Security Bulletin: Apache Ant Vulnerabilities Affect IBM Control Center (CVE-2020-1945, CVE-2020-11979)

Summary Apache Ant could allow a remote attacker to bypass security restrictions. Vulnerability Details CVEID: CVE-2020-1945 DESCRIPTION: Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sendin...

Security Bulletin: Vulnerability in Apache Ant affect IBM Operations Analytics - Log Analysis Analysis (CVE-2020-1945)

Summary A vulnerability in Apache Ant which could potentially leak sensitive information was addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2020-1945 DESCRIPTION: Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of...

Security Bulletin: Resilient is affected by a potential leak of internal information due to exposed generated source files (CVE-2017-1658)

Summary Security Bulletin: Resilient is affected by a potential leak of internal information due to exposed generated source files CVE-2017-1658 Vulnerability Details Summary Resilient has addressed the following vulnerability by removing external access to generated source files. Vulnerability...

Security Bulletin: Vulnerability in Apache Ant affects IBM Spectrum Symphony

Summary These interim fixes provide instructions on upgrading Apache Ant to 1.10.9 in IBM Spectrum Symphony 7.2.0.2, IBM Spectrum Symphony 7.2.1, IBM Spectrum Symphony 7.3, and IBM Spectrum Symphony 7.3.1 in order to address security vulnerability CVE-2020-11979 in Apache Ant. Vulnerability Detai...

CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

Authorization Bypass

apache-ant is vulnerable to authorization bypass. The vulnerabiltiy exists through the mitigation for CVE-2020-1945 has changed the permissions of temporary files it created so that only the current user was allowed to access them, while the fixcrlf task deleted the temporary file and creates a n...

CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the...

CVE-2020-11979

CVE-2020-11979 affects Apache Ant 1.10.8. The mitigation for CVE-2020-1945 changed temp-file permissions, but the fixcrlf task deleted the temp file and recreated it without protection, enabling an attacker to inject modified source files during builds. Connected advisories confirm the issue and ...

CVE-2020-1945

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build...

CVE-2020-1945

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build...

CVE-2020-0872

A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution Vulnerability in Application Inspector'...

Remote code execution

A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution Vulnerability in Application Inspector'...

PT-2020-1844

Name of the Vulnerable Software and Affected Versions Application Inspector versions v1.0.23 or earlier Description A remote code execution issue exists due to the tool reflecting example code snippets from third-party source files into its HTML output. This can be exploited by a remote attacker ...

EulerOS 2.0 SP2 : bluez (EulerOS-SA-2019-2380)

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In BlueZ 5.42, a use-after-free was identified in 'confopt' function in 'tools/parser/l2cap.c' source file. This issue can be triggered by...

Information Disclosure

Apache Tomcat HTTP/1.1 connector is vulnerable to information disclosure. A lack of validation in the URL allows remote attackers to inject NULL bytes and retrieve confidential information through reading of JSP source files when allowLinking is configured...

USN-3694-1 nasm vulnerabilities

It was discovered that NASM incorrectly handled certain source files. If a user or automated system were tricked into processing a specially crafted source file, a remote attacker could use these issues to cause NASM to crash, resulting in a denial of service, or possibly execute arbitrary code...

Open redirect

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 for 2.1 and before version 2.3...

CVE-2011-4181

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 for 2.1 and before version 2.3...

UBUNTU-CVE-2011-4181

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 for 2.1 and before version 2.3...