ai.ylyue:yue-library-base (>=Finchley.SR2.SR1 <=Finchley.SR4.1), ai.ylyue:yue-library-base-crypto (>=Finchley.SR4 <=Finchley.SR4.1) +3028 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (>=5.0.0.RELEASE <=5.0.4.RELEASE)

org.springframework:spring-core MAVEN version =5.0.0.RELEASE, =Finchley.SR2.SR1, =Finchley.SR4, =Finchley.SR2.SR1, =Finchley.SR2.SR1, =Finchley.SR4, =0.0.1, =0.0.2, =2.0.3.RELEASE, =2.0.3.RELEASE, =2.0.3.RELEASE, =2.0.3.RELEASE, =2.0.2.RELEASE, =2.0.2.RELEASE, =2.0.3.RELEASE, =2.0.7.RELEASE and...

F5 BIG-IP APM Information Disclosure Vulnerability (CNVD-2019-07130)

F5 BIG-IP Access Policy Manager APM is a suite of access and security solutions from F5 America. The solution provides unified access to business-critical applications and networks. portal access is one of the portal access components. A security vulnerability exists in portal access in F5 BIG-IP...

CVE-2018-15310

A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages...

CVE-2018-15310

A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages...

Code injection

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements...

Design/Logic Flaw

A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages...

Code injection

On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for origuri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts...

CVE-2018-5548

On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for origuri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts...

CVE-2018-5549

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements...

CVE-2018-15310

A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages...

CVE-2018-5548

On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for origuri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts...

CVE-2018-5549

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements...

CVE-2018-5549

CVE-2018-5549 affects BIG-IP APM SAML IdP (APMD may core) when processing SAML Assertions/responses. Affected: BIG-IP APM 11.6.0–11.6.3.1, 12.1.0–12.1.3.3, 13.0.0, 13.1.0–13.1.0.3. Impact: disruption of service (potential crash). Remediation: upgrade to fixed releases per vendor advisory (13.1.0....

CVE-2018-15310

CVE-2018-15310 affects BIG-IP APM portal access. Affected versions are 11.5.1–11.5.7, 11.6.0–11.6.3, and 12.1.0–12.1.3, which disclose the BIG-IP software version in rewritten portal pages. This is an information disclosure vulnerability in the portal access component; the root cause is not fully...

CVE-2018-5548

CVE-2018-5548 affects BIG-IP APM. The connected F5 advisory confirms an insecure AES ECB mode is used for the orig_uri parameter in an undisclosed /vdesk link of an APM virtual server with an access profile. This enables an attacker with a valid APM session to forge a redirect URL by manipulating...

Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition affect IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and Java SE Embedded impact IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2018-2795 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could...

CVE-2018-5546

CVE-2018-5546 affects the F5 BIG-IP APM client svpn and policyserver components on Linux and macOS. The vulnerability arises because these components run with elevated privileges on the local host, allowing a local unprivileged user to gain ownership of root-owned files, potentially disclose sens...

CVE-2018-5547

Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to establish network access. This feature displays a certificate user interface dialog box which contains the link to the certificate policy...

CVE-2018-5546

The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of...

CVE-2018-5547

CVE-2018-5547 affects the Windows client for F5 BIG-IP APM. The Windows Logon Integration feature, before version 7.1.7.1, by default runs in Legacy logon mode using a SYSTEM account to establish network access. This can present a certificate policy link in a UI dialog; clicking the link may open...