Security Bulletin: Potential information leakages vulnerabilities in IBM Jazz Team Server affect IBM Rational products based on IBM Jazz technology

Summary Multiple vulnerabilities in the IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management CLM, Rational DOORS Next Generation RDNG, Rational Engineering Lifecycle Manager RELM, Rational Team Concert RTC, Rational Quality Manager RQM, Rational...

CVE-2019-19342

A flaw was found in Ansible Tower 3.6.1 and 3.5.3 when /websocket is requested and the password contains the '' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker...

XenMobile Server experiences a communications error with Apple Deployment Programs (formerly DEP)

XenMobile Server administrators may notice that newly added Apple devices, which are registered viaApple Deployment Programs formerly DEP, do not appear on XenMobile Server. Previously enrolled devices are not affected. Apple DEP connectivity test initiated from the XenMobile server may also fail...

MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection

Exploit Title: MaxOn ERP Software 8.x-9.x - 'nomor' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.talagasoft.com Software Link: http://demo.maxonerp.com/ Software Download: https://datapacket.dl.sourceforge.net/project/maxon/maxon.rar Version:...

CVE-2018-17891

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a...

Code injection

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a...

CVE-2018-17891: Generation of Error Message Containing Sensitive Information

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a...

CVE-2017-1239

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124357...

Information disclosure

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124357...

Information disclosure

IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124359...

CVE-2017-1240

IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124359...

Debut Embedded HTTPd 1.20 - Denial of Service

Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers Date: 11/02/2017 Exploit Author: z00n @0xz00n Vendor Homepage: http://www.brother-usa.com Version: = 1.20 CVE : CVE-2017-16249 Description: The Debut embedded http server contains a remotely exploitable...

Denial of Service

Overview Versions of hapi prior to 11.1.3 are affected by a denial of service vulnerability. The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers. This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500...

Macromedia Sitespring 1.2 Default Error Page Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5249/info Macromedia Sitespring is a J2EE-compliant product for managing website production. The Macromedia Sitespring server runs on Microsoft Windows operating systems. A cross-site scripting issue has been reported in...

Get 500 when trying to communicate to confluence via trusted apps.

Steps to reproduce. 1 Install confluence 2.9.2 and crucible 1.6.5 2 Setup trusted apps to crucible specify a "IP address Matches as 10.0.100.123 3 Install the confluence crucible plugin...

CVE-2002-1027

Cross-site scripting vulnerability in the default HTTP 500 error script 500error.jsp for Macromedia Sitespring 1.2.0 277.1 allows remote attackers to execute arbitrary web script via a link to 500error.jsp with the script in 1the et parameter...

CVE-2002-1027

Cross-site scripting vulnerability in the default HTTP 500 error script 500error.jsp for Macromedia Sitespring 1.2.0 277.1 allows remote attackers to execute arbitrary web script via a link to 500error.jsp with the script in 1the et parameter...

CVE-2002-0408: Undefined Security Weakness

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

CVE-2002-0245

Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to 1 determine the physical path of the server via a request for a nonexistent file with a .pl Perl extension, which leaks the pathname in the error message, or 2 make any request that causes an HTTP 500 error, which leaks th...

CVE-2002-0245

CVE-2002-0245 affects Lotus Domino server 5.0.8 with NoBanner enabled. The vulnerability enables two information disclosures: (1) by requesting a non-existent file with a .pl extension, an error message reveals the server’s physical path; (2) any request that triggers an HTTP 500 error leaks the ...