Security Bulletin: A security vulnerability in IBM Liberty affects IBM Algo One Algo Risk Application (ARA) CVE-2017-1681

Summary A security vulnerability in IBM Liberty affects IBM Algo One Algo Risk Application ARA CVE-2017-1681 Vulnerability Details CVEID: CVE-2017-1681 DESCRIPTION: IBM WebSphere Application Server IBM Liberty for Java for Bluemix 3.15 could allow a local attacker to obtain sensitive information,...

CVE-2018-3714

node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path...

XXE Zeroday Vulnerability in HP PPM

Intro: XXE Zeroday Vulnerability in HP PPM Researchers at Rhino Security Labs discovered an XXE vulnerability in the way HP Project and Portfolio Management Center HP PPM processed imported tickets. Specifically, an XML external entity injection vulnerability allows an attacker to exploit the...

CVE-2017-14101

A security researcher found an XML External Entity XXE vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable...

CVE-2017-14101

A security researcher found an XML External Entity XXE vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable...

Xxe

A security researcher found an XML External Entity XXE vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable...

CVE-2017-14101

A security researcher found an XML External Entity XXE vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable...

CVE-2017-14101

Affected product/brand: Change Healthcare Conserus Image Repository archive solution (version 2.1.1.105). Vulnerability type: XML External Entity (XXE) injection. Root cause / vector: Unauthenticated user can send a modified HTTP SOAP request to the vulnerable service to trigger XXE behavior. Imp...

CVE-2017-14947

Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access Violation on Block Data Move starting at mupdfnet64!mIncrementalSaveFile+0x0000000000193359."...

Design/Logic Flaw

In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image0000000000400000+0x000000000001b596."...

CVE-2017-9926

In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image0000000000400000+0x000000000001b596."...

CVE-2017-9833

CVE-2017-9833 affects BOA Web Server 0.94.14rc21, enabling arbitrary file read via path traversal through the FILECAMERA parameter in /cgi-bin/wapopen. Exploitation reads files with root privileges without credentials. Affected component: BOA Web Server; root cause: improper handling of FILECAMER...

CVE-2015-5019

IBM Sterling Integrator 5.1 before 50100048 and Sterling B2B Integrator 5.2 before 50205009 allow remote authenticated users to read or upload files by leveraging a password-change requirement...

NetIQ Access Manager Directory Traversal Vulnerability

NetIQ Access Manager is a solution for controlling access to resources from American NetIQ. A directory traversal vulnerability in HF3, version 4.x prior to NetIQ Access Manager 4.0.1, allows remotely authenticated novlwww users to read arbitrary files via external entity declarations containing...

PT-2012-2104

Name of the Vulnerable Software and Affected Versions Blue Coat ProxySG versions 6.1 before 6.1.5.1 Blue Coat ProxySG versions 6.2 before 6.2.2.1 Description The issue allows context-dependent attackers to obtain sensitive authentication information by leveraging read access to a downloaded core...

CVE-2012-2206

The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI...

CVE-2009-2031

The CVE-2009-2031 entry applies to Sun OpenSolaris smbfs (SNV_84 to SNV_110). It describes a localPrivilege issue where, when default mount permissions are used, local users can read arbitrary files and list arbitrary directories on CIFS volumes . The description identifies the affected component...

CVE-2008-3946

The finger client in HP TCP/IP Services for OpenVMS 5.x allows local users to read arbitrary files via a link corresponding to a 1 .plan or 2 .project file...

CVE-2007-6185

Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a download action, as demonstrated by a certain PHP file containing database credentials...

HP-UX PHSS_35579 : s700_800 11.X OV NNM7.01 PA RISC Intermediate Patch 10

s700800 11.X OV NNM7.01 PA RISC Intermediate Patch 10 : The remote HP-UX host is affected by multiple vulnerabilities : - A potential vulnerability has been identified with HP OpenView Network Node Manager OV NNM. This vulnerability could be exploited remotely by an unauthorized user to execute...