Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability known as the SWEET32 Birthday attack (CVE-2016-2183)

Summary The IBM Security Access Manager appliances are affected by the SWEET32 Birthday attack vulnerability, which could allow an attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: IBM Security Guardium is affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the in the Triple-DES on 64-bit block cipher, used as a part of the SSL/TLS protocol. This vulnerability is known as the SWEET32 Birthday attack. IBM Security Guardium has fixed this vulnerability...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by the Open Source Oracle MySQL Vulnerabilities (CVE-2016-6664)

Summary Oracle MySQL could allow a local authenticated attacker to gain elevated privileges on the system, caused by the improper handling of the creation of error log file by the mysqldsafe script. An attacker could exploit this vulnerability to gain root privileges on the system. IBM Security...

Security Bulletin: A security vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Mobile (CVE-2015-2017)

Summary IBM Security Access Manager for Mobile is affected by a HTTP response splitting vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-2017 DESCRIPTION: The IBM WebSphere Portal is vulnerable to HTTP response splitting attacks. A remote attacker could...

Sql injection

Remote SQL Injection against the HP Service Manager Software Web Tier, version 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, may lead to unauthorized disclosure of data...

EUVD-2018-11681

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0870, CVE-2018-0991...

ManageEngine Desktop Central 9 < Build 92027 Multiple Vulnerabilities

The ManageEngine Desktop Central application running on the remote host is version 9 prior to build 92027. It is, therefore, affected by multiple vulnerabilities including a remote code execution and three cross-site scripting vulnerabilities. Note that Nessus has not attempted to exploit these...

Kentico CMS 9.x <= 11.0.20 XSS Vulnerability

Kentico CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:kentico:kentico...

Cross site scripting

A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management PPM version v9.30, v9.31, v9.32, v9.40 was found...

Microsoft Windows Internet Explorer Multiple RCE Vulnerabilities (KB4074736)

This host is missing a critical security update according to Microsoft KB4074736 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ISC BIND 9 < 9.9.11-P1 / 9.9.11-S2 / 9.10.6-P1 / 9.10.6-S2 / 9.11.2-P1 / 9.12.0rc2 Multiple Vulnerabilities

According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.9.x prior to 9.9.11-S2 or 9.9.11-P1, 9.10.x prior to 9.10.6-S2 or 9.10.6-P1, or 9.11.x prior to 9.11.2-P1. It is, therefore, affected by a remote denial of service vulnerability. C Tenable...

Microsoft Internet Explorer Multiple Vulnerabilities (KB4052978)

This host is missing a critical security update according to Microsoft security updates KB4052978. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc0x100, "This is not correctly encoded", "hex";' The buffer implementation was updated such that the buffer will...

CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc0x100, "This is not correctly encoded", "hex";' The buffer implementation was updated such that the buffer will...

CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc0x100, "This is not correctly encoded", "hex";' The buffer implementation was updated such that the buffer will...

OpenJDK: unbounded resource use in JceKeyStore deserialization (Serialization, 8181370)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated...

Oracle Java SE Deployment Subcomponent Unauthorized Operation Vulnerability

Oracle Java SE is the United States Oracle Oracle company's set of standard version of the Java platform for the development and deployment of desktop, server, and embedded devices and real-time environments in the Java application. A security vulnerability exists in the Deployment subcomponent o...

CVE-2017-3087

Adobe Captivate versions 9 and earlier have an information disclosure vulnerability resulting from abuse of the quiz reporting feature in Captivate...

CVE-2017-3098

Adobe Captivate

Microsoft Internet Explorer Remote Code Execution Vulnerability (KB4014661)

This host is missing a critical security update according to Microsoft security updates KB4014661. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...