Hardcoded credentials

Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through...

Security Bulletin: IBM Connect:Direct Web Services vulnerable to sensitive information exposure due to PostgreSQL (CVE-2023-2455)

Summary IBM Connect:Direct Web Services has addressed a PostgreSQL vulnerability. Vulnerability Details CVEID:CVE-2023-2455 DESCRIPTION: PostgreSQL could allow a local authenticated attacker to bypass security restrictions, caused by a flaw with row security policies disregard user ID changes aft...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary There is a vulnerability in the Apache Commons FileUpload library used by IBM Sterling Partner Engagement Manager. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting (CVE-2023-23481)

Summary IBM Sterling Partner Engagement Manager has addressed a stored cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2023-23481 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitra...

Security Bulletin: IBM Tivoli Business Service Manager is vulnerable to remote code execution due to Dojo (CVE-2021-23450)

Summary Dojo is shipped with IBM Tivoli Business Manager 6.2.0 as part of its UI framework. Information about security vulnerabilities affecting Dojo has been published in a security bulletin. Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: Dojo could allow a remote attacker to execute...

WordPress Multiple Vulnerabilities (May 2023) - Windows

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

Security Bulletin: IBM Tivoli Business Service Manager is vulnerable to a denial of service attack due to FasterXML Woodstox

Summary FasterXML Woodstox is shipped with IBM Tivoli Business Manager 6.2.0 as part of its XML processor insfrastructure. Information about security vulnerabilities affecting FasterXML Woodstox has been published in a security bulletin. Vulnerability Details CVEID:CVE-2022-40151 DESCRIPTION:...

K06844177: PHP vulnerability CVE-2017-9229

Security Advisory Description An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in leftadjustcharhead during regular expression compilation. Invalid handling of reg-dmax in forwardsearchrange could result...

SUSE CVE-2012-3145

Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0 through 5.3.4, and 6.2.0 allows local users to affect confidentiality, related to BASE...

SUSE CVE-2019-16865

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image...

PT-2024-14721

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.0-rc3-syzkaller-00376-g7c6984405241 Description The issue is related to a deadlock that can occur when using the btrfs file system. Specifically, it happens when the fiemap code triggers a fault while accessi...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to remote code execution due to Apache Commons Text [CVE-2022-42889]

Summary IBM Sterling Partner Engagement Manager has addressed a Publicly disclosed vulnerability that are published by Apache Commons - Collections v3.2.1 CVE-2022-42889 Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execute arbitrary...

CVE-2022-2962 affecting package qemu for versions less than 6.2.0-13

CVE-2022-2962 affecting package qemu for versions less than 6.2.0-13. A patched version of the package is available...

CVE-2021-4207 affecting package qemu for versions less than 6.2.0-13

CVE-2021-4207 affecting package qemu for versions less than 6.2.0-13. A patched version of the package is available...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to spoofing attacks due to WAS Liberty (CVE-2018-25031, CVE-2021-46708)

Summary IBM Sterling Partner Engagement Manager has addressed all vulnerabilities published by WAS liberty below. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, a...

CVE-2022-34335

CVE-2022-34335 affects IBM Sterling Partner Engagement Manager (Standard Edition) versions 6.1.2, 6.2.0, and 6.2.1. An authenticated user can exhaust server resources, leading to a denial of service. The documented impact is availability loss with CVSSv3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/...

CVE-2022-3872 affecting package qemu for versions less than 6.2.0-12

CVE-2022-3872 affecting package qemu for versions less than 6.2.0-12. A patched version of the package is available...

CVE-2022-4144 affecting package qemu for versions less than 6.2.0-12

CVE-2022-4144 affecting package qemu for versions less than 6.2.0-12. A patched version of the package is available...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to denial of service due to CVE-2022-0561

Summary LibTIFF is not used directly by IBM App Connect Enterprise Certified Container but is present in the DesignerAuthoring image used for mapping assistance, which may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability...

CVE-2022-39343 Azure RTOS FileX vulnerable to Buffer Offerflow

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a vali...