PT-2018-18558 · Microsoft · Powershell Editor +2

Name of the Vulnerable Software and Affected Versions: PowerShell Editor Services affected versions not specified PowerShell Editor affected versions not specified PowerShell Extension affected versions not specified Description: A remote code execution issue exists in PowerShell Editor Services...

PT-2018-12217 · Htslib · Htslib

Name of the Vulnerable Software and Affected Versions: HTSlib version 1.8 Description: An issue has been found in HTSlib, which is a memory leak in fai read in faidx.c. It has been disputed that this issue exists in the test harness and that HTSlib users would be aware of the need to destruct the...

PT-2018-18533 · Microsoft · Browsers +2

Name of the Vulnerable Software and Affected Versions: Microsoft browsers affected versions not specified Description: A remote code execution issue exists in the way the scripting engine handles objects in memory in Microsoft browsers. This could corrupt memory, allowing an attacker to execute...

PT-2018-2475 · Linux +2 · Linux +2

Name of the Vulnerable Software and Affected Versions: Linux affected versions not specified Description: The issue is caused by a buffer overflow in the Linux operating system kernel. Exploitation of this issue may allow an attacker to cause a denial of service. Recommendations: At the moment,...

CVE-2018-1000621

Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for Linux and "non-enclosure" installs - Mark 1 and Picroft unaffected. This attack appear to be...

PT-2018-11871 · Ethereum · Naga

Name of the Vulnerable Software and Affected Versions: naga affected versions not specified Description: The issue concerns an integer overflow in the mintToken function of a smart contract implementation for naga, an Ethereum token. This overflow allows the owner of the contract to set the balan...

PT-2018-11813 · Erik De Castro Lopo +1 · Libsndfile +1

Name of the Vulnerable Software and Affected Versions: libsndfile version 1.0.28 Description: There is a reported memory leak in the psf allocate function in common.c, as demonstrated by sndfile-convert. However, the maintainer and third parties were unable to reproduce the issue and it has been...

PT-2018-16187 · Ruby · Ruby-Grape

Name of the Vulnerable Software and Affected Versions: ruby-grape affected versions not specified Description: The ruby-grape ruby gem suffers from a cross-site scripting XSS vulnerability via the format parameter. This issue allows for potential XSS attacks. Recommendations: At the moment, there...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Algo One - Core

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.15 and earlier and 8.0.5.7 and earlier and IBM® Runtime Environment Java™ Version 7.0.10.15 and earlier and 8.0.5.7 and earlier used by IBM Algo One - Core. These issues were disclosed as part of the I...

PT-2018-8792 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perfo...

Security Bulletin: Vulnerability in cpio affects PowerKVM (CVE-2014-9112)

Summary A vulnerability in GNU cpio CVE-2014-9112 affects PowerKVM. Vulnerability Details CVEID: CVE-2014-9112 DESCRIPTION: GNU cpio is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the processcopyin function. By persuading a victim to extract a specially-craft...

Security Bulletin: Vulnerabilities in Python affect PowerKVM (CVE-2013-5123, CVE-2014-8991)

Summary PowerKVM is affected by two vulnerabilities in Python. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2013-5123 DESCRIPTION: Python pip could allow a remote attacker to bypass security restrictions, caused by the implementation of the mirroring support without...

Security Bulletin: PowerKVM is affected by flac vulnerabilities (Multiple CVEs)

Summary PowerKVM is affected by multiple flac vulnerabilities. Vulnerability Details CVEID: CVE-2014-8962 DESCRIPTION: The libFLAC library, which is used to process FLAC Free Lossless Audio Codec files is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM Storwize V7000 Unified (CVE-2017-1000366)

Summary IBM Storwize V7000 Unified is shipped with GNU glibc, for which a fix is available for a security vulnerability. Vulnerability Details A GNU C library glibc memory corruption vulnerability affects IBM Storwize V7000 Unified. CVEID: CVE-2017-1000366 DESCRIPTION: Glibc could allow a local...

Security Bulletin: Arcfour vulnerability issue in IBM Storwize V7000 Unified

Summary IBM Storwize V7000 Unified was shipped with Arcfour which uses weak client-to-server encryption algorithms, for which fix is available. Vulnerability Details CVEID: CVE-2017-1375 DESCRIPTION: IBM System Storage Storwize V7000 Unified V7000U uses weaker than expected cryptographic algorith...

Security Bulletin: Unauthorized privileges can be obtained from IBM Service account on IBM SONAS (CVE-2014-3043)

Summary A fix is available for IBM SONAS, for the security issue that unauthorized privileges can be obtained from IBM Service account. Vulnerability Details CVEID: CVE-2014-3043 DESCRIPTION: The IBM SONAS service account can be used to obtain unauthorized privileges on a IBM SONAS system. The...

Security Bulletin: Fix available for Sensitive Data Exposure Vulnerability in IBM Cúram Social Program Management (CVE-2016-9978)

Summary IBM Cúram Social Program Management is vulnerable to an already authenticated user bypassing the Security Sensitivity controls via a specially crafted URL. This allows an attacker to view information for certain business objects tagged with higher sensitivity than their current sensitivit...

Security Bulletin: Fix available for DOM based Cross Site Scripting (XSS) Vulnerability in IBM Cúram Social Program Management (CVE-2016-9979)

Summary IBM Cúram Social Program Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker might exploit this vulnerability by using a specially crafted URL to run a script in a victim's web browser. Vulnerability Details CVEID:...

Security Bulletin: An unspecified vulnerability in Oracle Java SE affects IBM Algo One Algo Risk Application (CVE-2017-10115)

Summary An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in the GSKit component of IBM DataPower Gateways (CVE-2016-0201)

Summary IBM DataPower Gateways uses GSKit in certain modules - namely MQ, ISAM/TAM, JMS. A vulnerability has been addressed in the GSKit component of IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive...