Cross site scripting

IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172882...

Cross site scripting

IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166204...

CVE-2019-0193

A flaw was found in Apache Solr’s DataImportHandlerDIH. A DIH configuration containing scripts coming from a request's dataConfig parameter allows an attacker to perform remote code execution. Mitigation Edit solrconfig.xml to configure all DataImportHandler usages with an "invariants" section...

CVE-2019-11110

Authentication bypass in the subsystem for IntelR CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2019-11097

Improper directory permissions in the installer for IntelR Management Engine Consumer Driver for Windows before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45,13.0.10 and 14.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow an authenticated user to potentially enable escalation of...

CVE-2019-11102

Insufficient input validation in IntelR DAL software for IntelR CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access...

CVE-2019-11090

Cryptographic timing conditions in the subsystem for IntelR PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; IntelR TXE 3.1.70 and 4.0.20; IntelR SPS before versions SPSE504.01.04.305.0, SPSSoC-X04.00.04.108.0, SPSSoC-A04.00.04.191.0, SPSE304.01.04.086.0,...

CVE-2019-11101

Insufficient input validation in the subsystem for IntelR CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access...

CVE-2019-11087

Insufficient input validation in the subsystem for IntelR CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege, information disclosure or denial of...

CVE-2019-0168

Insufficient input validation in the subsystem for IntelR CSME before versions 11.8.70, 12.0.45 and 13.0.10; IntelR TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access...

SQLite CVE-2019-19880 Denial of Service Vulnerability

Description SQLite is prone to a denial of service vulnerability. Attackers can exploit this issue to cause denial-of-service conditions. SQLite 3.30.1 is vulnerable; other versions may also be affected. Technologies Affected SQLite SQLite 3.30.1 Recommendations Block external access at the netwo...

Micro Focus ArcSight Logger Cross-Site Request Forgery Vulnerability

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. A cross-site request forgery vulnerability exists in Micro...

Shadow CVE-2019-19882 Multiple Local Privilege Escalation Vulnerabilities

Description Shadow is prone to multiple local privilege-escalation vulnerabilities. A local attacker can exploit these issues to gain elevated privileges. Shadow 4.8 is vulnerable; other versions may also be affected. Technologies Affected Shadow-Maint Shadow 4.8 Recommendations Permit local acce...

STMicroelectronics ST33TPHF2ESPI TPM Encryption Issue Vulnerability

The STMicroelectronics ST33TPHF2ESPI TPM is a Trusted Computing Platform Module from STMicroelectronics, Switzerland. A cryptographic issue vulnerability exists in versions of the STMicroelectronics ST33TPHF2ESPI TPM prior to 2019-09-12. The vulnerability stems from a networked system or product...

Cross site scripting

The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

The vulnerability of the embedded microcontroller’s consumer driver, Intel Management Engine, and the microprogramming software Intel Trusted Execution Engine (TXE), allows a perpetrator to enhance their privileges.

The vulnerability of the embedded microcontroller’s consumer driver, Intel Management Engine for Windows, and Intel Trusted Execution Engine TXE software, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Intel Platform Trust Technology (PTT) platform for storing account data and managing keys, along with the microsoftware Intel Trusted Execution Engine (TXE) and Intel Server Platform Services, arises from the lack of protection for operational data. This allows attackers to gain access to the cryptographic keys stored in the Trusted Platform Module (TPM).

The vulnerability of the Intel Platform Trust Technology-based data storage and key management platform, along with the Intel Trusted Execution Engine software and Intel Server Platform Services, is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow a...

The vulnerability of the MEinfo utility in Intel’s Converged Security and Manageability Engine (CSME) and Intel’s Trusted Execution Engine (TXE) allows a attacker to enhance their privileges.

The vulnerability of the MEinfo utility in Intel’s Converged Security and Manageability Engine CSME and Intel’s Trusted Execution Engine TXE software exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerabilities of Intel Converged Security and Manageability Engine (CSME) and Intel Trusted Execution Engine (TXE) involve buffer overflows in dynamic memory, which allow attackers to expose sensitive information, cause system failures, or gain elevated privileges.

The vulnerability of the Microprogramming Software Intel Converged Security and Manageability Engine CSME and Intel Trusted Execution Engine TXE is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, cause...

The vulnerability of the driver for the hardware abstraction layer of the MEinfo utility lies in the Microprogramming Software Intel Converged Security and Manageability Engine (CSME), the Microprogramming Software Intel Trusted Execution Engine (TXE), the Intel-SA-00086 Detection Tool, and the INTEL-SA-00125 Detection Tool. This vulnerability allows attackers to enhance their privileges.

The vulnerability of the MEinfo driver for hardware abstraction in Intel Converged Security and Manageability Engine CSME microprogramming software, Intel Trusted Execution Engine TXE microprogramming software, Intel-SA-00086 Detection Tool, and INTEL-SA-00125 Detection Tool is related to...