CVE-2017-13987

An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files...

CVE-2017-13986

CVE-2017-13986 is a reflected Cross-Site Scripting (XSS) vulnerability in ArcSight ESM and ArcSight ESM Express . Affected are any 6.x versions prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 . The issue arises from handling a crafted URL, enabling unintended information exposure. According to NVD, the...

CVE-2017-13988

Affected product: ArcSight ESM and ArcSight ESM Express. Vulnerable versions: any 6.x prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. Root cause / impact: improper access control lets unauthorized users alter the maximum size of storage groups and enable/disable the follow schedule function. Exploitab...

CVE-2017-13987

Summary: CVE-2017-13987 concerns HP ArcSight ESM/ESM Express. The vulnerability is an insufficient access control that allows an unauthorized user to download log files. This affects any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. Affected product/limitation: ArcSight ESM and ArcSight ...

CVE-2017-13990

Summary: CVE-2017-13990 describes an information-disclosure vulnerability in HP ArcSight ESM/ESM Express (ArcSight) where any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1 can disclose the Apache Tomcat application server version. Affected products/versions: ArcSight ESM and ArcSight ESM ...

PT-2017-13182

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is related to imprope...

PT-2017-13183

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is related to imprope...

PT-2017-13180

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description A reflected Cross-Site...

PT-2017-13185

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description An information leakage issue...

PT-2017-13181

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description The issue is related to...

PT-2017-13184

Name of the Vulnerable Software and Affected Versions ArcSight ESM versions prior to 6.9.1c Patch 4 ArcSight ESM versions prior to 6.11.0 Patch 1 ArcSight ESM Express versions prior to 6.9.1c Patch 4 ArcSight ESM Express versions prior to 6.11.0 Patch 1 Description An information leakage issue...

jobs.americanexpress.com XSS vulnerability

Vulnerable URL: https://jobs.americanexpress.com/unitedstates?lang=en-US%26quot%3B%26%2339%3B--!%26gt%3B%26lt%3B%2FScript%2F%26gt%3B%26lt%3BSvg%2FOnLoad%3Dconfirm/openbugbounty/%20%2F%2F=footercareers Details: Description| Value ---|--- Patched:| No Latest check for patch:| 24.12.2017 Vulnerabili...

CVE-2017-10997

In all Qualcomm products with Android releases from CAF using the Linux kernel, using a debugfs node, a write to a PCIe register can cause corruption of kernel memory...

Threat Outbreak Alert RuleID30587: Email Messages Distributing Malicious Software on September 13, 2017

Medium Alert ID: 55204 First Published: 2017 September 13 15:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30587 may contain the following files: Name ...

CVE-2015-4085

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

CVE-2015-4085: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1...

PT-2017-6736

Name of the Vulnerable Software and Affected Versions Etherpad frontend tests version 1.6.0 and earlier Description A directory traversal issue exists in the node/hooks/express/tests.js file of the Etherpad frontend tests. Recommendations For versions prior to 1.6.1, update to version 1.6.1 or...

NEC EXPRESS CLUSTER clpwebmc Remote Root Exploit

NEC EXPRESS CLUSTER comes with Cluster Manager, a Java applet for cluster configuration and management. The underlying webserver 'clpwebmc' runs as root and accepts connections on TCP port 29003 which can be initiated without authentication in the default installation. / 2017 update: as of 3.3.4...

CVE-2015-0101

The CVE-2015-0101 issue is an XSS vulnerability in IBM Business Process Manager across Standard, Express, and Advanced lines (versions 7.5.x, 8.0.x, 8.5.x). It stems from insufficient input validation in BPM’s Process Center, allowing a remote attacker to craft a URL that executes script in a vic...

PT-2017-6425

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager Standard versions 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5 IBM Business Process Manager Express versions 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5 IBM Business Process Manager Advance...