6.5.0.2101 on Windows 7 SP1 and Internet Explorer 9 Vendor Notification: November 19, 2012 Vendor Patch: March 15, 2013 Public Disclosure: Marc...

McAfee Virtual Technician (MVT) 6.5.0.2101 - Insecure ActiveX Method

McAfee Virtual Technician MVT 6.5.0.2101 - Insecure ActiveX Method Advisory ID: HTB23128 Product: McAfee Virtual Technician MVT 6.5.0.2101 Vendor: McAfee Vulnerable Versions: 6.5.0.2101 and probably prior Tested Version: 6.5.0.2101 on Windows 7 SP1 and Internet Explorer 9 Vendor Notification:...

CVE-2012-5879

Summary: CVE-2012-5879 affects McAfee Virtual Technician (MVT) and ePO-MVT prior to remediation, via the ActiveX control in McHealthCheck.dll. The insecure Save() method on McHealthCheck.dll can cause remote attackers to modify or create arbitrary files using a full pathname argument, potentially...

McAfee Virtual Technician (MVT) 6.5.0.2101 Unsafe Active-X

Advisory ID: HTB23128 Product: McAfee Virtual Technician MVT 6.5.0.2101 Vendor: McAfee Vulnerable Versions: 6.5.0.2101 and probably prior Tested Version: 6.5.0.2101 on Windows 7 SP1 and Internet Explorer 9 Vendor Notification: November 19, 2012 Vendor Patch: March 15, 2013 Public Disclosure: Marc...

CVE-2008-5879

The CVE-2008-5879 entry describes a Cross-site scripting (XSS) vulnerability in Phpclanwebsite (PCW) 1.23.3 Fix Pack 5 and earlier, exploitable via the page parameter and other unspecified vectors. Affected product is Phpclanwebsite/PCW (version 1.23.3 Fix Pack 5 and earlier). The underlying issu...

CVE-2008-5879

Cross-site scripting XSS vulnerability in index.php in Phpclanwebsite aka PCW 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors...

CVE-2008-5879

creationtimestamp| type| source ---|---|--- 2008-12-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/7515...

CVE-2006-5879

CVE-2006-5879: SQL injection in ASPPortal 4.0.0 beta and earlier via Poll_ID parameter in default1.asp (remote command execution). Exploitation details are documented in the NVD/CVE records; no remediation details are provided here. The entry is linked to CVE-2006-1353 as a separate vector.

CVE-2006-5879

SQL injection vulnerability in default1.asp in ASPPortal 4.0.0 beta and earlier allows remote attackers to execute arbitrary SQL commands via the PollID parameter, a different vector than CVE-2006-1353...