Valve: Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games.

The structure of the save file implies unpacking of temporary files with extensions .HL1, .HL2 and .HL3. In the code of command 'load', there is a check for invalid substrings, such as .., so unpacking the files into the top directories will not work. Also, it seems, there is a code for checking...

CVE-2018-1883

A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST API. IBM X-Force ID: 151969...

CVE-2018-1883

A problem within the IBM MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST API. IBM X-Force ID: 151969...

CVE-2018-1883

CVE-2018-1883 affects IBM MQ Console REST API in IBM MQ 9.0.2–9.0.5 and 9.1.0.0. The issue enables a denial-of-service condition preventing users from logging into the MQ Console REST API. The IBM bulletin indicates affected products and provides remediation: upgrade to IBM MQ V9.1.1 for the 9 CD...

RHEL 6 : openshift-console (RHSA-2012:1555)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:1555 advisory. - openshift-console: CSRF attack CVE-2012-5622 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Security Bulletin: IBM MQ Console could allow an attacker to execute a denial of service attack. (CVE-2018-1883)

Summary A problem within the IBM MQ Console REST API could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST API. Vulnerability Details CVEID: CVE-2018-1883 DESCRIPTION: A problem within the IBM MQ Console REST API could allow attackers t...

Google Chrome 71 Touts 43 Fixes, Fights Ad Abuse

Google officially lifted the curtain on Chrome 71 for Windows, Mac and Linux on Tuesday. The latest browser version touts new security features and a slew of fixes. Overall, Google issued 43 patches with the security update for Chrome 71. The newest version, 71.0.3578.80, included an array of hig...

RHEL 6 : rubygem-openshift-origin-console (RHSA-2015:1808)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:1808 advisory. OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud...

Security Bulletin: Potential cross-site scripting vulnerability in the WebSphere Application Server Admin Console shipped with Tivoli Integrated Portal (CVE-2018-1777)

Summary There is a potential cross-site scripting vulnerability in the WebSphere Application Server Admin Console. Vulnerability Details CVEID: CVE-2018-1777 DESCRIPTION: IBM WebSphere Application Server Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Security Policy Manager (CVE-2018-1777)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Tivoli Security Policy Manager TSPM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...

Oracle Secure Global Desktop Administration Console Cross-Site Scripting Vulnerability

Oracle Secure Global Desktop SGD is a desktop virtualization product from Oracle Corporation. It allows users to access server-hosted applications and desktops.Administration Console is one of the administration console programs. A cross-site scripting vulnerability exists in the helpwindow.jsp...

Unable to remove store from StoreFront console

event 0: "An error occurred while running the command :'Remove-DSStore2' Cannot bind argument to the parameter 'VirtualPath' because it is an empty string...

CVE-2018-11076

Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance IDPA 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client...

CVE-2018-11076

Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance IDPA 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client...

CVE-2018-19547

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

Code injection

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

CVE-2018-19547

CVE-2018-19547 affects JTBC(PHP) 3.0.1.7 with a reflected/stored XSS in the console/xml/manage.php?type=action&action=edit content parameter. The root cause is an improper handling of the content parameter in that endpoint, enabling injection of arbitrary JavaScript/HTML. The connected documents ...

Oracle Secure Global Desktop Administration Console 4.4 Cross Site Scripting Vulnerability

Oracle Secure Global Desktop Administration Console version 4.4 build 20080807152602 suffers from cross site scripting vulnerabilities. alert"XSS" helpFile=concepts.html&pageTitle=Administrator Help&mastheadUrl=/images/productNameSecondaryMasthead.png&mastheadDescription=Sun Secure Global Desktop...