katello SQL Injection vulnerability

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via Yaml.load in YamlProvider. Mitigation: If the YamlProvider is enabled it's recommended to add authentication, and authorization to the endpoint expectin...

Improper Access Control in Apache Tomcat

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...

Apache Tomcat Improper Access Control vulnerability

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency...

katello SQL Injection vulnerability

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

USN-5407-1: Cairo vulnerabilities

Gustavo Grieco, Alberto Garcia, Francisco Oca, Suleman Ali, and others discovered that Cairo incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. CVE-2016-9082, CVE-2017-9814, CVE-2019-6462 Stephan Bergmann discovered that Cairo incorrectly...

SUSE: Security Advisory (SUSE-SU-2022:1565-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NewStart CGSL CORE 5.04 / MAIN 5.04 : libxml2 Vulnerability (NS-SA-2022-0015)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libxml2 packages installed that are affected by a vulnerability: - xpointer.c in libxml2 before 2.9.5 as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products does not forb...

SUSE SLED12 / SLES12 Security Update : libwmf (SUSE-SU-2022:1560-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1560-1 advisory. libwmf was updated to 0.2.12: upstream changed to fork from Fedora: https://github.com/caolanm/libwmf merged a...

USN-4797-1: LibASS vulnerabilities

It was discovered that LibASS incorrectly handled certain ASS files. A remote attacker could possibly use this issue to cause a denial of service. One of the issues, CVE-2016-7970, only affected Ubuntu 16.04 ESM. CVE-2016-7969, CVE-2016-7970, CVE-2016-7972 It was discovered that LibASS incorrectl...

SUSE-SU-2022:1516-1 Security update for libwmf

This update for libwmf fixes the following issues: libwmf was updated to 0.2.12: upstream changed to fork from Fedora: https://github.com/caolanm/libwmf merged all the pending fixes merge in fixes for libgd CVE-2019-6978 bsc1123522 fixed memory allocation failure CVE-2016-9011 Fixes for %libexecd...

IBM Java 6.0 < 6.0.16.25 / 6.1 < 6.1.8.25 / 7.0 < 7.0.9.40 / 7.1 < 7.1.3.40 / 8.0 < 8.0.3.0 Multiple Vulnerabilities (Apr 1, 2016)

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.25 / 6.1 6.1.8.25 / 7.0 7.0.9.40 / 7.1 7.1.3.40 / 8.0 8.0.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update April 2016 advisory. - Buffer overflow in the Java Virtual...

IBM Java 6.0 < 6.0.16.30 / 6.1 < 6.1.8.30 / 7.0 < 7.0.9.50 / 7.1 < 7.1.3.50 / 8.0 < 8.0.3.10 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.30 / 6.1 6.1.8.30 / 7.0 7.0.9.50 / 7.1 7.1.3.50 / 8.0 8.0.3.10. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 19 2016 CPU advisory. - Unspecified vulnerability in Oracle Java SE...

IBM Java 6.0 < 6.0.16.41 / 6.1 < 6.1.8.41 / 7.0 < 7.0.10.1 / 7.1 < 7.1.4.1 / 8.0 < 8.0.4.1 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.41 / 6.1 6.1.8.41 / 7.0 7.0.10.1 / 7.1 7.1.4.1 / 8.0 8.0.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 17 2017 CPU advisory. - The DES and Triple DES ciphers, as used in t...

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to a Insecure JSF ViewState found in MDM User Interface (CVE-2016-9714)

Summary IBM InfoSphere Master Data Management is vulnerable to a Insecure JSF ViewState found in MDM Busines Admin User Interface which could allow an attacker to execute malicious and unauthorized actions. Vulnerability Details CVEID: CVE-2016-9714 DESCRIPTION: IBM InfoSphere Master Data...

Security Bulletin: Denial of service vulnerability in OpenSSL affects IBM InfoSphere Master Data Management (CVE-2016-8610)

Summary IBM Initiate Master Data Service and IBM InfoSphere Master Data Management are vulnerable to a OpenSSL denial of service attack and could cause the application to stop responding. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: SSL/TLS protocol is vulnerable to a denial of service...

Security Bulletin: Vulnerability in OpenSSL affects IBM InfoSphere Master Data Management (CVE-2016-2842)

Summary This bulletin addresses CVE-2016-2842 for IBM InfoSphere Master Data Management. Vulnerability Details OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Master Data Management. IBM InfoSphere Master Data Management addressed...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server shipped with IBM InfoSphere Master Data Management Server (CVE-2016-2108 CVE-2016-2107 CVE-2016-2105 CVE-2016-2106 CVE-2016-2109 CVE-2016-2176)

Summary IBM WebSphere Application Server is shipped as a component of IBM InfoSphere Master Data Management Server . Information about a security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bullet...

Security Bulletin: Multiple vulnerabilities in OpenSSL affects IBM InfoSphere Master Data Management

Summary IBM Initiate Master Data Service and IBM InfoSphere Master Data Management are vulnerable to multiple OpenSSL denial of service attacks and could allow access to sensitive information. Vulnerability Details CVEID: CVE-2016-2177 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...

Security Bulletin: Security vulnerability in Apache affects IBM InfoSphere Master Data Management (CVE-2016-1000031)

Summary IBM InfoSphere Master Data Management is vulnerable to a Novell NetIQ Sentinel issue and could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVE-ID: CVE-2016-1000031 DESCRIPTION: Novell NetIQ Sentinel could allow a remote attacker to execute...