1374 matches found
Security Bulletin: IBM Security Guardium is affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS (CVE-2016-2183)
Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the in the Triple-DES on 64-bit block cipher, used as a part of the SSL/TLS protocol. This vulnerability is known as the SWEET32 Birthday attack. IBM Security Guardium has fixed this vulnerability...
Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Missing HTTP Strict-Transport-Security Header vulnerability (CVE-2016-0240)
Summary IBM Security Guardium Database Activity Monitor does not force the HTTP Strict-Transport-Security Header. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID: CVE-2016-0240 DESCRIPTION: IBM Security Guardium Database...
Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Improper Authentication Vulnerability (CVE-2016-0241)
Summary IBM Security Guardium Database Activity Monitor could allow a local attacker to bypass security authorization and masquerade as the administrator by manipulating the HTTP login request. Vulnerability Details CVEID: CVE-2016-0241 DESCRIPTION: IBM Security Guardium Database Activity Monitor...
Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Guardium
Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Security Guardium. IBM Security Guardium has addressed the applicable CVEs including the “DROWN: Decrypting RSA with Obsolete and Weakened eNcryption" vulnerability. Vulnerability Detail...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Guardium (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931)
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, that is used by IBM Security Guardium. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability and Java SE...
Security Bulletin: Vulnerability in Apache Commons FileUpload affects IBM Forms Server (CVE-2016-3092 )
Summary An Apache Commons FileUpload vulnerability for handling string edge case was addressed by IBM Forms Server. Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending...
Security Bulletin: IBM Forms Viewer Installation could allow a remote attacker to execute arbitrary code on the system (CVE-2016-2542)
Summary IBM Forms Viewer Installation could allow a remote attacker to execute arbitrary code on the system. If you have recently downloaded a copy of IBM Forms Viewer, use the information below to correct the vulnerability prior to installing the product. If you have already installed IBM...
Oracle WebCenter (Fatwire) 7.x Cross Site Scripting
Application: Oracle WebCenter Sites FatWire Content Server Versions Affected: 7.x 11gR1 Vendor URL: http://oracle.com Bugs: Multiple XSS Oracle WebCenter Sites FatWire Content Server 7.x 11gR1 Sent: 18.12.2017 Reported: 18.12.2017 Date of Public Advisory: 14.04.2018 Reference: Oracle Security Not...
Drupal Drupalgeddon 2 Forms API Property Injection Exploit
This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source:...
Intel 2G Modem
1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION : Exploitable remotely Vendor : Intel Equipment : Intel 2G Modem Vulnerability : Buffer Overflow 2. RISK EVALUATION Successful exploitation of this buffer overflow vulnerability may allow remote code execution. The vulnerability affects Intel 2G modem...
Directory traversal
An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...
CVE-2018-9309
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...
Sql injection
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...
CVE-2018-9309
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...
PT-2018-18966 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in a "dl/dl sendsms.php" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "dl/dl sendsms.php" request until the issue is...
CVE-2018-8968
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
Code injection
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...
Sql injection
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...
Directory traversal
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...
