CVE-2019-1660

A vulnerability in the Simple Object Access Protocol SOAP of Cisco TelePresence Management Suite TMS software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to a lack of proper access and authentication controls on the...

Cisco Patches Critical Bug in License Management Tool

Cisco Systems is warning of a critical bug in two of its license management tools that could allow an unauthenticated remote attacker to execute arbitrary queries. A successful attack could allow for an attacker to modify and delete random data in Cisco product lifecycle management applications...

[SECURITY] Fedora 28 Update: hylafax+-5.6.1-1.fc28

HylaFAXtm is a enterprise-strength fax server supporting Class 1 and 2 fax modems on UNIX systems. It provides spooling services and numerous supporting fax management tools. The fax clients may reside on machines different from the server and client implementations exist for a number of platform...

[SECURITY] Fedora 28 Update: xen-4.10.1-6.fc28

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM XIV Gen3 systems and IBM XIV Management Tools (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM XIV Gen3 systems and IBM XIV Management Tools. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing ...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM XIV Management Tools (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects XIV Management Tools. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM XIV Management Tools (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM XIV Management Tools. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in Java Runtime affect XIV Management Tools (CVE-2015-0410)

Summary There is a vulnerability in Oracle® Java™ SE, Version 7u72 that is used by XIV Management Tools. This issue was disclosed as part of the Oracle Java SE updates in January 2015. Vulnerability Details CVEID: CVE-2015-0410 DESCRIPTION: An unspecified vulnerability related to the Security...

Security Bulletin: Vulnerability in SSLv3 affects IBM XIV Storage System Gen 3.0 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM XIV Storage System Gen 3.0 Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitiv...

Security Bulletin: Vulnerability in SSLv3 affects IBM XIV Storage System Gen 2 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM XIV Storage System Gen2. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerabilities in Bash affect the IBM Hyper-Scale Manager component of the XIV Management Tools (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by the IBM Hyper-Scale Manager component of the XIV Management Tools...

Security Bulletin: XIV Management Tools v4.4 Fixes Vulnerability CVE-2014-0411

Summary An unspecified vulnerability in Oracle Java SE could allow remote attackers to impact confidentiality and integrity of XIV management traffic. Vulnerability Details CVE ID: CVE-2014-0411 DESCRIPTION: An unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 an...

The Citrix License Server certificate is not in the Delivery Controller's trusted root store

License Server certificate not in the Delivery Controller's trusted root certificate store. This will impact Studio and Director managing and displaying information from the license server...

The vulnerability of the management tools for virtual infrastructure, such as VMware vCenter Server and VMware ESXi hypervisors, arises from the failure to address sequences of characters CRLF. This allows attackers to control the headers and bodies of HTTP responses, as well as execute cross-site scripting attacks and attacks on intermediate proxy servers.

The vulnerability of the VMware vCenter Server and VMware ESXi hypervisor management infrastructure relates to the lack of measures to neutralize CRLF sequences. User-provided data is appended to HTTP responses without proper processing, allowing arbitrary headers to be inserted into HTTP...

Foreman Information Disclosure Vulnerability (CNVD-2017-05519)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. An information disclosure vulnerability exists in Foreman. An attacker could exploit this vulnerability ...

[SECURITY] Fedora 25 Update: xen-4.7.1-9.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Unsanitised driver domain input in libxl device handling

ISSUE DESCRIPTION libxl's device-handling code freely uses and trusts information from the backend directories in xenstore. The backend domain driver domain can store bogus data in the backend, causing libxl's enquiry functions to fail, confusing management tools. A driver domain can also remove...

xen-tools -- Unsanitised driver domain input in libxl device handling

The Xen Project reports: libxl's device-handling code freely uses and trusts information from the backend directories in xenstore. A malicious driver domain can deny service to management tools...

[SECURITY] Fedora 23 Update: xen-4.5.3-3.fc23

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

IBM Tivoli Directory Server and Security Directory Server Command Execution Vulnerability

IBM Tivoli Directory Server is a suite of enterprise identity management software that uses the Lightweight Directory Access Protocol LDAP. A security vulnerability exists in the IBM Tivoli Directory Server and Security Directory Server web management tools. An attacker could exploit the...