PHP 'FFI::cast()' Memory Leak Denial of Service Vulnerability

Description PHP is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial of service condition. Versions prior to PHP 7.4.0 are vulnerable. Technologies Affected PHP PHP 7.3.0 PHP PHP 7.3.1 PHP PHP 7.3.10 PHP PHP 7.3.11 PHP PHP 7.3.12 PHP PHP 7.3.2 PHP PHP...

PHP 'Closure::bindTo' Memory Corruption Vulnerability

Description PHP is prone to a a memory-corruption vulnerability. Successful exploits may allow the attacker to cause denial-of-service condition. Versions prior to PHP 7.4.0 are vulnerable. Technologies Affected PHP PHP 7.3.0 PHP PHP 7.3.1 PHP PHP 7.3.10 PHP PHP 7.3.11 PHP PHP 7.3.2 PHP PHP 7.3.3...

PHP 'new COM()' Denial of Service Vulnerability

Description PHP is prone to a denial-of-service vulnerability. Successful exploits may allow the attacker to crash the affected application resulting in denial-of-service condition. Versions prior to PHP 7.4.0 are vulnerable. Technologies Affected PHP PHP 7.3.0 PHP PHP 7.3.1 PHP PHP 7.3.2 PHP PHP...

PHP 'unserialize()' Stack Buffer Overflow Vulnerability

Description PHP is prone to a remote stack-based buffer-overflow because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploit this issue to cause a denial-of-service condition. Due to the nature of this issue, code...

Apple Security Update: Apple TV Software 7.3.1

Apple recommends to install security update Apple TV Software 7.3.1 on devices Apple TV 3rd generation...

Security Bulletin: IBM QRadar SIEM is vulnerable to Cross-Site Scripting (CVE-2018-2021)

Summary IBM QRadar SIEM could allow users to embed code in the UI that may lead to Cross-Site Scripting. Vulnerability Details CVEID: CVE-2018-2021 Description: IBM QRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Important: Red Hat Security Advisory: Red Hat Fuse 7.3.1 security update

A micro version update from 7.3 to 7.3.1 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...

CVE-2019-6977

gdImageColorMatch in gdcolormatch.c in the GD Graphics Library aka LibGD 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigg...

CVE-2019-6977

gdImageColorMatch in gdcolormatch.c in the GD Graphics Library aka LibGD 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigg...

Internet Bug Bounty: Use after free and out of bounds read in xmlrpc_decode()

Malformed input can lead to use after free and out of bounds memory errors. This has been fixed with the latest updates of PHP 7.1.26/7.2.14/7.3.1. Note: I reported those as separate bugs to PHP, but they had the same underlying bug and were fixed by the same commit. The release notes only mentio...

Security Bulletin: Public disclosed vulnerability from Apache Tika

Summary Public disclosed vulnerability from Apache Tika Vulnerability Details CVEID: CVE-2018-1338 Description: Apache Tika is vulnerable to a denial of service, caused by an error in BPGParser. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability ...

Security Bulletin: IBM QRadar SIEM is vulnerable to Cross-Site Scripting (CVE-2018-1728)

Summary The product allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality and allowing spoofing attacks. Vulnerability Details CVEID: CVE-2018-1728 Description: IBM QRadar is vulnerable to cross-site scripting. This vulnerability allows users to...

Command injection

'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially...

There is a XML external entity expansion (XXE) vulnerability in Apache Solr config files

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion XXE in Solr config files solrconfig.xml, schema.xml, managed-schema. In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability...

Security Bulletin: A security vulnerability has been identified in embedded IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2015-7450)

Summary Embedded Websphere Application Server eWAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about a security vulnerability affecting eWAS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Vulnerability in Apache...

Security Bulletin: A security vulnerability has been identified in embedded IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2015-2017)

Summary Embedded Websphere Application Server eWAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about a security vulnerability affecting eWAS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: HTTP...

Security Bulletin:ClassLoader manipulation with Apache Struts affecting IBM Tivoli Netcool/OMNIbus_GUI (CVE-2014-0114)

Summary There is a ClassLoader manipulation vulnerability in Apache Struts that is used by IBM Tivoli Netcool/OMNIbusGUI Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts 1.X could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restri...

Security Bulletin: IBM QRadar SIEM contains vulnerable components and libraries. (CVE-2011-4314)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2011-4314 DESCRIPTION: OpenID4Java could allow a remote attacker to bypass security restrictions, caused by the improper...

Security Bulletin: IBM QRadar Incident Forensics, as found in IBM QRadar SIEM, is vulnerable to an authentication bypass leading to remote command injection. (CVE-2018-1418)

Summary An authentication bypass leading to remote command injection has been found in IBM QRadar Incident Forensics. Vulnerability Details CVEID: CVE-2018-1418 DESCRIPTION: IBM QRadar Incident Forensics could allow a user to bypass authentication which could lead to code execution. CVSS Base...

Security Bulletin:IBM QRadar SIEM is vulnerable to command injection. (CVE-2017-1696)

Summary The product passes unsafe user supplied data forms, cookies, HTTP headers etc. to a system shell. This allows attackers to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2017-1696 DESCRIPTION: IBM QRadar could allow a remote authenticated attacker to execute...