Security Bulletin: IBM WebSphere Dashboard Framework is affected by a security vulnerability in Apache POI (CVE-2016-5000)

Summary Apache POI, which is bundled with IBM WebSphere Dashboard Framework, could allow a remote attacker to obtain sensitive information. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache POI, which is used by the spreadsheet integration functionality. CVEID:...

Security Bulletin: Security Vulnerability in Apache Commons FileUpload affects IBM WebSphere Dashboard Framework (CVE-2016-3092 )

Summary Apache Commons FileUpload, which is bundled with IBM WebSphere Dashboard Framework, allows remote attackers to cause a denial of service CPU consumption via a long boundary string. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache Commons FileUpload, whi...

Security Bulletin: Security vulnerabilities have been identified in the versions of IBM WebSphere Application Server Community Edition bundled with WebSphere Dashboard Framework 7.0.1 (CVE-2015-5345) (CVE-2016-0706) (CVE-2016-0714)

Summary IBM WebSphere Application Server Community Edition is bundled as an optional component of WebSphere Dashboard Framework. Information about security vulnerabilities affecting this component have been published. Vulnerability Details CVEID: CVE-2015-5345 DESCRIPTION: Apache Tomcat could all...

Security Bulletin: Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6, affects: WebSphere Dashboard Framework (CVE-2016-3427, CVE-2016-3426, CVE-2016-0264)

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Version 6, that is used by WebSphere Dashboard Framework. These issues were disclosed as part of the IBM Java SDK updates in April 2016. The vulnerabilities may affect some configurations of products...

Security Bulletin: A security vulnerability has been identified in WebSphere MQ Telemetry shipped with WebSphere Remote Server (CVE-2014-4263, CVE-2014-4244, CVE-2015-0410, CVE-2014-6593)

Summary WebSphere MQ Telemetry is shipped as a component of WebSphere Remote Server. Information about a security vulnerability affecting WebSphere MQ Telemetry has been published in a security bulletin. Vulnerability Details For vulnerability details, see the security bulletin Multiple...

ImageMagick Input Validation Vulnerability

ImageMagick is the United States ImageMagick Studio company's set of open source image processing software. A security vulnerability exists in the coders/tiff.c file in ImageMagick prior to version 7.0.1-10. An attacker can exploit this vulnerability to cause a denial of service application crash...

Splunk < 7.0.1 - Information Disclosure Vulnerability

Exploit for linux platform in category web applications Exploit Title: Splunk 7.0.1 - Information Disclosure Exploit Author: KoF2002 Vendor Homepage: https://www.splunk.com/ Version: 6.2.3 - 7.01 MAYBE ALL VERSION AFFECTED Tested on: Linux OS CVE : CVE-2018-11409 Splunk through 6.2.3 7.0.1 allows...

Information disclosure

Splunk through 7.0.1 allows information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key...

Splunk __raw Server Info Disclosure

Splunk 6.2.3 through 7.0.1 allows information disclosure by appending /raw/services/server/info/server-info?outputmode=json to a query. Versisons 6.6.0 through 7.0.1 require authentication. Module Options msf use auxiliary/gather/splunk/rawserverinfo msf undefinedrawserverinfo show actions...

Design/Logic Flaw

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

Kernel update: Virtuozzo ReadyKernel patch 44.0 for Virtuozzo 7.0.1 and 7.0.3

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to Virtuozzo kernels 3.10.0-327.42.0.vz7.18.7 Virtuozzo 7.0.1 and 3.10.0-327.42.0.vz7.20.18 Virtuozzo 7.0.3. Vulnerability id: PSBM-80340 Hard lockups happened when the kernel was processing SAK Secure...

CVE-2017-5004

EMC RSA identity-related products are affected by Stored Cross Site Scripting vulnerabilities: RSA Identity Governance and Lifecycle (version 7.0.1 and 7.0.2 across all patch levels), RSA Via Lifecycle and Governance (version 7.0), and RSA Identity Management and Governance (IMG) (version 6.9.1 a...

Cross-site scripting vulnerability in multiple Peplink Balance products (CNVD-2017-09519)

Peplink Balance 305 and others are multi-exit load balancing routers for medium-sized businesses. A cross-site scripting vulnerability exists in various Peplink Balance products using firmware versions prior to fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. A remote attacker can exploit...

CVE-2017-8840

Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, a...

Important kernel security update: Virtuozzo ReadyKernel patch 18.0 for kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0), 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1), and 3.10.0-327.36.1.vz7.20.18 (Virtuozzo 7.0.3)

The cumulative Virtuozzo ReadyKernel patch updated with security fixes as well as stability bug fixes. The patch applies to Virtuozzo versions 7.0.0, 7.0.1, and 7.0.3. Vulnerability id: CVE-2017-2636 Race condition in drivers/tty/nhdlc.c in the Linux kernel through 4.10.1 allows local users to ga...

Kernel security update: Virtuozzo ReadyKernel patch 17.0 for kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0), 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1), and 3.10.0-327.36.1.vz7.20.18 (Virtuozzo 7.0.3)

The cumulative Virtuozzo ReadyKernel patch updated with a security fix. The patch applies to Virtuozzo versions 7.0.0, 7.0.1, and 7.0.3. Vulnerability id: CVE-2017-7308 The packetsetring function in net/packet/afpacket.c in the Linux kernel through 4.10.6 does not properly validate certain...

Important kernel security update: Virtuozzo ReadyKernel patch 14.0 for kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0), 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1), and 3.10.0-327.36.1.vz7.20.18 (Virtuozzo 7.0.3)

The cumulative Virtuozzo ReadyKernel patch updated with security fixes. The patch applies to Virtuozzo versions 7.0.0, 7.0.1, and 7.0.3. Vulnerability id: CVE-2017-6074 A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB...

Apache TomEE 7.x < 7.0.1 DoS

Binary data 9904.prm...

Infoblox Network Automation HTTP Response Splitting Vulnerability

Infoblox Network Automation is a suite of automated network configuration and change management software from Infoblox USA. An HTTP response splitting vulnerability exists in Infoblox Network Automation versions 7.0.1 and 6.9.2, which can be exploited by an attacker to affect or tamper with web...

Infoblox Network Automation Cross-Site Scripting Vulnerability

Infoblox Network Automation is a suite of automated network configuration and change management software from Infoblox USA. The software has the ability to automate the review and analysis of network changes using built-in expert topics. A cross-site scripting vulnerability exists in Infoblox...