Security Bulletin: HTTP response splitting attack in IBM Application Server on Cloud (CVE-2015-2017)

Summary There is a vulnerability in IBM Application Server on Cloud that could allow an HTTP response splitting attack in Channel. Vulnerability Details CVEID: CVE-2015-2017 DESCRIPTION: The IBM WebSphere Application is vulnerable to HTTP response splitting attacks. A remote attacker could exploi...

Security Bulletin: HTTP response splitting attack in WebSphere Application Server (CVE-2015-2017)

Summary There is a vulnerability in IBM WebSphere Application Server that could allow an HTTP response splitting attack in Channel. Vulnerability Details CVEID: CVE-2015-2017 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker could...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Edge Component Caching Proxy (CVE-2015-5004)

Summary The Edge Component Caching Proxy in IBM WebSphere Application Server could provide weaker than expected security. This is only an issue if you are using the Edge Caching proxy. Vulnerability Details CVEID: CVE-2015-5004 DESCRIPTION: IBM WebSphere Application Server Edge Component Caching...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details The following advisories are included in the IBM® SDK Java™...

Security Bulletin: Various security issues exist in WebSphere Service Registry and Repository version 8.0

Summary This bulletin describes a variety of minor security issues that have been found and fixed in WebSphere Service Registry and Repository version 8.0 Vulnerability Details CVE ID: CVE-2014-6153 DESCRIPTION: WSRR WEBUI ISSUES A COOKIE WHICH IS NOT DECLARED SSL ONLY. CVSS CVSS Base Score: 2.6...

Security Bulletin: Incorrect authorization in IBM Business Process Manager (BPM) Saved Search Admin (CVE-2014-4802)

Summary When you create and run a saved search from the Saved Search Admin tab of the Process Admin Console, the result set might contain tasks or instances that the current user is not authorized to see. Vulnerability Details CVE ID:CVE-2014-4802 DESCRIPTION: IBM Business Process Manager Saved...

Security Bulletin: Multiple vulnerabilities fixed in IBM HTTP Server (APAR PI22070)

Summary IBM HTTP Server is affected by multiple vulnerabilities. Vulnerability Details CVE ID: CVE-2014-0226 Description: The IBM HTTP server is vulnerable to a heap-based buffer overflow, caused by a race condition in the modstatus module when handling the scoreboard. By sending a...

Debian DSA-4220-1 : firefox-esr - security update

Ivan Fratric discovered a buffer overflow in the Skia graphics library used by Firefox, which could result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4220. The text...

CVE-2018-9357

In BNEPWrite of bnepapi.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1...

Quest KACE Systems Management Command Injection

This module exploits a command injection vulnerability in Quest KACE Systems Management Appliance version 8.0.318 and possibly prior. The downloadagentinstaller.php file allows unauthenticated users to execute arbitrary commands as the web server user www. A valid Organization ID is required. The...

Debian DSA-4211-1 : xdg-utils - security update

Gabriel Corona discovered that xdg-utils, a set of tools for desktop environment integration, is vulnerable to argument injection attacks. If the environment variable BROWSER in the victim host has a '%s' and the victim opens a link crafted by an attacker with xdg-open, the malicious party could...

SAP Identity Management XML External Entity Injection Vulnerability

SAP Identity Management is a suite of identity management applications from SAP that can be embedded into business processes. A security vulnerability exists in SAP Identity Management version 8.0, which arises from the program's failure to validate an XML document from an untrusted source. An...

CVE-2018-2417

CVE-2018-2417 affects SAP Identity Management 8.0, where a condition related to the ToASCII pass may enable an attacker to access information that should be restricted. The connected documents confirm the vulnerability as an information-disclosure issue but do not provide concrete technical detai...

Google Android Media framework elevation of privilege vulnerability (CNVD-2018-10695)

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Media framework in Google Android 8.0, which can be exploited by attackers to gain elevation of privilege...

Debian DSA-4193-1 : wordpress - security update

Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions or unsafe redirects. More information can be found in the upstream advisory at...

Debian DSA-4184-1 : sdl-image1.2 - security update

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 1.2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened. C Tenable Network Security, Inc. The descriptive text and package checks in...

CVE-2017-1786

CVE-2017-1786 describes a memory-leak vulnerability in IBM MQ (WebSphere MQ) that under certain conditions could allow an authenticated user to exhaust resources and cause service loss. Affected products and versions include IBM MQ v8 (maintenance 8.0.0.0–8.0.0.8) and IBM MQ v9 LT S (9.0.0.0–9.0....

CVE-2018-2859

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications subcomponent: Portfolio, Attribution. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticate...

CVE-2018-2855

Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications subcomponent: Portfolio, Attribution. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network...

Google Android System (system ui) Denial of Service Vulnerability (CNVD-2018-09466)

Android on Google Pixel and Nexus is an open source Linux-based operating system for Google Pixel and Nexus smartphones developed by Google and the Open Handset Alliance OHA, with System system ui as one of the System system ui is one of the system UI components. A denial of service vulnerability...