IBM WebSphere MQ Managed File Transfer Information Disclosure Vulnerability

IBM WebSphere MQ is a messaging middleware product from IBM, USA. It provides a reliable and proven messaging backbone for Service Oriented Architecture SOA.IBM WebSphere MQ Managed File Transfer is one of the tools used to manage file transfers in the system. A security vulnerability exists in I...

IBM WebSphere MQ Information Disclosure Vulnerability (CNVD-2018-15743)

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA. An information disclosure vulnerability exists in IBM WebSphere MQ versions 8.0 through 9.0, which originates from the...

CVE-2018-1543

IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598...

CVE-2018-1374

An IBM WebSphere MQ Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4 client connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa. IBM X-Force ID: 137775...

OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Concurrency. Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with...

OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Concurrency. Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with...

PRTG Network Monitor Authenticated RCE

Notifications can be created by an authenticated user and can execute scripts when triggered. Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command allowing command execution under the context of privileged user. The module uses provided...

IBM WebSphere MQ Denial of Service Vulnerability (CNVD-2018-17157)

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing a reliable and proven messaging backbone for Service Oriented Architecture SOA. A security vulnerability exists in IBM WebSphere MQ versions 8.0 and 9.0 that originates from the program's use of the...

Security Bulletin: IBM MQ is affected by a potential denial of service to channel processes (CVE-2017-1557)

Summary An IBM MQ application with authority to connect to a remote queue manager could send a malicious request that could cause undefined behaviour within the channel process servicing that connection, including a loss of service for other connections being serviced by the same channel process...

Security Bulletin: IBM MQ Appliance potential access to queue manager private keys (CVE-2015-1985)

Summary There is potential for malicious users to access IBM MQ Appliance queue manager private keys without requiring knowledge of the password. Vulnerability Details CVEID: CVE-2015-1985 DESCRIPTION: IBM MQ Appliance M2000 could allow a malicious user with read authority to copied key repositor...

PT-2018-1430

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.9 and later Description The issue is related to the functions tcp collapse ofo queue and tcp prune ofo queue in the Linux kernel, which can be exploited to cause a denial of service. This can happen when an attacker sen...

OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacke...

CVE-2018-11132

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

Command injection

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-11134

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password including root. A...

CVE-2018-11132: Improper Neutralization of Special Elements used in an OS Command

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue...

PT-2018-10323

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description A command injection issue exists in the message queue of the Quest KACE System Management Appliance, allowing low-privilege users to execute arbitrary commands with root...

PT-2018-10325

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description The issue allows a low-privilege user to change the password of any user, including the 'kace support' account, which has full sudo privileges. This is possible due to a comman...