Security Bulletin: IBM Security Directory Suite vulnerable to information disclosure (CVE-2018-15473)

Summary Security vulnerability that could allow a remote attacker to obtain sensitive information, has been fixed and delivered in IBM Security Directory Suite. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused b...

Security Bulletin: A vulnerability in IBM Spectrum Scale packaged in IBM Elastic Storage System could cause a denial of service (CVE-2020-4756)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage System that could allow a local attacker to cause a denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4756 DESCRIPTION: IBM Spectrum Scale could allow a loca...

PT-2020-4391 · Microsoft · 3D Viewer

Name of the Vulnerable Software and Affected Versions: 3D Viewer affected versions not specified Description: A remote code execution issue exists due to improper memory handling by the Base3D rendering engine. An attacker who successfully exploits this issue could gain execution on a victim...

PT-2020-4320 · Microsoft · Windows Backup Service +1

Name of the Vulnerable Software and Affected Versions: Windows Backup Service affected versions not specified Description: The issue is related to an elevation of privilege vulnerability that exists when the Windows Backup Service improperly handles file operations. To exploit this, an attacker...

PT-2020-4390 · Microsoft · Visual Studio Code

Name of the Vulnerable Software and Affected Versions: Visual Studio Code affected versions not specified Description: A remote code execution issue exists when the Python extension loads a Jupyter notebook file, allowing an attacker to run arbitrary code in the context of the current user. If th...

PT-2020-4283 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: A remote code execution issue exists in Microsoft Excel software due to improper handling of objects in memory. An attacker who successfully exploits this issue could run arbitrary...

PT-2020-4332 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: A remote code execution issue exists in Microsoft Office software due to improper handling of objects in memory. An attacker who successfully exploits this issue could run arbitrar...

PT-2020-4317 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook affected versions not specified Description: The issue is related to a denial of service vulnerability in Microsoft Outlook software. This vulnerability occurs when the software fails to properly handle objects in memory,...

PT-2020-4388 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 on-premises affected versions not specified Description: A cross-site scripting issue exists due to improper sanitization of specially crafted web requests. An authenticated attacker could exploit this by sending a...

PT-2020-4331 · Microsoft · Windows Error Reporting +1

Name of the Vulnerable Software and Affected Versions: Windows Error Reporting WER affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in Windows Error Reporting WER when it handles and executes files. This could allow an attacker to gain...

PT-2020-4333 · Microsoft · Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Microsoft Hyper-V affected versions not specified Description: A denial of service issue exists due to improper validation of malicious data from a user on a guest operating system. An attacker with a privileged account on a guest operating...

PT-2020-14463 · Smarter · Smarter Coffee Maker

Name of the Vulnerable Software and Affected Versions: Smarter Coffee Maker versions before 2nd generation Description: The issue allows firmware replacement without authentication or authorization. User interaction is required to press a button. This problem only affects products that are no...

Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Simultaneous Multi-threading SMT in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port...

PT-2022-8872 · Upx +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 4.0.0 Description: A memory-related issue was found in the adjABS function within the p lx elf.cpp file of UPX, which can be triggered by a specially crafted Mach-O file. Recommendations: For UPX version 4.0.0, at the moment, ther...

PT-2020-4183 · Cisco · Cisco Ios Xe Rom Monitor (Rommon)

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE ROM Monitor ROMMON Software for Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services Routers, Cisco ASR 1000 Series Aggregation Services Routers, and Cisco cBR-8 Converged Broadband Routers...

PT-2020-4085 · Microsoft · Diagnostics Hub Standard Collector Service +1

Name of the Vulnerable Software and Affected Versions: Diagnostics Hub Standard Collector Service affected versions not specified Description: The issue is related to improper handling of file operations by the Diagnostics Hub Standard Collector, which can lead to elevation of privilege. An...

PT-2020-3895 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: An information disclosure issue exists due to improper handling of objects in memory by StartTileData.dll. This could allow an attacker to obtain information that could further compromise t...

PT-2020-4155 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: An information disclosure issue exists due to the Windows kernel's improper handling of objects in memory. This could allow an attacker to obtain information that could be used to further...

PT-2020-3899 · Microsoft · Windows Shell +1

Name of the Vulnerable Software and Affected Versions: Windows Shell affected versions not specified Description: The issue is related to the improper handling of objects in memory by the Shell infrastructure component, allowing an attacker to potentially run processes in an elevated context. To...

PT-2020-4023 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: A cross-site-scripting XSS issue exists due to improper sanitization of specially crafted web requests. An attacker could exploit this by sending a crafted request,...