Security Bulletin: IBM MQ Appliance is affected by an OpenSSL vulnerability (CVE-2017-3736)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x8664 Montgomery squaring function bnsqrx8xinternal...

PT-2019-13572 · Pdfresurrect +2 · Pdfresurrect +2

Name of the Vulnerable Software and Affected Versions: PDFResurrect version 0.15 Description: The issue arises from a buffer overflow that occurs when PDFResurrect mishandles data associated with startxref and %%EOF in a crafted PDF file. Recommendations: For PDFResurrect version 0.15, at the...

CVE-2019-1010283

Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function dataonconnection in src/callback.c. The attack vector is: network connectivity. The fixed...

PT-2019-11441 · Gnu +1 · Glibc +1

Name of the Vulnerable Software and Affected Versions: glibc affected versions not specified Description: The issue concerns a mitigation bypass in glibc, allowing an attacker to potentially guess the heap addresses of pthread-created threads. The vendor's stance is that ASLR bypass itself is not...

PT-2019-12884 · Zoho · Zoho Manageengine Assetexplorer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer affected versions not specified Description: An issue was discovered in Zoho ManageEngine AssetExplorer, where there is a cross-site scripting XSS issue via the ResourcesAttachments.jsp page with the pageName...

PT-2019-11746 · Jenkins · Jenkins Mashup Portlets Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mashup Portlets Plugin affected versions not specified Description: The issue concerns the storage of credentials in an unencrypted manner on the Jenkins master, making them accessible to users with file system access. Recommendations...

PT-2019-2722

Name of the Vulnerable Software and Affected Versions Windows AppX Deployment Service AppXSVC affected versions not specified Description The issue is related to the improper handling of hard links by the Windows AppX Deployment Service AppXSVC, which can lead to an elevation of privilege. This c...

PT-2019-2758 · Microsoft · Windows Remote Desktop Services +1

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Services affected versions not specified Description: A remote code execution issue exists in Remote Desktop Services due to insufficient input validation, allowing an attacker to execute arbitrary code. The vulnerabili...

PT-2019-13247 · Imagemagick +4 · Imagemagick +4

Name of the Vulnerable Software and Affected Versions: ImageMagick version 7.0.8-50 Q16 Description: The issue is related to memory leaks in ImageMagick due to an error in wand/mogrify.c. This error occurs at AcquireMagickMemory. Recommendations: For ImageMagick version 7.0.8-50 Q16, at the momen...

PT-2019-13249 · Open Source +4 · Libosinfo +4

Name of the Vulnerable Software and Affected Versions: libosinfo version 1.5.0 Description: The issue allows local users to discover credentials by listing a process. This occurs because credentials are passed to osinfo-install-script via the command line. There is no information available about...

PT-2019-18498 · Linear · Linear Emerge 50P/5000P

Name of the Vulnerable Software and Affected Versions: Linear eMerge 50P/5000P devices affected versions not specified Description: The issue allows for unauthenticated file upload. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

PT-2019-18496 · Linear · Linear Emerge 50P/5000P

Name of the Vulnerable Software and Affected Versions: Linear eMerge 50P/5000P devices affected versions not specified Description: The issue allows for authentication bypass. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2019-18491 · Linear · Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Linear eMerge E3-Series devices affected versions not specified Description: The issue concerns hard-coded credentials in the Linear eMerge E3-Series devices. Recommendations: At the moment, there is no information about a newer version that...

PT-2019-18499 · Linear · Linear Emerge 50P/5000P

Name of the Vulnerable Software and Affected Versions: Linear eMerge 50P/5000P devices affected versions not specified Description: The issue allows authenticated command injection with root code execution. Recommendations: At the moment, there is no information about a newer version that contain...

PT-2019-18489 · Linear · Linear Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Linear eMerge E3-Series devices affected versions not specified Description: The issue allows for Authorization Bypass with Information Disclosure. Recommendations: At the moment, there is no information about a newer version that contains a...

PT-2019-18505 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise affected versions not specified Description: The issue allows for Open Redirect, which could potentially be exploited by attackers to redirect users to malicious websites. Recommendations: At the moment, there is no...

PT-2019-18503 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise devices affected versions not specified Description: The issue allows Cross-Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application...

PT-2019-16900 · Ibm · Ibm Tivoli Netcool Impact

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Netcool/Impact version 7.1.0 Description: The issue allows for remote execution of commands by a low-privileged user, enabling remote code execution. This can lead to the execution of arbitrary code on the system, resulting in...

Security Bulletin: API Connect V2018 is impacted by sensitive information leak (CVE-2018-2013)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-2013 DESCRIPTION: IBM API Connect could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. CVSS Base Score: 5.3 CVSS Temporal Score: S...

GHSA-GC94-6W89-HPQR Command Injection in fs-path

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available...