Description of the security update for Office 2010: August 13, 2019

Description of the security update for Office 2010: August 13, 2019 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Word software if it does not correctly handle objects in memory. To learn more about the vulnerability, see Microsoft Common...

Description of the security update for SharePoint Enterprise Server 2016: August 13, 2019

None None...

Description of the security update for Word 2010: August 13, 2019

Description of the security update for Word 2010: August 13, 2019 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Word software if ti does not correctly handle objects in memory. To learn more about the vulnerability, see Microsoft Common...

Description of the security update for Office 2013: August 13, 2019

Description of the security update for Office 2013: August 13, 2019 Summary This security update resolves a remote code execution vulnerability that exists if the Windows Jet Database Engine incorrectly handles objects in memory. To learn more about the vulnerability, see Microsoft Common...

CVE-2017-18500

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues...

CVE-2017-18500

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues...

3CX Phone system (web) management console code issue vulnerability

3CX Phone system web management console is a web-based management console program for the 3CX phone system. A code issue vulnerability exists in 3CX Phone system web management console versions 12.5.44178.1002 through 12.5 SP2. The vulnerability arises from an improperly designed or implemented...

Security Bulletin: Potential denial of service vulnerability in WebSphere Application Server may affect IBM InfoSphere Identity Insight (CVE-2019-4046)

Summary There is a potential denial of service vulnerability in WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2019-4046 Link to security bulletin: Affected Products and Versions IBM InfoSphere Identity Insight 9.0 IBM InfoSphere...

Security Bulletin: Potential spoofing attack in WebSphere Application Server may affect IBM InfoSphere Identity Insight (CVE-2018-1695)

Summary There is a potential spoofing attack in WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2018-1695 Link to security bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10716523 Affected Products and Versions IBM...

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats...

Security Bulletin: IBM MQ Appliance affected by an OpenSSH vulnerability (CVE-2019-6110)

Summary IBM MQ Appliance has addressed the following OpenSSH vulnerability. Vulnerability Details CVEID: CVE-2019-6110 DESCRIPTION: OpenSSH could allow a remote attacker to conduct spoofing attacks, caused by accepting and displaying arbitrary stderr output from the scp server. A man-in-the-middl...

Security Bulletin: IBM MQ Appliance is affected by an OpenSSL vulnerability (CVE-2019-1559)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a...

Security Bulletin: IBM MQ clients are vulnerable to a denial of service attack caused by consuming specifically crafted messages (CVE-2019-4261)

Summary An error was found with the IBM MQ client message handling logic that causes a denial of service attack when specifically crafted messages are consumed. Vulnerability Details CVEID: CVE-2019-4261 DESCRIPTION: IBM MQ Clients are vulnerable to a denial of service attack caused by specially...

CVE-2019-7000

A Cross-Site Scripting XSS vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 8.0.14. Prior versions not listed were not evaluated...

CVE-2019-7614

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

Security Bulletin: IBM StoredIQ is affected by a missing function level access control vulnerability (CVE-2019-4163)

Summary IBM StoredIQ has addressed the following vulnerability: Missing function level access control. Vulnerability Details CVEID: CVE-2019-4163 DESCRIPTION: IBM StoreIQ could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. CVSS...

Ubuntu 16.04 LTS / 18.04 LTS : Firefox regressions (USN-4054-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4054-2 advisory. USN-4054-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the...

USN-4054-2 firefox regressions

USN-4054-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the inconvenience. Original advisory details: A sandbox escape was discovered in Firefox. If a user were tricked in to installing a malicious language pac...

Security Bulletin: Clickjacking vulnerability in WebSphere Application Server Liberty Admin Center (CVE-2019-4285)

Summary There is a clickjacking vulnerability in IBM WebSphere Application Server Liberty Admin Center. Vulnerability Details CVEID: CVE-2019-4285 DESCRIPTION: IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By...

HP Service Pack for ProLiant Local Unauthorized Access Vulnerability

HP Service Pack for ProLiant is a comprehensive system software and firmware update solution from Hewlett Packard Enterprise HPE, USA. A local unauthorized access vulnerability exists in the bundled software for HP Service Pack for ProLiant versions prior to 2018.09.0. An attacker could use this...