Security Bulletin: Potential Information Disclosure in WebSphere Application Server (CVE-2016-9736)

Summary There is a potential information disclosure in WebSphere Application Server using malformed SOAP requests on WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-9736 DESCRIPTION: IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker t...

Security Bulletin: Potential Information Disclosure vulnerability in WebSphere Application Server (CVE-2016-5986)

Summary There is a potential information disclosure in WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-5986 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the...

Security Bulletin: Code execution vulnerability in WebSphere Application Server (CVE-2016-5983).

Summary There is a potential code execution vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a serialized object from untrusted sources. CVSS Bas...

Security Bulletin: Bypass security restrictions in WebSphere Application Server (CVE-2016-0385)

Summary There is a potential bypass security restriction vulnerability in IBM WebSphere Application Server. This will only occur in environments that have the webcontainer custom property HttpSessionIdReuse enabled. Vulnerability Details CVEID: CVE-2016-0385 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: File path traversal vulnerabilities affect IBM PureApplication System (CVE-2014-6158)

Summary File upload functionality within IBM PureApplication System might lead to server compromise and Denial of Service DoS. Vulnerability Details CVEID: CVE-2014-6158 DESCRIPTION: IBM PureApplication System’s file upload functions might lead to server compromise and DoS when authorized users...

Debian DSA-4220-1 : firefox-esr - security update

Ivan Fratric discovered a buffer overflow in the Skia graphics library used by Firefox, which could result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4220. The text...

Debian DSA-4211-1 : xdg-utils - security update

Gabriel Corona discovered that xdg-utils, a set of tools for desktop environment integration, is vulnerable to argument injection attacks. If the environment variable BROWSER in the victim host has a '%s' and the victim opens a link crafted by an attacker with xdg-open, the malicious party could...

Fedora Update for xen FEDORA-2018-98684f429b

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4193-1 : wordpress - security update

Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions or unsafe redirects. More information can be found in the upstream advisory at...

Debian DSA-4184-1 : sdl-image1.2 - security update

Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 1.2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened. C Tenable Network Security, Inc. The descriptive text and package checks in...

CVE-2017-1786

CVE-2017-1786 describes a memory-leak vulnerability in IBM MQ (WebSphere MQ) that under certain conditions could allow an authenticated user to exhaust resources and cause service loss. Affected products and versions include IBM MQ v8 (maintenance 8.0.0.0–8.0.0.8) and IBM MQ v9 LT S (9.0.0.0–9.0....

IBM AppScan Enterprise Edition Cross-Site Scripting Vulnerability

IBM AppScan Enterprise Edition is an IBM system for testing Web and mobile applications for security vulnerabilities and generating reports with recommendations for remediation. A cross-site scripting vulnerability exists in IBM AppScan Enterprise Edition 9.0.2 iFix 001 prior to version 9.0.x. Th...

CVE-2018-1445

IBM WebSphere Portal (versions 8.0.0–8.0.0.1, 8.5, 9.0) is affected by CVE-2018-1445 for a cross-site scripting (XSS) vulnerability caused by improper validation of user-supplied input. An unauthenticated, remote attacker can lure a user to a specially crafted URL to execute arbitrary script in t...

CVE-2015-1952

IBM AppScan Enterprise Edition 9.0.x is affected by a cross-site scripting (XSS) vulnerability tracked as CVE-2015-1952. The flaw exists in 9.0.x before 9.0.2 iFix 001 and allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The issue originates from input valid...

Natus Xltek EEG NeuroWorks SavePatientMontage Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the SavePatientMontage functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in code execution. An attacker can a malicious packet to trigger this vulnerability. Teste...

Debian DSA-4153-1 : firefox-esr - security update

It was discovered that a use-after-free in the compositor of Firefox can result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4153. The text itself is copyright C Softwar...

CVE-2015-9257

BMC Remedy Action Request AR System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS...

CVE-2017-17736

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard...

CVE-2017-17736

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard...

CVE-2018-2366

SAP Business Process Automation BPA By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs...