Microsoft Internet Explorer CVE-2015-0037 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

[SECURITY] Fedora 20 Update: rubygem-passenger-4.0.53-3.fc20

Phusion Passenger=C2=AE is a web server and application server, designed to be fast, robust and lightweight. It takes a lot of complexity out of deploying web a pps, adds powerful enterprise-grade features that are useful in production, and makes administration much easier and less complex. It...

Microsoft Windows CVE-2015-0004 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will result in the complete compromise of affected computers. Technologies Affected Avaya Aura...

Microsoft Windows Kernel 'mrxdav.sys' CVE-2015-0011 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to bypass impersonation security levels and gain elevated privileges on the affected system. Technologies Affected Avaya Aura Conferencing Standard Edition 6.0 Avaya...

Updated resteasy package fix CVE-2014-3490

Updated resteasy packages fixes security vulnerability: It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEa...

IBM WebSphere Application Server Directory Traversal Vulnerability (CNVD-2014-09182)

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. A directory traversal vulnerability in IBM WebSphere Application Server versions 8.0.x prior to 8.0.0.10 and 8.5.x prior to 8.5.5.4 allows remote attackers to read arbitrary...

IBM WebSphere Application Server Clickjacking Vulnerability

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. A clickjacking vulnerability in IBM WebSphere Application Server versions 7.x prior to 7.0.0.37, 8.0.x prior to 8.0.0.10, and 8.5.x prior to 8.5.5.4 allows remote attackers to...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2014-09183)

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. Cross-site scripting vulnerability in IBM WebSphere Application Server versions 7.0.0.37 prior to 7.x, 8.0.0.10 prior to 8.0.x, and 8.5.5.4 prior to 8.5.x allows remote attacke...

CVE-2014-8890

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

CVE-2014-6164

IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL...

Xxe

The Communications Enabled Applications CEA service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entit...

CVE-2014-8890

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

CVE-2014-6164

IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL...

CVE-2014-6164

CVE-2014-6164 (IBM WebSphere Application Server) affects IBM WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4. A remote attacker can spoof OpenID/OpenID Connect cookies via a crafted URL, potentially exposing sensitive information. Affected products/versions are listed in the IBM bulletin; reme...

CVE-2014-8890

CVE-2014-8890 affects IBM WebSphere Application Server Liberty Profile (8.5.x) where a remote attacker can gain elevated privileges when deployment-descriptor security constraints are combined with ServletSecurity annotations. Root cause: improper handling of security configuration in the servlet...

CVE-2014-6167

Cross-site scripting XSS vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6167

CVE-2014-6167 (IBM WebSphere Application Server) is a cross-site scripting vulnerability caused by improper validation of session input via URL rewriting. A remote attacker can inject arbitrary script into a victim’s browser when a crafted URL is processed. Affected products/versions: WebSphere A...

CVE-2014-6174

CVE-2014-6174 affects IBM WebSphere Application Server across multiple lines: 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4. It enables remote attackers to hijack the user’s click actions via a crafted HTTP request (clickjacking). Remediation per connected sources: upgrade ...

CVE-2014-6166

CVE-2014-6166 affects IBM WebSphere Application Server: CEA service XXE vulnerability that could expose sensitive data when processing XML. Affected: WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4; Feature Pack for CEA 1.x before 1.0.0.15. Root cause is XML External E...

SOL15904 - Multiple third-party application-server vulnerabilities

Recommended action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. Supplemental...