Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details The following advisories are included in the IBM® SDK Java™...

Security Bulletin: Various security issues exist in WebSphere Service Registry and Repository version 8.5

Summary This bulletin describes a variety of noncritical security issues that have been found and fixed in WebSphere Service Registry and Repository version 8.5. Vulnerability Details CVE ID: CVE-2014-6153 DESCRIPTION: WSRR WEBUI ISSUES A COOKIE WHICH IS NOT DECLARED SSL ONLY. CVSS CVSS Base Scor...

Security Bulletin: Incorrect authorization in IBM Business Process Manager (BPM) Saved Search Admin (CVE-2014-4802)

Summary When you create and run a saved search from the Saved Search Admin tab of the Process Admin Console, the result set might contain tasks or instances that the current user is not authorized to see. Vulnerability Details CVE ID:CVE-2014-4802 DESCRIPTION: IBM Business Process Manager Saved...

Security Bulletin: Multiple vulnerabilities fixed in IBM HTTP Server (APAR PI22070)

Summary IBM HTTP Server is affected by multiple vulnerabilities. Vulnerability Details CVE ID: CVE-2014-0226 Description: The IBM HTTP server is vulnerable to a heap-based buffer overflow, caused by a race condition in the modstatus module when handling the scoreboard. By sending a...

Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.2

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.5.5.2 Vulnerability Details CVE ID: CVE-2013-4039 PM84760 DESCRIPTION: WebSphere Application Server for Compute Grid could allow a remote attacker to obtain sensitive information and exploit this...

Natus Xltek NeuroWorks

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Natus Medical, Inc. Natus Equipment: Natus Xltek NeuroWorks software Vulnerabilities: Stack-Based Buffer Overflow, Out-of-Bounds Read 2. RISK EVALUATION Successful exploitation of these...

Twonky Server < 8.5.1 Multiple XSS Vulnerabilities

Twonky Server is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Improper access control

IBM WebSphere Application Server WAS 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362...

CVE-2018-2834

Vulnerability in the Oracle Data Visualization Desktop component of Oracle Fusion Middleware subcomponent: Security. The supported version that is affected is 12.2.4.1.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Data...

CVE-2018-1445

IBM WebSphere Portal (versions 8.0.0–8.0.0.1, 8.5, 9.0) is affected by CVE-2018-1445 for a cross-site scripting (XSS) vulnerability caused by improper validation of user-supplied input. An unauthenticated, remote attacker can lure a user to a specially crafted URL to execute arbitrary script in t...

Drupal 8.5.x < 8.5.1 RCE

Binary data 700230.prm...

CVE-2018-1444

CVE-2018-1444 affects IBM WebSphere Portal 8.5 and 9.0, where a cross-site scripting vulnerability arises from improper validation of user-supplied input. An unauthenticated remote attacker can entice a user to click a crafted URL to execute arbitrary script in the user’s browser, with potential ...

CVE-2018-1437

IBM Notes 8.5 and 9.0 are affected by CVE-2018-1437 due to an error related to untrusted search paths that enables DLL hijacking. This local vulnerability could allow an attacker to execute arbitrary code on the system or cause the application to crash. The issue is tied to the System Diagnostics...

CVE-2018-1437

IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM...

CVE-2018-1435

CVE-2018-1435 affects IBM Notes 8.5 and 9.0. The issue is a DLL hijacking vulnerability that could allow code execution when a user is tricked into opening a malicious executable in a directory under an attacker’s control. Connected sources reiterate IBM Notes DLL loading remote code execution vu...

CVE-2016-0369

IBM Forms Experience Builder versions 8.5, 8.5.1 and 8.6 are affected by an XML External Entity (XXE) processing vulnerability. The root cause is XXE when processing XML data, which could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3 base score is 2.7 (LOW). R...

CVE-2017-1720

IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807...

Code injection

IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633...

CVE-2017-1720

CVE-2017-1720 affects IBM Notes 8.5 and 9.0, where a local attacker could execute arbitrary commands by crafting a command line sent via Shared Memory IPC. Connected CNVD-2018-03879 describes an elevation of privilege vulnerability in IBM Client Application Access and Notes related to IPC. The NV...

CVE-2017-1711

CVE-2017-1711 affects IBM iNotes 8.5 and 9.0 SUService. The vulnerability arises from the risk of loading a malicious DLL masquerading as a Windows DLL located in the temp directory, potentially allowing code execution. Connected documents reiterate the same issue and reference IBM X-Force ID 134...