Debian: Security Advisory (DSA-4359-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Asset Analyzer (RAA) is affected by an Apache CXF vulnerability

Summary Rational Asset Analyzer RAA has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly with com.sun.net.ssl...

ABB M2M ETHERNET

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable from an adjacent network/low skill level to exploit Vendor: ABB Equipment: M2M ETHERNET Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to upload a malicious...

Node.js third-party modules: [webpack-bundle-analyzer] Cross-site Scripting

I would like to report Cross-site Scripting in webpack-bundle-analyzer. It allows injecting and executing arbitray JavaScript code. Module module name: webpack-bundle-analyzer version: 3.0.3 npm page: https://www.npmjs.com/package/webpack-bundle-analyzer Module Description Visualize size of webpa...

SolarWinds NetFlow Traffic Analyzer (NTA) Detection (Windows SMB Login)

SMB login-based detection of SolarWinds NetFlow Traffic Analyzer NTA. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a vulnerability in WAS liberty.

Summary Rational Asset Analyzer RAA has addressed the following vulnerability: Apache Tomcat used by WAS liberty could allow a remote attacker to bypass security restrictions, caused by the use of expression language. An attacker could exploit this vulnerability to bypass the protections of a...

Security Bulletin: A vulnerability in IBM Java Runtime affect Rational Asset Analyzer (RAA).

Summary A vulnerability in IBM® Runtime Environment Java™ Version 8.0.5.15 used by Rational Asset Analyzer. Rational Asset Analyzer has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java...

CVE-2018-19877

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field...

Security Bulletin: There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.5.15 used by Rational Asset Analyzer. Rational Asset Analyzer has addressed the applicable CVEs.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.5.15 used by Rational Asset Analyzer. Rational Asset Analyzer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive...

CVE-2018-12174

Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate privileges via local access...

CVE-2018-12174

Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate privileges via local access...

Heap overflow

Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate privileges via local access...

CVE-2018-12174

Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate privileges via local access...

CVE-2018-12174

Intel Advisory INTEL-SA-00180 confirms CVE-2018-12174 as a heap overflow in Intel® Trace Analyzer 2018 within Intel® Parallel Studio XE 2018 Update 3, potentially enabling an authenticated user to escalate privileges via local access. Affected product line is Intel® Parallel Studio XE 2018 Update...

Intel® Trace Analyzer 2018 Advisory

Summary: A potential security vulnerability in Intel® Trace Analyzer 2018 in Intel® Parallel Studio XE 2018 may allow an authenticated user to escalate privileges via a local vector. Intel is releasing Intel® Parallel Studio XE 2018 updates to mitigate this potential vulnerability. Vulnerability...

The vulnerability of the syntactic analyzer in LQS files of data collection and process automation monitoring tools like LAquis SCADA allows a perpetrator to execute arbitrary code.

The vulnerability of the LQS syntax analyzer in data collection files and in LAquis SCADA, a tool for industrial automation control, is related to the use of pointers. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

[SECURITY] [DSA 4315-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4315-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 12, 2018 https://www.debian.org/security/faq -...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...