CVE-2018-1444

CVE-2018-1444 affects IBM WebSphere Portal 8.5 and 9.0, where a cross-site scripting vulnerability arises from improper validation of user-supplied input. An unauthenticated remote attacker can entice a user to click a crafted URL to execute arbitrary script in the user’s browser, with potential ...

CVE-2018-1437

IBM Notes 8.5 and 9.0 are affected by CVE-2018-1437 due to an error related to untrusted search paths that enables DLL hijacking. This local vulnerability could allow an attacker to execute arbitrary code on the system or cause the application to crash. The issue is tied to the System Diagnostics...

CVE-2018-1435

CVE-2018-1435 affects IBM Notes 8.5 and 9.0. The issue is a DLL hijacking vulnerability that could allow code execution when a user is tricked into opening a malicious executable in a directory under an attacker’s control. Connected sources reiterate IBM Notes DLL loading remote code execution vu...

CVE-2018-1437

IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM...

Debian DSA-4121-1 : gcc-6 - security update

This update doesn't fix a vulnerability in GCC itself, but instead provides support for building retpoline-enabled Linux kernel updates. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4121. The text itself i...

Trend Micro IMSVA Management Portal Authentication Bypass Vulnerability

The Trend Micro InterScan Messaging Security Virtual Appliance IMSVA management portal is vulnerable to an authentication bypass vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Code injection

IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633...

CVE-2017-1720

IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807...

CVE-2017-1720

CVE-2017-1720 affects IBM Notes 8.5 and 9.0, where a local attacker could execute arbitrary commands by crafting a command line sent via Shared Memory IPC. Connected CNVD-2018-03879 describes an elevation of privilege vulnerability in IBM Client Application Access and Notes related to IPC. The NV...

CVE-2017-1711

CVE-2017-1711 affects IBM iNotes 8.5 and 9.0 SUService. The vulnerability arises from the risk of loading a malicious DLL masquerading as a Windows DLL located in the temp directory, potentially allowing code execution. Connected documents reiterate the same issue and reference IBM X-Force ID 134...

Code injection

IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions that only an admin should be performing, so there is risk that someone not authorized can change things that they are not suppose to. IBM...

CVE-2018-1368

IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions that only an admin should be performing, so there is risk that someone not authorized can change things that they are not suppose to. IBM...

CVE-2018-1368

IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions that only an admin should be performing, so there is risk that someone not authorized can change things that they are not suppose to. IBM...

CVE-2017-15706

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a...

Debian DSA-4098-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-1000005 Zhouyihai Ding discovered an out-of-bounds read in the code handling HTTP/2 trailers. This issue doesn't affect the oldstable distribution jessie. - CVE-2018-1000007 Craig de Stigter discovered that...

Debian DSA-4094-1 : smarty3 - security update

It was discovered that Smarty, a PHP template engine, was vulnerable to code-injection attacks. An attacker was able to craft a filename in comments that could lead to arbitrary code execution on the host running Smarty. C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-4092-1 : awstats - security update

The cPanel Security Team discovered that awstats, a log file analyzer, was vulnerable to path traversal attacks. A remote unauthenticated attacker could leverage that to perform arbitrary code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-4093-1 : openocd - security update

Josef Gajdusek discovered that OpenOCD, a JTAG debugger for ARM and MIPS, was vulnerable to Cross Protocol Scripting attacks. An attacker could craft a HTML page that, when visited by a victim running OpenOCD, could execute arbitrary commands on the victims host. This fix also sets the OpenOCD...

glibc 'realpath()' Privilege Escalation

This module attempts to gain root privileges on Linux systems by abusing a vulnerability in GNU C Library glibc version 2.26 and prior. This module uses halfdog's RationalLove exploit to exploit a buffer underflow in glibc realpath and create a SUID root shell. The exploit has offsets for glibc...

Oracle AgileExpress v9.0 - Privilege Escalation Vulnerability

Document Title: =============== Oracle AgileExpress v9.0 - Privilege Escalation Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2114 Release Date: ============= 2018-01-16 Vulnerability Laboratory ID VL-ID:...