CVE-2018-1833

CVE-2018-1833 affects IBM Event Streams 2018.3.0. A remote attacker with prior CLI access can submit an API request using a forged Host header to spoof the request. The impact is limited to header spoofing as described in the IBM/X-Force context; no exploitation details beyond header manipulation...

CVE-2018-1833

IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An attacker, who has already gained authorised access via the CLI, could exploit this vulnerability to spoof the request header. IBM X-Force ID: 150507...

CVE-2018-1833

IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An attacker, who has already gained authorised access via the CLI, could exploit this vulnerability to spoof the request header. IBM X-Force ID: 150507...

Cross site request forgery (csrf)

IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An attacker, who has already gained authorised access via the CLI, could exploit this vulnerability to spoof the request header. IBM X-Force ID: 150507...

The vulnerability of the Libvirt virtualization management library, related to a bug that leads to excessive memory consumption, allows a hacker to trigger a service failure.

The vulnerability of the Libvirt virtualization management library is related to an error that causes excessive memory consumption when processing large data streams by QEMU. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Security Bulletin: IBM Event Streams is affected by cURL vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included cURL application. Vulnerability Details CVEID: CVE-2018-16840 DESCRIPTION: cURL is vulnerable to a denial of service, caused by a heap use-after-free flaw in the Curlclose function. By sending a specially-craft...

Security Bulletin: Potential redirection to external site when using the the IBM Event Streams API (CVE-2018-1833)

Summary There is a potential for IBM Event Streams API calls involving a paginated response to be redirected to an external site after the first page has been retrieved when subsequent pages are requested. Vulnerability Details CVEID: CVE-2018-1833 DESCRIPTION: IBM Event Streams could allow a...

Security Bulletin: Potential MITM attack in Apache CXF used by IBM Event Streams (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by IBM Event Streams CVE-2018-8039 Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly...

Shenzhen Qiaoan Wireless Camera has information leakage vulnerability

Shenzhen Qiaoan Technology Co., Ltd. as a surveillance camera R&D manufacturer, produces and sells Qiaoan Surveillance, Qiaoan Surveillance Camera, Qiaoan Webcam, Qiaoan Hard Disk Recorder, Qiaoan Dome Camera and so on. There is an information leakage vulnerability in Joan's wireless cameras...

Security Bulletin: A Security Vulnerability Has Been Identified In IBM Cloud Private shipped with IBM Event Streams CVE-ID: CVE-2018-1002105

Summary IBM Cloud Private is shipped with IBM Event Streams. Information about a security vulnerability affecting IBM Cloud Private has been published in a security bulletin. Vulnerability Details Refer to the security bulletin listed in the Remediation/Fixes section Affected Products and Version...

Security Bulletin: Vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU which includes Oracle Apr 2018 CPU

Summary There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU which includes Oracle Apr 2018 CPU used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-2800 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related...

[SECURITY] Fedora 27 Update: icecast-2.4.4-1.fc27

Icecast is a streaming media server which currently supports Ogg Vorbis and MP3 audio streams. It can be used to create an Internet radio station or a privately running jukebox and many things in between. It is very versatile in that new formats can be added relatively easily and supports open...

Fedora 27 : icecast (2018-f3d995c6a8)

This release fixes buffer overflows in URL authentication code CVE-2018-18820, a crash in htpasswd authentication if no filename is set, a crash on xsltApplyStylesheet error, and a crash on malformed Opus streams. It also corrects global listener counter. It stops displaying hashed user passwords...

FaceTime - 'readSPSandGetDecoderParams' Stack Corruption

There are a variety of problems that occur when processing malformed H264 streams in readSPSandGetDecoderParams, leading to OOB read, OOB write and stackchk crashes. I think the root cause is stack corruption. This issue can occur if someone accepts a malicious FaceTime call. To reproduce the...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty

Summary There's a vulnerability in IBM WebSphere Application Server Liberty used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerability in WebSphere Liberty ORB client

Summary There's a vulnerability in WebSphere Liberty ORB client used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, cause...

Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU

Summary There's a multiple vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when...

Security Bulletin: Vulnerability in Apache CXF

Summary There's a vulnerability in Apache CXF used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work...

com.holidaycheck:amqp-akka-streams_2.11 (>=1.3.1 <=2.0.0), com.holidaycheck:amqp-akka-streams_2.12 (>=1.3.1 <=2.0.0) +1 more potentially affected by CVE-2017-15701 via org.apache.qpid:qpid-broker (>=6.1.3 <=6.1.4)

org.apache.qpid:qpid-broker MAVEN version =6.1.3, =1.3.1, =1.3.1, =0.0.1, =0.0.35 Source cves: CVE-2017-15701 Source advisory: OSV:GHSA-4R7G-7CPJ-5JR7...

CVE-2018-17919

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams...