Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...

CVE-2018-12938

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-17833. Reason: This candidate is a duplicate of CVE-2017-17833. Notes: All CVE users should reference CVE-2017-17833 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2018-12938

This CVE entry is rejected/not used per the Initial Description.

UBUNTU-CVE-2018-12938

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-17833. Reason: This candidate is a duplicate of CVE-2017-17833. Notes: All CVE users should reference CVE-2017-17833 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2018-12938

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-17833. Reason: This candidate is a duplicate of CVE-2017-17833. Notes: All CVE users should reference CVE-2017-17833 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

Cross site request forgery (csrf)

Tooltipy tooltips for WP version 5 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1...

CVE-2018-1000505

Tooltipy tooltips for WP version 5 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1...

CVE-2018-1000505

Tooltipy tooltips for WP version 5 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1...

CVE-2018-1000505

Tooltipy tooltips for WP version 5 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1...

CVE-2018-1000505

Tooltipy (tooltips for WP) version 5 contains a Cross-Site Request Forgery (CSRF) vulnerability in the Settings page that could allow an attacker to cause a post to be duplicated. The issue is exploitable via a link the admin must follow, and affects the plugin’s 5.x line. It is stated to be fixe...

CVE-2018-1000505: Cross-Site Request Forgery (CSRF)

Tooltipy tooltips for WP version 5 contains a Cross ite Request Forgery CSRF vulnerability in Settings page that can result in could allow anybody to duplicate posts. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1...

PT-2018-9403

Name of the Vulnerable Software and Affected Versions Tooltipy tooltips for WP version 5 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Settings page, which could allow anybody to duplicate posts. This attack appears to be exploitable via an Admin...

CVE-2018-1000522

CVE-2018-1000522 is a reservation duplicate of CVE-2018-10364 and, per linked records, relates to a Cross-Site Scripting issue in BigTree CMS prior to version 4.2.22. The root cause is an XSS vulnerability on the Users management page via the name or company field. Affected product: BigTree CMS; ...

CVE-2018-1000545

jpegoptim 1.4.5 is vulnerable due to an invalid use of realloc() and free() in jpegoptim.c, which can cause a denial of service. This CVE is CVE-2018-11416; CVE-2018-1000545 is a reservation duplicate of that entry. A fix is available in jpegoptim 1.4.6. No exploitation or in-the-wild details are...

CVE-2018-10848

CVE-2018-10848 is a reserved duplicate of CVE-2018-12532; the connected records provide concrete details under CVE-2018-12532: Red Hat JBoss RichFaces 4.5.3–4.5.17 allow unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java cod...

CVE-2018-10849

CVE-2018-12533 is a RichFaces EL-injection vulnerability in Red Hat JBoss RichFaces 3.1.0–3.3.4 that allows remote, unauthenticated attackers to inject EL expressions and execute arbitrary Java code via a crafted /DATA/ path in a Paint2DResource.ImageData object (RF-14310). The CVE-2018-10849 ent...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10531. Reason: This candidate is a reservation duplicate of CVE-2016-10531. Notes: All CVE users should reference CVE-2016-10531 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2016-1000013

CVE-2016-1000013 is a reserved/duplicate entry of CVE-2016-10531 and is not an active vulnerability entry. The connected documents confirm that the underlying issue is a cross-site scripting vulnerability in the Node.js marked module (marked

CVE-2016-1000025

CVE-2016-1000025 is a reservation duplicate of CVE-2016-10542. The connected records provide concrete detail for the active entry: CVE-2016-10542, which affects the ws Node.js websocket library (versions <= 1.1.0) and allows a remote attacker to crash the process by sending an oversized payloa...

Security Bulletin: There are potential Cross Site Scripting (XSS) vulnerabilities in the Duplicate Detect component in Financial Transaction Manager (FTM) for Check Services (CVE-2018-1390)

Summary There are potential Cross Site Scripting XSS vulnerabilities in the Duplicate Detect component in Financial Transaction Manager FTM for Check Services Vulnerability Details CVEID: CVE-2018-1390 DESCRIPTION: IBM Financial Transaction Manager for Check Services for Multi-Platform is...