CVE-2018-12422

CVE-2018-12422 – Evolution-Data-Server (GNOME Evolution) Affected: addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server, GNOME Evolution up to version 3.29.2. Root cause: Unsafe use of strcat on a constructed string, leading to a potential buffer overflow. Impact (per sources)...

CVE-2018-12422: Improper Restriction of Operations within the Bounds of a Memory Buffer

addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the...

IBM DB2 Data Server Driver for JDBC and SQLJ Injection Vulnerabilities

IBM DB2 is a relational database management system from IBM in the United States. The system's execution environments are mainly UNIX, Linux, IBM i, z/OS, and Windows server versions.Data Server Driver for JDBC and SQLJ is one of the data server drivers. A security vulnerability exists in Data...

CVE-2017-1677

IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999...

Design/Logic Flaw

IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999...

CVE-2017-1677

IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999...

CVE-2017-1677

CVE-2017-1677 affects IBM DB2 family via unsafe deserialization in the Data Server Driver for JDBC/SQLJ. The vulnerability occurs when the driver deserializes /tmp/connlicj.bin, enabling object injection and potentially arbitrary code execution depending on the classpath. Affected products/versio...

CVE-2017-1677

IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999...

CVE-2017-1677: Deserialization of Untrusted Data

IBM Data Server Driver for JDBC and SQLJ IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999...

Security Bypass Vulnerabilities in Multiple Cisco Products

Cisco TelePresence Video Communication Server VCS and Cisco Expressway are both telepresence video communication servers from Cisco that integrate with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communicatio...

evolution-data-server: IMAPx Component Information Disclosure

camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensiti...

Moderate: Red Hat Bug Fix Advisory: evolution-data-server bug fix update

An update for evolution-data-server is now available for Red Hat Enterprise Linux 7. The evolution-data-server packages provide a unified back end for applications which interact with contacts, tasks and calendar information. Evolution Data Server was originally developed as a back end for the...

dataserver.be XSS vulnerability

Vulnerable URL: http://www.dataserver.be/apps/login.asp?username=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 20:19 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Oracle: Security Advisory (ELSA-2007-0510)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2009-0354)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2007-0344)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2013-1540)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-5427

CVE-2014-5427 affects Johnson Controls Metasys 4.1–6.5 (ADS, ADX, LCS8520, NAE 55xx-x, NIE 5xxx-x, NxE8500). A remote, unauthenticated attacker can read password hashes via a POST request, exposing credentials and affecting confidentiality. Connected sources indicate multiple advisories and a pat...

CVE-2014-5427: Exposure of Sensitive Information to an Unauthorized Actor

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

SuSE 11.3 Security Update : evolution-data-server (SAT Patch Number 9969)

evolution-data-server has been updated to disable support for SSLv3. This security issues has been fixed : - SSLv3 POODLE attack CVE-2014-3566 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information...