Security Bulletin: WebSphere Application Server Liberty is vulnerable to Cross-site Scripting (CVE-2020-4303, CVE-2020-4304)

Summary There is a cross-site scripting vulnerability in the OAuth, OpenID Connect and SAML features. This has been addressed. Vulnerability Details CVEID: CVE-2020-4303 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This...

Security Bulletin: CVE-2020-2654 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-2654 was disclosed as part of the Oracle January 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of...

Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server (CVE-2019-12406)

Summary There is a denial of service in the Apache CXF library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachmen...

Security Bulletin: Vulnerability in embedded IBM Websphere Application Server Liberty affects IBM Watson Compare and Comply for IBM Cloud Pak for Data

Summary WebSphere liberty is vulnerable to a DOS Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability ...

Code Injection in vishwanatharondekar/gitlab-cli

Description The git-lab-cli module is vulnerable against RCE since a command is crafted using user inputs not validated and then executedading to arbitrary command injection POC 1. Check there aren't files called HACKED 2. Execute the following commands in another terminal: bash npm i git-lab-cli...

CVE-2020-8488

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities...

Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities...

GHSA-V2WC-PFQ2-5CM6 Possible XSS attack in Wagtail

Impact A cross-site scripting XSS vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges,...

compare-eslint-config (>=0.1.0 <=0.1.1) potentially affected by CVE-2020-7629 via install-package (=0.1.0)

install-package NPM version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on install-package and may be impacted: - compare-eslint-config =0.1.0, =0.1.1 Source cves: CVE-2020-7629 Source advisory: SNYK:JS-INSTALLPACKAGE-564267...

The vulnerability of the PA-RISC CRYPTO_memcmp function in the OpenSSL library, related to information disclosure, allows attackers to gain access to confidential data.

The vulnerability of the PA-RISC CRYPTOmemcmp function in the OpenSSL library is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

Security Bulletin: Vulnerability in embedded IBM Websphere Application Server Liberty affects IBM Watson Compare and Comply for IBM Cloud Pak for Data

Summary A vulnerability in the IBM WebSphere Application Server Liberty embedded in IBM Watson Compare and Comply for IBM Cloud Pak for Data could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. Vulnerability Details CVEID: CVE-2019-4305...

Denial Of Service (DoS)

modhttp2 is vulnerable to denial of service DoS. The vulnerability exists through a read-after-free on a string compare...

WordPress YITH WooCommerce Compare plugin <=1.3.14 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Compare plugin versions =1.3.14. Solution Update the WordPress YITH WooCommerce Compare plugin to the latest available version at least 1.3.15...

WordPress YITH WooCommerce Compare plugin <=2.3.14 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Compare plugin versions =2.3.14. Solution Update the WordPress YITH WooCommerce Compare plugin to the latest available version at least 2.3.15...

PT-2019-5730 · Imagemagick +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 6.9.10-69 and 7.0.8-69 Description: The issue is related to the IntensityCompare function in the /magick/quantize.c file of the ImageMagick console graphic editor, which is associated with an integer overflow. Th...

DEBIAN-CVE-2019-17350

An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service infinite loop involving a compare-and-exchange operation...

UBUNTU-CVE-2019-17350

An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service infinite loop involving a compare-and-exchange operation...

PT-2019-5146 · Xen · Xen

Name of the Vulnerable Software and Affected Versions: Xen versions prior to 4.13 Description: An issue in Xen allows Arm domU attackers to cause a denial of service through an infinite loop involving a compare-and-exchange operation. This can be exploited to disrupt service. Recommendations: For...

PT-2019-5858 · Imagemagick +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.8-68 Description: The issue is related to the IntensityCompare function in the /MagickCore/quantize.c component of ImageMagick, where a double value is casted to int and returned, potentially causing a value...

Security Bulletin: Vulnerabilities in Eclipse OpenJ9, Oracle Java SE, and IBM WebSphere Application Server affect IBM Watson Compare and Comply for IBM Cloud Private for Data

Summary This bulletin discloses three vulnerabilities that affect IBM Watson™ Compare and Comply for IBM Cloud Private for Data: - A high-severity vulnerability in Eclipse OpenJ9 - A medium-severity vulnerability in IBM WebSphere® Application Server - A low-severity vulnerability in Oracle® Java...