CVE-2018-20058

CVE-2018-20058 describes a local file path traversal in Evernote for macOS prior to 7.6, affecting the attachment preview feature (MACOSNOTE-28634). The vulnerability path is local file access via the attachment preview, enabling potential leakage of files present on the user’s system. The NVD en...

Security Bulletin: IBM DataPower Gateways is affected by a downgrade vulnerability (CVE-2018-1663)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1663 Vulnerability Details CVEID: CVE-2018-1663 DESCRIPTION: IBM DataPower Gateways could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport...

CVE-2018-1697

CVE-2018-1697 affects IBM Maximo Asset Management 7.6 and possibly related IBM Maximo products when installed on affected core versions. An authenticated user could enumerate usernames by sending a specially crafted HTTP request, leading to information disclosure with a CVSS v3 base score of 4.3 ...

Cross site request forgery (csrf)

IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153118...

CVE-2018-1927

IBM StoredIQ 7.6 is vulnerable to cross-site request forgery (CSRF). Affected versions are 7.6.0.0 to 7.6.0.17. Root cause is CSRF enabling unauthorized actions via trusted user requests. Remediation: upgrade to 7.6.0.17 and apply the interim fix 7.6.0.17-IBMStoredIQ-LinuxX86_64-if001 from Fix Ce...

CVE-2018-1584

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143497...

CVE-2018-1584

CVE-2018-1584 affects IBM Maximo Asset Management 7.6 core. Affected component: Web UI where cross-site scripting (XSS) can be injected, enabling arbitrary JavaScript execution that may lead to credentials disclosure within a trusted session. CVSSv3 base score 5.4 (MEDIUM). IBM’s bulletin lists a...

CentOS 7 : libkdcraw (CESA-2018:3065)

An update for libkdcraw is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CentOS 7 : jasper (CESA-2018:3253)

An update for jasper is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CentOS 7 : wget (CESA-2018:3052)

An update for wget is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

wpa_supplicant security update

CentOS Errata and Security Advisory CESA-2018:3107 An update for wpasupplicant is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

libkdcraw security update

CentOS Errata and Security Advisory CESA-2018:3065 An update for libkdcraw is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

krb5, libkadm5 security update

CentOS Errata and Security Advisory CESA-2018:3071 An update for krb5 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2018:3092 An update for glibc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2018-1872

CVE-2018-1872 affects IBM Maximo Asset Management 7.6, with a cross-site scripting vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The vulnerability is documented across multiple sources (IBM X-For...

Oracle Linux 7 : samba (ELSA-2018-3056)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3056 advisory. - resolves: 1614265 - Fix CVE-2018-1139 - resolves: 1614269 - Fix CVE-2018-10858 Tenable has extracted the preceding description block directly from th...

Oracle Linux 7 : gnutls (ELSA-2018-3050)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3050 advisory. - Improved counter-measures in TLS CBC record padding for lucky13 attack CVE-2018-10844, 1589704, CVE-2018-10845, 1589707 - Added counter-measures for...

Oracle Linux 7 : 389-ds-base (ELSA-2018-3127)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-3127 advisory. - Resolves: Bug 1595766 - CVE-2018-10871 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default Tenable has extracted the...

Oracle Linux 7 : openssl (ELSA-2018-3221)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3221 advisory. - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily - fi...

ovmf security, bug fix, and enhancement update

20180508-3.gitee3198e672e2.el7 - ovmf-redhat-provide-virtual-bundled-OpenSSL-in-OVMF.patch bz1607792 - Resolves: bz1607792 add 'Provides: bundledopenssl = 1.1.0h' to the spec file 20180508-2.gitee3198e672e2 - OvmfPkg/PlatformBootManagerLib: connect consoles unconditionally bz1577546 - build OVMF...