Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Host On-Demand

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8.0 used by Host On-Demand. Host On-Demand has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates in October 2018. Vulnerability Details If you run your own Java code...

Confluence Server / Data Center Path Traversal Vulnerability

Confluence Server and Confluence Data Center suffer from a path traversal vulnerability in the downloadallattachments resource. Versions affected include 6.6.0 up to 6.6.13, 6.7.0 up to 6.12.4, 6.13.0 up to 6.13.4, 6.14.0 up to 6.14.3, and 6.15.0 up to 6.15.2. Confluence Server / Data Center Path...

Security Bulletin: Asset Analyzer (RAA) is affected by an Apache CXF vulnerability

Summary Rational Asset Analyzer RAA has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly with com.sun.net.ssl...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2018-1793)

Summary Websphere Application Server is shipped as a component of IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the...

Security Bulletin: IBM Security Access Manager Appliance is affected by a glibc vulnerability (CVE-2017-15670)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-15670 DESCRIPTION: GNU C Library is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the glob function in glob.c. By sending a...

rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

Security Bulletin: TLS padding vulnerability affects Communications Server for Windows (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects Communications Server for Windows. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product allows a remote attacker to obtain sensitive information,...

Security Bulletin: Real-time compression appliance (CVE-CVE-2015-3216)

Summary Real time compression appliance affected by one Open SSL issue. Vulnerability Details CVEID: CVE-2015-3216 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds memory read error in ssleayrandbytes function. By sending specially crafted data, a remote...

Security Bulletin: OpenSSL security vulnerabilities in IBM Storwize V7000 Unified (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511)

Summary There are security vulnerabilities related to OpenSSL in IBM Storwize V7000 Unified products. Vulnerability Details OpenSSL is used in IBM Storwize V7000 Unified for providing communication security by encrypting data being transmitted. CVEID: CVE-2014-3505 DESCRIPTION: OpenSSL is...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Impact (CVE-2016-8934)

Summary IBM WebSphere Application Server is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Potential...

Security Bulletin: A security vulnerability has been identified in Oracle MySQL shipped with IBM Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - April 2016

Summary Oracle MySQL is shipped as a component of IBM Tivoli Network Manager IP Edition. Information regarding security vulnerabilities affecting Oracle MySQL has been published. Vulnerability Details Tivoli Network Manager IP Edition ships with Oracle MySQL. Oracle has released a Critical Patch...

Security Bulletin: Two vulnerabilities exist in IBM Case Foundation and FileNet Business Process Manager (CVE-2012-5784 and CVE-2014-3596)

Summary Apache Axis contains two security vulnerabilities that could allow for spoofing attacks. See the individual descriptions below for the details. Vulnerability Details CVE-ID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct...

Security Bulletin: Java Vulnerability in Rational Automation Framework (CVE-2013-4002, CVE-2013-5825, CVE-2013-5372)

Summary Previous releases of IBM Rational Automation Framework are affected by the vulnerabilities in Java that may allow remote attackers to influence the availability of the Framework Server. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alert...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect various Optim data server tools desktop products (CVE-2014-6593 and CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7R1 Service Refresh 2 and earlier releases, Version 7 Service Refresh 8 and earlier releases, Version 6 Service Refresh 16 Fix Pack 2 and earlier releases that are used by various Optim data server tools...

PostgreSQL Security Bypass Vulnerability (Dec 2017) - Linux

PostgreSQL is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postgresql:postgresql";...

PT-2017-12606 · Apache · Apache Commons Jelly +1

Name of the Vulnerable Software and Affected Versions: Apache Commons Jelly versions prior to 1.0.1 Description: The issue arises during Jelly xml file parsing with Apache Xerces. If a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the...

Adobe Flash Player Within Google Chrome Security Update (APSB16-01) - Mac OS X

Adobe Flash Player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:flashplayerchrome"...

Avast Free Antivirus Multiple Vulnerabilities

Avast Free Antivirus is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Struts2-045 analysis of CVE-2017-5638-a vulnerability warning-the black bar safety net

Vulnerability description Vulnerability name: Struts2-045 Vulnerability type: remote command execution Vulnerability rating: high risk Vulnerability cause: based on the Jakarta Multipart parser file upload module when processing to upload filesmultipartrequest for exception information is made to...

Adobe Reader Out-of-bounds Vulnerability (Feb 2015) - Windows

Adobe Reader is prone to unspecified Out-of-bounds error vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...