Cross site scripting

Cross-site scripting XSS vulnerability in IBM Rational Collaborative Lifecycle Management CLM 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Quality Manager RQM 3.0.x before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x...

CVE-2018-7705

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

CVE-2018-7704

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

Directory traversal

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

Directory traversal

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. dot dot in the option2 parameter in an attachment action to secmail/getmessage.exe...

Code injection

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

CVE-2018-7705

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. dot dot in the filename parameter to secupload2/upload.aspx...

CVE-2018-7704

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe...

CVE-2018-7706

CVE-2018-7706 affects SecurEnvoy SecurMail prior to 9.2.501. A directory-traversal flaw in the attachment action to secmail/getmessage.exe can be exploited by remote authenticated users to read arbitrary emails via the ".." sequence in the option2 parameter. The condition is tied to a pre-9.2.501...

Xxe

XML external entity XXE vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510...

CVE-2016-0250

XML external entity XXE vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510...

CVE-2016-0250

CVE-2016-0250 is an XXE vulnerability in IBM InfoSphere Information Governance Catalog (IGC). It affects IGC versions 11.3 prior to 11.3.1.2 and 11.5 prior to 11.5.0.1, enabling a remote authenticated attacker to read arbitrary files or cause a denial of service by processing crafted XML data. Th...

CVE-2016-0268

XML external entity XXE vulnerability in IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM fo...

CVE-2016-0268

XML external entity XXE vulnerability in IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM fo...

CVE-2016-0286

IBM Tivoli Business Service Manager (TBSM) 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 contains an information-disclosure vulnerability. An authenticated user with specific privileges could trigger exposure of the administrator password by manipulating the communicatio...

CVE-2016-0268

CVE-2016-0268 affects IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services on Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013. The vulnerability is an XML External Entity (XXE) issue in XML processing that could allow a remote authenticated atta...

CVE-2014-8780

CVE-2014-8780 describes a cross-site scripting (XSS) vulnerability in Jease 2.11. The issue allows remote authenticated users to inject arbitrary web script or HTML via the content section note, with the attack vector involving the Create module’s content field and persistent scripting in the bro...

CVE-2014-8780

Cross-site scripting XSS vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note...

Updated krb5 packages fix security vulnerabilities

Updated krb5 packages fix security vulnerabilities: An issue was discovered in MIT Kerberos 5 aka krb5 through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in the Key Distribution Center KDC, which allows...

MGASA-2018-0155 Updated krb5 packages fix security vulnerabilities

Updated krb5 packages fix security vulnerabilities: An issue was discovered in MIT Kerberos 5 aka krb5 through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in the Key Distribution Center KDC, which allows...