Security Bulletin: No validation on SSL certificates in IBM Tivoli Composite Application Manager for Transactions (CVE-2014-3051)

Summary IBM Tivoli Composite Application Manager for Transactions does not validate SSL certificates during normal operation. An attacker could perform man in middle attack techniques and obtain authentication credentials. Vulnerability Details CVE-ID: CVE-2014-3051 DESCRIPTION: IBM Tivoli...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions is affected by a Local escalation of privilege vulnerability (CVE-2014-0907)

Summary A vulnerability in IBM Tivoli Composite Application Manager for Transactions on Linux, Solaris and AIX could allow a local user to gain elevated privilege. Vulnerability Details CVE-ID: CVE-2014-0907 DESCRIPTION: The IBM Tivoli Composite Application Manager for Transactions products liste...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions affected by multiple vulnerabilities in IBM JRE (Multiple CVEs)

Summary IBM Tivoli Composite Application Manager for Transactions is shipped with two IBM JREs that are based on Oracle Java. It is also dependent on ITM 6.2.1 Framework, which also has it own JRE. Oracle has released a January 2014 Critical Patch Update CPU that contains security vulnerability...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions is affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450 and CVE-2013-6449)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2013-4353 DESCRIPTION: A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

openSUSE Security Update : ImageMagick (openSUSE-2018-598)

This update for ImageMagick to version 7.0.7-34 fixes the following issues : The following security issue was fixed : - Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts. The following non-security issues were fixed : - Added support for reading eXIf chun...

Security update for ImageMagick (moderate)

This update for ImageMagick to version 7.0.7-34 fixes the following issues: The following security issue was fixed: - Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts. The following non-security issues were fixed: - Added support for reading eXIf chunks ...

Microsoft Office - Composite Moniker Remote Code Execution Exploit

Exploit for windows platform in category local exploits What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the...

compositesolutions.ch XSS vulnerability

Open Bug Bounty ID: OBB-523899 Description| Value ---|--- Affected Website:| compositesolutions.ch Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

Microsoft Office - Composite Moniker Remote Code Execution

Microsoft Office - Composite Moniker Remote Code Execution What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using th...

Digium Asterisk Open Source and Certified Asterisk Remote Denial of Service Vulnerabilities

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. A remote denial of service vulnerability exis...

chromium-browser: cross origin information disclosure in skia

Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

[SECURITY] Fedora 26 Update: ImageMagick-6.9.9.22-1.fc26

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

[SECURITY] Fedora 27 Update: ImageMagick-6.9.9.22-1.fc27

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

[SECURITY] Fedora 27 Update: ImageMagick-6.9.9.13-1.fc27

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

SAP Composite Application Framework Authorization Tool XML External Entity Injection Vulnerability

SAP Composite Application Framework is the German SAP SAP company integrated SAP NetWeaver to create composite applications for the software. An XML external entity injection vulnerability exists in the SAP Composite Application Framework Authorization Tool. An attacker could exploit this...

UBUNTU-CVE-2015-8875

Multiple integer overflows in the 1 pixopscompositenearest, 2 pixopscompositecolornearest, and 3 pixopsprocess functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted image, whi...

gdk-pixbuf integer overflow vulnerability (CNVD-2016-03336)

gdk-pixbuf is a toolkit for image loading and pixel buffer processing. An integer overflow vulnerability exists in gdk-pixbuf's 'pixopscompositenearest', 'pixopscompositecolornearest', and 'pixopsprocess' functions contain an integer overflow vulnerability. An attacker could exploit this...

UBUNTU-CVE-2016-2194

The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service infinite loop via unspecified input to the OS2ECP function, related to a composite modulus...

CVE-2016-2194

The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service infinite loop via unspecified input to the OS2ECP function, related to a composite modulus...