RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues PoC As admin, Navigate to Setting Яндекс.Турбо Счетчики and enter a payload such as " onmouseover="alert1 into a...

OS Command Injection in Security Analytics

Summary The Symantec Security Analytics web UI is susceptible to an OS command injection vulnerability. A remote unauthenticated attacker, who has access to the Security Analytics web UI, can execute arbitrary OS commands on the target with elevated privileges. Affected Products The following...

Security Bulletin: Vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis (CVE-2019-17558)

Summary Apache Solr is vulnerable to Remote Code Execution. This has been addressed. Vulnerability Details CVEID: CVE-2019-17558 DESCRIPTION: Apache Solr could allow a remote attacker to execute arbitrary code on the system. By providing a Velocity template through the VelocityResponseWriter, an...

Security Bulletin: Vulnerability in jersey affect Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2014-3643)

Summary There is a potential XXE vulnerability in jersey that affects Apache Zookeeper Vulnerability Details CVEID: CVE-2014-3643 DESCRIPTION: Jersey could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data by jersey SAX...

Security Bulletin: protobuf Vulnerability in Apache Solr affect IBM Operations Analytics - Log Analysis Analysis (CVE-2015-5237)

Summary A potential Buffer Error and Out-of-Bounds Write vulnerabilities in protobuf were addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2015-5237 DESCRIPTION: Google Protocol Buffers could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect Apache Solr shipped with IBM Operations Analytics - Log Analysis

Summary There are vulnerabilities in various versions of Eclipse Jetty that affect Apache Solr. The vulnerabilities are in Vulnerability Details section. Vulnerability Details CVEID: CVE-2019-10246 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information, caused by...

Security Bulletin: Vulnerability in Apache Ant affect IBM Operations Analytics - Log Analysis Analysis (CVE-2020-1945)

Summary A vulnerability in Apache Ant which could potentially leak sensitive information was addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2020-1945 DESCRIPTION: Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of...

Oracle Business Intelligence Enterprise Edition 安全漏洞

Oracle Business Intelligence Enterprise Edition OBIEE is a business intelligence BI tool from Oracle Corporation. A security vulnerability exists in the Analytics Web General component in Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0. A...

Oracle Business Intelligence Enterprise Edition 安全漏洞

Oracle Business Intelligence Enterprise Edition OBIEE is a business intelligence BI tool from Oracle Corporation. A security vulnerability exists in the Analytics Actions component in Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0. An attacker could...

Symantec Security Analytics Web UI 操作系统命令注入漏洞

Symantec Security Analytics Web UI is an application from Symantec Corporation, USA. Symantec Security Analytics suffers from an operating system command injection vulnerability that results from improper input validation. An unauthenticated, remote attacker could use this vulnerability to send...

Oracle Hospitality Reporting and Analytics 输入验证错误漏洞

Oracle Hospitality Reporting and Analytics is a suite of platforms for hotels used by Oracle Corporation USA for generating reports for analyzing operational data. Oracle Hospitality Inventory Management Export to Reporting and Analytics 9.1.0 suffers from an input validation error vulnerability...

Security Bulletin: Vulnerability in Bouncy Castle affect Apache Solr shipped IBM Operations Analytics - Log Analysis Analysis (CVE-2019-17359)

Summary IBM Operations Analytics - Log Analysis has addressed a vulnerability that could cause OutOfMemoryError error in Bouncy Castle. Vulnerability Details CVEID: CVE-2019-17359 DESCRIPTION: Bouncy Castle Crypto is vulnerable to a denial of service, caused by OutOfMemoryError error in ASN.1...

Security Bulletin: Vulnerability in Apache Commons Compress affect Apache Solr shipped IBM Operations Analytics - Log Analysis Analysis (CVE-2019-12402)

Summary There is a potential Resource Management vulnerability in Apache Commons Compress that affects Apache Solr Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an error in the internal file name encoding algorithm...

Security Bulletin: Multiple vulnerabilities in Apache Hadoop affect Apache Solr shipped with IBM Operations Analytics - Log Analysis

Summary There are vulnerabilities in various versions of Apache Hadoop that affect Apache Solr. The vulnerabilities are in Vulnerability Details section. Vulnerability Details CVEID: CVE-2018-11766 DESCRIPTION: Apache Hadoop could allow a local attacker to gain elevated privileges on the system. ...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Apache Zookeeper vulnerability (CVE-2019-0201)

Summary IBM Operations Analytics - Log Analysis has addressed a potential permission vulnerability in Apache ZooKeeper. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permission...

Security Bulletin: Vulnerability in Apache Hadoop affect Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2018-11768)

Summary There is a potential Buffer Errors vulnerability in Apache Hadoop hadoop-hdfs that affects Apache Solr Vulnerability Details CVEID: CVE-2018-11768 DESCRIPTION: Apache Hadoop is vulnerable to a denial of service, caused by a mismatch in the size of the fields used to store user/group...

Security Bulletin: Apache Solr, shipped with IBM Operations Analytics - Log Analysis, susceptible to vulnerability in Apache POI (CVE-2019-12415)

Summary The XXE vulnerability in Apache POI affects Apache Solr. This has been fixed. Vulnerability Details CVEID: CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data by tool...

Security Bulletin: Vulnerability in Apache PDFBox affect Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2019-0228)

Summary Apache Solr susceptible to XXE vulnerability in Apache PDFBox. This has been fixed. Vulnerability Details CVEID: CVE-2019-0228 DESCRIPTION: Apache PDFBox could allow a remote attacker to obtain sensitive information, caused by improper handling of XML External Entity XXE by the XML parser...

Security Bulletin: Multiple vulnerabilities in Bouncy Castle affects Apache Solr shipped with IBM Operations Analytics - Log Analysis

Summary There is various type of vulnerabilities in Bouncy Castle that affect Apache Solr. The list can be found at Vulnerability Details section. Vulnerability Details CVEID: CVE-2018-1000613 DESCRIPTION: Legion of the Bouncy Castle Java Cryptography APIs could allow a remote attacker to execute...

Security Bulletin: Apache Solr, shipped with IBM Operations Analytics - Log Analysis, susceptible to multiple vulnerabilities in Apache Xerces2

Summary There are vulnerabilities in Apache Xerces2 Java Parser that affect Apache Solr. The details are available in the Vulnerability Details section. Vulnerability Details CVEID: CVE-2013-4002 DESCRIPTION: A denial of service vulnerability in the Apache Xerces-J parser used by IBM Java could...