Security Bulletin: Rational Functional Tester Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Summary Java API Documentation contains a frame injection vulnerability. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVEID: CVE-2013-1571...

The vulnerability in the IBM SDK development tools arises from an incorrect limitation on the path name to the restricted access catalog. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the IBM SDK development tools exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the integrity of protected information during the extraction o...

The vulnerability of the urllib module in the Python programming language, related to deficiencies in pathname restrictions, allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the urllib module in the Python programming language is related to errors in input validation. Exploiting this vulnerability allows an attacker to gain access to confidential data and compromise its integrity...

PT-2019-5073

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 74.0.3729.108 Description The issue is related to a process lifetime problem in Google Chrome on Android, which could allow a remote attacker to potentially persist an exploited process via a crafted...

The vulnerability of the libcurl library, caused by buffer overflows in the stack, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Curlauthcreatentlmtype3message function, which creates the NTLM type-3 header lib/vauth/ntlm.c, from the libcurl library, is due to a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the software platform for integrating Spring Integration corporate applications lies in improper restrictions on XML references to external objects. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the software platform for integrating Spring Integration corporate applications is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility o...

PT-2019-3435

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 74.0.3729.131 Description The issue is related to a parameter passing error in the media player of Google Chrome, which can be exploited by a remote attacker using a crafted HTML page. This could potentially lea...

The vulnerability of Junos OS’ firewall filter configuration allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of Junos OS’ firewall filter configuration is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the mod_session module in the Apache HTTP Server, related to the lack of consideration for the lifetime of a session, allows attackers to compromise the integrity of protected data.

The vulnerability of the modsession module in the Apache HTTP Server is related to the lack of time-out checking before session data is decoded. Exploiting this vulnerability allows an attacker to compromise the integrity of protected data...

A vulnerability in the PHP programming language interpreter, related to reading beyond the buffer boundaries of dynamic memory, allows attackers to cause service failures, violate confidentiality, and compromise the integrity of protected data.

The vulnerability in the PHP programming language interpreter relates to reading beyond the buffer boundaries during the processing of regular expressions. Exploiting this vulnerability can allow a malicious actor to cause service failures, violate the confidentiality and integrity of protected...

The vulnerability of the wget console program for downloading files over the network is related to the UNIX utility commands in the BusyBox. This vulnerability stems from the operation of writing out data beyond the buffer limit into dynamic memory, allowing an attacker to compromise the integrity and accessibility of data, as well as to cause service failures.

The vulnerability of the wget console program for downloading files over the network is related to a buffer overflow vulnerability in dynamic memory. Exploiting this vulnerability allows an attacker to compromise the integrity and accessibility of data, as well as to cause service interruptions...

The vulnerability of the IonMonkey JavaScript compiler for Firefox and Firefox ESR browsers lies in a type conversion error, which allows attackers to compromise the integrity of protected data.

The vulnerability of the IonMonkey compiler for Firefox and Firefox ESR browsers lies in a type conversion error when accessing arbitrary objects during compilation. Exploiting this vulnerability allows an attacker to compromise the integrity of protected data locally...

The vulnerability of the coTURN server, related to configuration errors, allows attackers to compromise data integrity.

The vulnerability of the coTURN server is related to a configuration error that causes external traffic to be redirected to the backend interface of its own host. Exploiting this vulnerability allows an attacker to compromise the integrity of data...

PT-2019-5743

Name of the Vulnerable Software and Affected Versions libseccomp-golang versions 0.9.0 and earlier Description The issue is related to the incorrect generation of BPFs by libseccomp-golang, where multiple arguments are ORed instead of ANDed. This allows a process to bypass intended access...

CVE-2019-2424

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

Buffer overflow

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware subcomponent: Outside In Filters. Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Code injection

Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite subcomponent: Renewals. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2019-2706

Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware subcomponent: BPM Foundation Services. The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2719

CVE-2019-2719 affects Oracle Siebel CRM Knowledge component (InfoCenter/Web Applications). Affected: 8.5.1.0–8.5.1.7, 8.6.0, 8.6.1. An unauthenticated attacker can exploit via HTTP; attacks require user interaction and may lead to unauthorized update/insert/delete and read access of Oracle Knowle...

CVE-2019-2660

Vulnerability in the Oracle Knowledge Management component of Oracle E-Business Suite subcomponent: Setup, Admin. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker wi...