Spoofing

A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK...

CVE-2018-8479

Azure IoT SDK Spoofing Vulnerability (CVE-2018-8479) affects the C SDK for Azure IoT Device Provisioning on Windows using the HTTP transport. The root cause is improper validation of HTTP certificates in the transport library, enabling potential server impersonation via spoofing/MITM during provi...

Microsoft Releases Patches for 60 Flaws—Two Under Active Attack

Get your update caps on. Just a few minutes ago Microsoft released its latest monthly Patch Tuesday update for August 2018, patching a total of 60 vulnerabilities, of which 19 are rated as critical. The updates patch flaws in Microsoft Windows, Edge Browser, Internet Explorer, Office, ChakraCore,...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2016-4560

Summary IBM SDK for Node.js installation executables on the Windows platform are affected by CVE-2016-4560 Vulnerability Details CVEID: CVE-2016-4560 DESCRIPTION: Flexera InstallAnywhere could allow a local attacker to gain elevated privileges on the system, caused by an untrusted search path. An...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2016-0603)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.6 , 1.7 and 1.8 that is used by Rational Host On Demand .JRE installation executables on the Windows platform are affected by this vulnerability. Vulnerability Details CVE-ID: CVE-2016-0603 Descriptio...

Foxit Reader Remote Code Execution Vulnerability (CNVD-2018-14566)

Foxit Reader for Windows is China's Foxit Foxit Software Corporation, a Windows-based platform for PDF document reader. A post-release reuse vulnerability exists in the handling of Ink annotations in Foxit Reader 9.1.0.5096 and earlier versions for Windows. A remote attacker can exploit this...

Foxit Reader Type Obfuscation Remote Code Execution Vulnerability (CNVD-2018-14466)

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...

Jenkins 任意文件读取漏洞(CVE-2018-1999002)

SECURITY-914 / CVE-2018-1999002 An arbitrary file read vulnerability in the Stapler web framework used by Jenkins allowed unauthenticated users to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master process has access to. Input...

Foxit PhantomPDF integer overflow vulnerability (CNVD-2018-14069)

Foxit Reader is a PDF document reader from China's Foxit Software Corporation.Foxit PhantomPDF is a commercial version. An integer overflow vulnerability exists in the handling of PDF documents in Foxit PhantomPDF 9.1.0.5096 and earlier versions for Windows platforms, which arises from a process...

Foxit Reader Memory Misreference Vulnerability (CNVD-2018-14146)

Foxit Reader for Windows is China's Foxit Foxit Software Corporation, a Windows-based platform for PDF document reader. A memory misreference vulnerability exists in the handling of the 'SeedValue Generic Object' parameter passed to the 'signatureSetSeedValue' function in Foxit Reader 9.1.0.5096...

Foxit Reader Buffer Overflow Vulnerability (CNVD-2018-14093)

Foxit Reader for Windows is China's Foxit Foxit Software Corporation, a Windows-based platform for PDF document reader. An out-of-bounds reading vulnerability exists in the handling of PDF documents in Foxit Reader 9.1.0.5096 and earlier versions for Windows platforms, where the program fails to...

CVE-2018-1000209

Sensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions vulnerability in Sensu Core on Windows platforms that can result in Unprivileged users may execute code in context of Sensu service account. This attack appear to be exploitable via Unprivileged user may place a...

Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", 'Description' = %q This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter...

Security Bulletin: Vulnerability in InstallAnywhere affects IBM Tivoli Monitoring for Tivoli Storage Manager Server (CVE-2016-4560)

Summary InstallAnywhere generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Monitoring for Tivoli Storage Manager Reporting on Windows platforms. Vulnerability Details CVEID: CVE-2016-4560 DESCRIPTION: Flexera InstallAnywhere could allow a local...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager Server (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects the IBM Tivoli Storage Manager IBM Spectrum Protect Server on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera InstallShield could allow a local attacker ...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager FastBack for Bare Machine Recovery (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects the IBM Tivoli Storage Manager FastBack for Bare Machine Recovery on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera InstallShield could allow a local...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Virtual Environments: Data Protection for Microsoft Hyper-V (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Virtual Environments: Data Protection for Microsoft Hyper-V IBM Spectrum Protect for Virtual Environments on Windows platforms. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Databases: Data Protection for Oracle (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Databases: Data Protection for Oracle IBM Spectrum Protect for Databases on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexer...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server IBM Spectrum Protect for Databases on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542...

Determining which CVE fixes are included in a JRE

Question IBM Security Bulletins list CVEs that must be applied to the JRE that RPT scripts use to run tests. How can you determine whether a specific JRE version includes a particular CVE? Answer IBM Security Bulletins list Common Vulnerabilities and Exposures CVE that must be fixed in the T6...