Security Bulletin: SPSS Statistics ActiveX Control Code Execution Vulnerability Notification (CVE-2015-0140)

Summary SPSS Statistics ActiveX control on Windows 32 bit installations could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to visit a specially-crafted Web page with Internet Explorer, a local attacker could exploit this vulnerability to execute arbitrar...

Security Bulletin: IBM SPSS Statistics ActiveX Control Buffer Overflow (CVE-2015-8530)

Summary An IBM SPSS Statistics ActiveX Control is vulnerable to a stack-based buffer overflow. By persuading a victim to visit a specially-crafted Web page that passes an overly long argument to the Initialize function, a remote attacker could overflow a buffer and execute arbitrary code on the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics: CVE-2015-1932, CVE-2015-2601, CVE-2015-2613, CVE-2015-2625

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 1.6 and 1.7 that are used by IBM SPSS Statistics. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allow an...

Security Bulletin: IBM SPSS Statistics is affected by CVE-2018-3139 and CVE-2018-3180 vulnerabilities

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-3139 DESCRIPTION: An unspecified vulnerability in Oracle Java SE relate...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-12547 DESCRIPTION: In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6.0, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime Environment's Diagnostic...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. This CVE affects the windows platform only. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2017-10115, CVE-2017-10116)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics Version 21, 22, 23, 24, and 25. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTIO...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics Server (CVE-2017-10356, CVE-2017-10388)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics Desktop and Server Version 22, 23, 24, and 25. These issues were disclosed as part of the IBM Java SDK updates in Oct 2017. Vulnerability Details CVEID:...

Security Bulletin: IBM SPSS Statistics is affected by an Apache Poi vulnerability (CVE-2017-12626)

Summary IBM SPSS Statistics has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-12626 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by an error while parsing malicious WMF, EMF, MSG and macros and specially crafted DOC, PPT and XLS. By persuadin...

Security Bulletin: IBM SPSS Statistics is affected by multiple GSKit vulnerabilities

Summary IBM SPSS Statistics has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel Sandy-Bridge microarchitecture...

COVID-19 Phishing: Exploiting a Global Pandemic

It's sad to think criminals are hard at work taking advantage of the extraordinary stress the world's population is currently experiencing. But they are. New phishing scams exploiting anxiety about COVID-19 are trending upward. Akamai's Carrier Data Science and Threat Research teams analyzing...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as the I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process...

postgresql: Selectivity estimators bypass row security policies

PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...

Mail.ru: [pulse.mail.ru] Доступ к статистике чужих площадок

Few API methods of pulse.mail.ru were not properly restricted and could be used to obtain statistics information for arbitrary domains...

MISP Cross-Site Scripting Vulnerability (CNVD-2020-16634)

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. MISP 2.4.122 A reflected cross-site scripting vulnerability exists related to app/View/Users/statisticsorgs.ct...

PT-2020-12002 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.122 Description: The issue is related to reflected XSS via unsanitized URL parameters, specifically in the app/View/Users/statistics orgs.ctp file. Recommendations: For MISP version 2.4.122, update to a version that sanitizes...

Business Email Compromise. What to do

The FBI has just released it’s annual Internet Crime Report for 2019, it makes for some really interesting and depressing reading. The mainstream media focused on the headline figure of $3.5Bn in losses in 2019, but what caught my eye is the Business Email Compromise BEC or CEO Fraud stats. I...

SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service DoS or account takeover via credential-stuffing. SoundCloud recently sold a $75 million stake to satellite...