CVE-2012-4837

IBM Cognos BI is vulnerable to XPath injection (read arbitrary XML) for versions 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1. The issue arises from improper input validation prior to XPath query use and requires remote authenticated access. Remediation: apply Cognos ...

CVE-2012-4840

IBM Cognos Business Intelligence BI 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension functions, via unspecified vectors...

CVE-2012-4840

IBM Cognos BI is vulnerable to XPath injection (CVE-2012-4840). Affected versions: 8.4.1 prior to IF1, 10.1 prior to IF2, 10.1.1 prior to IF2, and 10.2 prior to IF1. Attackers can remotely inject XPath code and call XPath extension functions via unspecified vectors. Mitigation: apply Cognos BI In...

PT-2013-1727

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence BI versions 8.4.1 through 8.4.1 before IF1 IBM Cognos Business Intelligence BI versions 10.1 through 10.1 before IF2 IBM Cognos Business Intelligence BI versions 10.1.1 through 10.1.1 before IF2 IBM Cognos...

CVE-2012-4837: Exposure of Sensitive Information to an Unauthorized Actor

IBM Cognos Business Intelligence BI 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors...

CVE-2012-4840: Improper Control of Generation of Code

IBM Cognos Business Intelligence BI 8.4.1 before IF1, 10.1 before IF2, 10.1.1 before IF2, and 10.2 before IF1 allows remote attackers to conduct XPath injection attacks, and call XPath extension functions, via unspecified vectors...

PT-2013-1726

Name of the Vulnerable Software and Affected Versions IBM Cognos Business Intelligence BI versions 8.4.1 through 8.4.1 before IF1 IBM Cognos Business Intelligence BI versions 10.1 through 10.1 before IF2 IBM Cognos Business Intelligence BI versions 10.1.1 through 10.1.1 before IF2 IBM Cognos...

Windows Manage User Level Persistent Payload Installer

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require 'msf/core/post/common' require...

Scientific Linux Security Update : mingw32-libxml2 on SL6.x (x86_64) (20130131)

IMPORTANT NOTE: The mingw32 packages in Scientific Linux 6 will no longer be updated proactively and will be deprecated with the release of Scientific Linux 6.4. These packages were provided to support other capabilities in Scientific Linux and were not intended for direct use. You are advised to...

CentOS Update for mingw32-libxml2 CESA-2013:0217 centos6

Check for the Version of mingw32-libxml2 OpenVAS Vulnerability Test CentOS Update for mingw32-libxml2 CESA-2013:0217 centos6 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

mingw32 security update

CentOS Errata and Security Advisory CESA-2013:0217 Updated mingw32-libxml2 packages that fix several security issues are now available for Red Hat Enterprise Linux 6. This advisory also contains information about future updates for the mingw32 packages, as well as the deprecation of the packages...

RHEL 6 : mingw32-libxml2 (RHSA-2013:0217)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0217 advisory. These packages provide the libxml2 library, a development toolbox providing the implementation of various XML standards, for users of MinGW...

libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service application crash via a...

libxml2: Heap-based buffer overflow by adding new namespace node to an existing nodeset or merging nodesets

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when addi...

Mandriva Linux Security Advisory : libxslt (MDVSA-2012:164)

Multiple vulnerabilities has been discovered and corrected in libxslt : Unspecified vulnerability in XSLT allows remote attackers to obtain potentially sensitive information about heap memory addresses via unknown vectors CVE-2011-1202. libxslt 1.1.26 and earlier does not properly manage memory,...

Fedora Update for libxml2 FEDORA-2012-13824

Check for the Version of libxml2 OpenVAS Vulnerability Test Fedora Update for libxml2 FEDORA-2012-13824 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

libxslt: Use-after-free when processing an invalid XPath expression

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service application crash via a crafted XSLT expression that is not properly identified during XPath navigation, related to 1 the...

Google Chrome < 21.0.1180.89 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 21.0.1180.89 and is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error exists related to line-breaking. CVE-2012-2865 - Variable casting errors exist related to 'run-ins' and XSL...

DataWatch Monarch Business Intelligence &#40;BI&#41; v5.1 Admin Section Blind XPath Injection

DataWatch Monarch BI v5.1 admin section blind XPath injection Class: Input Validation Error Remote: Yes Local: No Published: 26/06/2012 Credit: Raymond Rizk of Dionach Limited [email protected] Vulnerable: DataWatch Monarch BI v5.1 DataWatch's Monarch BI admin section is prone to a blind XPath...

CVE-2012-2870

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service application crash via a crafted XSLT expression that is not properly identified during XPath navigation, related to 1 the...