PT-2018-3861 · Tibco +1 · Tibco Jasperreports Server +5

Name of the Vulnerable Software and Affected Versions: TIBCO JasperReports Server versions up to and including 6.4.2 TIBCO JasperReports Server Community Edition versions up to and including 6.4.2 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.2 TIBCO Jaspersoft...

RHEL 7 : qemu-kvm (RHSA-2018:0816)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0816 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide th...

Important: Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update

An update for qemu-kvm-rhev is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SUSE SLES11 Security Update : glibc (SUSE-SU-2018:0874-1)

This update for glibc fixes the following issues: Security issues fixed : - CVE-2017-12133: Avoid use-after-free read access in clntudpcall bsc1081556 Non security issue fixed : - Fix incorrect getaddrinfo assertion trigger bsc1076871 Note that Tenable Network Security has extracted the preceding...

Authorization

An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions...

CVE-2018-1000105

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins...

Solaris 10 (sparc) : 120543-35

Vulnerability in the Solaris component of Oracle Sun Products Suite subcomponent: Apache HTTP Server. The supported version that is affected is 10. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful attack of this vulnerability can result in...

Cisco Secure Access Control Server XML External Entity Injection Vulnerability (CNVD-2018-05230)

Cisco Secure Access Control Server ACS is a secure access control server from Cisco USA. The server provides a comprehensive identity-based access control solution for Cisco intelligent information networks. An XML external entity injection vulnerability exists in the Web-based user interface in...

SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0655-1)

This update for glibc fixes the following issues : - CVE-2017-12133: Avoid use-after-free read access in clntudpcall bsc1081556 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean a...

Solaris 10 (x86) : 148976-01

Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: Utility/Remote Execution Serverin.rexecd. Supported versions that are affected are 8, 9, 10 and 11. Easily exploitable vulnerability allows successful unauthenticated network attacks via TCP/IP. Successf...

Linux kernel memory leak vulnerability (CNVD-2018-06647)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A memory disclosure vulnerability exists in the 'sassmpgetphyevents' function in the drivers/scsi/libsas/sasexpander.c file in Linux kernel version 4.15.7 and earlier....

CVE-2018-0207

CVE-2018-0207 affects the Cisco Secure Access Control Server web-based UI (pre-5.8 patch 9). It’s an XXE handling flaw in XML parsing that could let an unauthenticated, remote attacker gain read access to certain information by enticing an administrator to import a crafted XML file. Concrete affe...

CVE-2018-1000114

An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions...

XXE Zeroday Vulnerability in HP PPM

Intro: XXE Zeroday Vulnerability in HP PPM Researchers at Rhino Security Labs discovered an XXE vulnerability in the way HP Project and Portfolio Management Center HP PPM processed imported tickets. Specifically, an XML external entity injection vulnerability allows an attacker to exploit the...

CVE-2018-5445

A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.220170817. An attacker has read access to files within the directory structure of the target device...

Path traversal

A Path Traversal issue was discovered in Advantech WebAccess/SCADA versions prior to V8.220170817. An attacker has read access to files within the directory structure of the target device...

CVE-2018-2732

Vulnerability in the Oracle Financial Services Analytical Applications Reconciliation Framework component of Oracle Financial Services Applications subcomponent: User Interface. The supported version that is affected is 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2018-2692

Vulnerability in the Oracle Financial Services Asset Liability Management component of Oracle Financial Services Applications subcomponent: User Interface. Supported versions that are affected are 6.1.x and 8.0.x. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

CVE-2018-2625

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2018-2635

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite subcomponent: Login. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...