CVE-2020-10703

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools li...

Red Hat libvirt code issue vulnerability

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. It supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. A code issue vulnerability exists in Red Hat libvirt 6.0.0...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Apache Traffic Server (ATS) Multiple HTTP Request Smuggling Vulnerabilities

Apache Traffic Server is prone to multiple HTTP request smuggling vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Traffic Server Environment Issue Vulnerability

Apache Traffic Server ATS is the United States Apache Apache Software Foundation's set of scalable HTTP proxy and caching server. An environmental issue vulnerability exists in Apache Traffic Server versions 6.0.0 through 6.2.3, 7.0.0 through 7.1.8, and 8.0.0 through 8.0.5. An attacker can exploi...

CVE-2019-20485

qemu/qemudriver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service API blockage...

CVE-2019-4451

IBM Security Identity Manager (ISIM) 6.0.0 is affected by CVE-2019-4451, a cross-site scripting vulnerability in the Web UI that could lead to credentials disclosure within a trusted session. The IBM Security bulletin confirms the vulnerability and lists the affected product/version. Remediation ...

PT-2020-6312 · Libvirt +8 · Libvirt +8

Name of the Vulnerable Software and Affected Versions: libvirt versions 3.10.0 through 5.x Description: A NULL pointer dereference was found in the libvirt API for fetching a storage pool based on its target path. This flaw affects storage pools created without a target path, such as network-base...

Apache Solr 6.0.0 < 6.6.5 Remote Code Execution

In Apache Solr versions 5.0.0 5.5.5 and 6.0.0 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker may take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. Note that t...

Cross site scripting

An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack XSS via a parameter of the logon page...

CVE-2019-19151

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell tmsh privileges are able access object...

Security Bulletin: A security vulnerability has been fixed in the IBM Security Identity Manager product (CVE-2019-4561)

Summary A security vulnerability has been fixed in IBM Security Identity Manager 6.0.0 Vulnerability Details CVEID: CVE-2019-4561 DESCRIPTION: CVSS Base score: 8 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166456 for the current score. CVSS Vector:...

IBM Security Identity Manager Arbitrary Code Execution Vulnerability

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

CVE-2019-4561

CVE-2019-4561 affects IBM Security Identity Manager (ISIM) versions 6.0.0 and 6.0.2. The root cause is deserialization of untrusted data, enabling a remote attacker to execute arbitrary code when a user visits a crafted Web site. CVSS v3 base score is 8.0–8.8 (HIGH). IBM indicates ISIM 6.0.0.22-I...

Couchbase Server Authorization Issues Vulnerability (CNVD-2019-34123)

Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . An authorization issue vulnerability exists in Couchbase Server versions 6.0.0 and...

F5 BIG-IQ Centralized Management Cross-Site Scripting Vulnerability

F5 BIG-IQ Centralized Management is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. A cross-site scripting vulnerability in...

CVE-2019-11495

In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remot...

CVE-2019-11466

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access...

Totemomail Cross-Site Scripting Vulnerability

totemomail is an email encryption solution. A cross-site scripting vulnerability exists in the 'Authorization Service' feature in totemomail version 6.0.0 build 570, which can be exploited by an attacker to execute client-side code...