Security Bulletin: Vulnerabilities in Swagger affects WebSphere Application Server Liberty

Summary There are vulnerabilities in Swagger that affects WebSphere Application Server Liberty used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information,...

WordPress Multiple Vulnerabilities (May 2020) - Windows

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

Plone has an unspecified vulnerability

Plone is an open source content management system CMS built on the Zope application server. A security vulnerability exists in Plone versions 4.3 through 5.2.0, which stems from the program's lack of password strength checking. An attacker can exploit this vulnerability to crack passwords...

PT-2020-6487 · FFmpeg +4 · Ffmpeg +4

Name of the Vulnerable Software and Affected Versions: ffmpeg versions prior to 4.3 Description: The issue is related to the tty demuxer in the FFmpeg library, which did not have a read probe function assigned to it. This can be exploited by crafting a legitimate "ffconcat" file that references a...

Cross site scripting

ClickDesk version 4.3 and below has persistent cross site scripting...

CVE-2014-9211

ClickDesk version 4.3 and below has persistent cross site scripting...

Openfire 4.3.x < 4.5.0 Multiple XSS Vulnerabilities

Openfire is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

DEBIAN-CVE-2019-18886

An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security...

Atlassian Jira Service Desk 4.3.x < 4.3.4 Path Traversal Vulnerability

According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is prior to 3.9.16, 3.10.x prior to 3.16.8, 4.0.x prior to 4.1.3, 4.2.x prior to 4.2.5, 4.3.x prior to 4.3.4 or 4.4.x prior to 4.4.1. It is, therefore, affected by a path traversa...

SAP BusinessObjects Business Intelligence Reflective Cross-Site Scripting Vulnerability

SAP BusinessObjects Business Intelligence is a reporting and analytics business intelligence BI platform for enterprise users. A reflected cross-site scripting vulnerability exists in SAP BusinessObjects Business Intelligence versions prior to 4.2 and 4.3. The vulnerability stems from the product...

Squid Security Update Advisory (SQUID-2018:4)

Squid is prone to a cross-site scripting vulnerability to incorrect input handling when generating HTTPS response messages about TLS errors. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

CVE-2019-0314

SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2019-0251

The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0259

CVE-2019-0259 relates to SAP BusinessObjects (versions 4.2 and 4.3) and is a vulnerability where an attacker can upload arbitrary files, including scripts, due to insufficient file format validation. The root cause is inadequate validation during the file upload process, enabling remote, unauthen...

Security Bulletin: Vulnerability in WebSphere Liberty ORB client

Summary There's a vulnerability in WebSphere Liberty ORB client used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, cause...

GHSA-G8HW-794C-4J9G Path Traversal in org.springframework:spring-core

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. When static resources are served from a file system on Windows as opposed to the classpath, or...

Denial of Service in org.springframework:spring-core

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message ...

Race condition

A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework SGF version 4.2, 4.3. A race condition under high load in SGF exists where SGF transferred different parameter to the enabler...

CVE-2018-7110

A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework SGF version 4.2, 4.3. A race condition under high load in SGF exists where SGF transferred different parameter to the enabler...

Security Bulletin: IBM Cloud Manager with OpenStack is affected by a OpenSSL vulnerabilities

Summary Multiple security vulnerabilities have been identified in OpenSSL that is used by IBM Cloud Manager with OpenStack. IBM Cloud Manager with OpenStack has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3735 DESCRIPTION: OpenSSL could allow a remote attacker to obtain...