Security Bulletin: Multiple vulnerabilities of Apache Groovy (groovy-all-2.3.11.jar) have affected APM JBoss and APM WebLogic Agent [CVE-202-17521, CVE-2016-6814, CVE-2015-3253]

Summary APM JBoss and APM WebLogic Agents are vulnerable to Apache Groovygroovy-all-2.3.11.jar. CVE-2020-17521, CVE-2016-6814, CVE-2015-3253 The fix includes groovy-all-2.3.11.jar upgraded to groovy-all-2.5.21.jar. Vulnerability Details CVEID:CVE-2020-17521 DESCRIPTION: Apache Groovy could allow ...

Security Bulletin: IBM OpenPages for IBM Cloud Pak for Data is Vulnerable to Spring Web Unsafe Deserialization [CVE-2016-1000027]

Summary There is a vulnerability in the Spring Web open source library used by IBM OpenPages for IBM Cloud Pak for Data. This vulnerability has been addressed. CVE-2016-1000027 Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivota Spring Framework could allow a remote attacker to execu...

Security Bulletin: A security vulnerability has been identified in Open SSL, which is shipped with IBM Tivoli Network Manager IP Edition (CVE-2016-0702).

Summary Open SSL is shipped with IBM Tivoli Network Manager IP Edition version 3.9. Information about a security vulnerability affecting Open SSL has been published here. Vulnerability Details CVEID:CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information,...

openSUSE 15 Security Update : guile1, lilypond (openSUSE-SU-2023:0137-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0137-1 advisory. - The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other...

F5 Networks BIG-IP : Bootstrap vulnerability (K000133673)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.3.3 / 14.1.2.4 / 15.1.0 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K000133673 advisory. - In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the...

CVE-2016-2388

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 16:21:14+00:00| seen| https://t.me/arpsyndicate/976 2024-12-24 20:32:28+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971660 2025-02-06 02:42:30+00:00| see...

CVE-2016-4523

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-04 14:41:23+00:00| seen| https://t.me/arpsyndicate/1229 2024-12-24 20:30:37+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971523 2025-02-12 21:07:53+00:00|...

CVE-2016-6367

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:31:15+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971569 2025-02-23 02:10:12+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2026-02-02...

CVE-2016-0162

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:31:20+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971575 2025-02-14 10:00:27+00:00| seen| Telegram/fDe2aaJtAy1Ik6CcR7Ow8xM0rFnIAG6VRaJJP5ZKhOF5P5--...

CVE-2016-3298

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 20:23:29+00:00| seen| https://t.me/arpsyndicate/1020 2024-12-24 20:31:15+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971568 2025-02-14 10:00:28+00:00|...

CVE-2016-2386

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:32:28+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971661 2025-02-06 02:42:30+00:00| seen| Telegram/I28O9wkdgJkLjeMmTeTN9Qi0u0ZHBIZwL7RmOdMTWya76r7...

CVE-2016-8562

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:27:26+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971312 2025-02-23 02:10:12+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2026-02-02...

CVE-2016-15033 Delete All Comments <= 2.0 - Arbitrary File Upload

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...

CVE-2016-15033

CVE-2016-15033 affects the WordPress Delete All Comments plugin (versions up to 2.0). The root cause is missing file type validation in delete-all-comments.php, enabling unauthenticated attackers to upload arbitrary files to the server, with potential remote code execution. Documented impact is a...

Amazon Linux 2 : squid (ALAS-2023-2066)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2066 advisory. Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed...

CVE-2016-15032

CVE-2016-15032 affects the TYPO3 extension mback2k mh_httpbl (versions ≤ 1.1.7). The vulnerability lies in the stopOutput function of class.tx_mhhttpbl.php, where manipulation of $_SERVER['REMOTE_ADDR'] enables cross-site scripting. It can be triggered remotely. The issue is addressed in version ...

CVE-2016-15032 mback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scripting

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as problematic has been found in mback2k mhhttpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.txmhhttpbl.php. The manipulation of the argument $SERVER'REMOTEADDR' leads to cross site scripting. It is...

Important: squid

Issue Overview: Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients. CVE-2016-10003 Affected Packages:...

GHSA-HGV6-W7R3-W4QW Kyverno vulnerable due to usage of insecure cipher

Summary Insecure 3DES ciphers are used which may lead to exploitation of the Sweet32 vulnerability. Specifically, the ciphers TLSECDHERSAWITH3DESEDECBCSHA secp256r1 and TLSRSAWITH3DESEDECBCSHA rsa 2048 are allowed. See CVE-2016-2183. This is fixed in Kyverno v1.9.5 and v1.10.0 and no known users...

Kyverno vulnerable due to usage of insecure cipher

Summary Insecure 3DES ciphers are used which may lead to exploitation of the Sweet32 vulnerability. Specifically, the ciphers TLSECDHERSAWITH3DESEDECBCSHA secp256r1 and TLSRSAWITH3DESEDECBCSHA rsa 2048 are allowed. See CVE-2016-2183. This is fixed in Kyverno v1.9.5 and v1.10.0 and no known users...