Security Bulletin: wscanhw and wscansw vulnerabilities in scanner component of IBM License Metric Tool v9, v7.5, 7.2.2, IBM Endpoint Manger for Software Use Analysis v9 and IBM Tivoli Asset Discovery for Distributed v7.5, v7.2.2

Summary CIT scanner component contains format string vulnerability in wscanhw executable and stack overflow vulnerability in wscansw executable. Successful exploitation of the vulnerabilities allows for scanner process manipulation, and possibly crashing the process. Vulnerability Details CVEID:...

Security Bulletin: IBM InfoSphere BigInsights 4.2.5 is affected by an Open Source (Solr) vulnerabilty (CVE-2017-12629)

Summary IBM InfoSphere BigInsights 4.2.5 is affected by an Open Source Solr vulnerabilty CVE-2017-12629 Vulnerability Details CVE-ID: CVE-2017-12629 Description: Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a...

Remote code execution occurs in Apache Solr

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

Moderate: Red Hat Security Advisory: rh-java-common-lucene5 security update

An update for rh-java-common-lucene5 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Xxe

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

CVE-2017-12629

CVE-2017-12629 affects Apache Solr before 7.1 (with Lucene before 7.1). The issue combines an XXE in the XML Query Parser (deftype=xmlparser) that can upload data to /upload or enable blind XXE for local file reads, and a second RCE path via RunExecutableListener reachable through a Config API ad...

Trend Micro Control Manager Information Disclosure (CVE-2016-6220)

An XML external entity XXE processing vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of user-supplied input prior to executing an XML query. A remote, authenticated attacker could exploit this vulnerability by sending a malicious HTT...

Trend Micro Control Manager TreeUserControl_process_tree_event Information Disclosure

An XML external entity XXE processing vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of user-supplied input prior to executing an XML query in TreeUserControlprocesstreeevent.aspx. A remote, authenticated attacker could exploit this...

Trend Micro Control Manager AdHocQuery_SelectView XPATH Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within AdHocQuerySelectView.aspx. The issue lies in the failure to sanitize...

Trend Micro Control Manager AdHocQuery_SelectView XPATH Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within AdHocQuerySelectView.aspx. The issue lies in the failure to sanitize...

IBM DB2 9.7 < Fix Pack 11 Multiple Vulnerabilities (Bar Mitzvah) (FREAK) (TLS POODLE)

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 11. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the monitoring and audit features that occurs when handling a specially crafte...

Multiple IBM Product Denial of Service Vulnerabilities (CNVD-2015-03496)

IBM manufactures and sells computer hardware and software, and provides consulting services for systems architecture and web hosting. Common Inventory Technology CIT versions prior to 2.7.0.2050 are used in IBM License Metric Tool versions 7.2.2, 7.5 and 9, Endpoint Manger for Software Use Analys...

Code injection

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

Code injection

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-8926

CVE-2014-8926 affects IBM License Metric Tool (CIT) before 2.7.0.2050 in IBM License Metric Tool v7.2.2, v7.5, and v9; IBM Endpoint Manger for Software Use Analysis v9; and Tivoli Asset Discovery for Distributed v7.2.2 and v7.5. A crafted XML query can cause denial of service via CPU consumption ...

CVE-2014-8926

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...