AIX 6.1 TL 9 : bind (IV84984) (deprecated)

https://vulners.com/cve/CVE-2016-1285 ISC BIND is vulnerable to a denial of service, caused by the improper handling of control channel input. By sending a specially crafted packet, a remote attacker could exploit this vulnerability to trigger an assertion failure in sexpr.c or alist.c and cause...

AIX 5.3 TL 12 : bind (IV85298) (deprecated)

https://vulners.com/cve/CVE-2016-1285 ISC BIND is vulnerable to a denial of service, caused by the improper handling of control channel input. By sending a specially crafted packet, a remote attacker could exploit this vulnerability to trigger an assertion failure in sexpr.c or alist.c and cause...

AIX 6.1 TL 9 : bind (IV81279) (deprecated)

ISC BIND is vulnerable to a denial of service, caused by improper bounds checking in apl42.c. By sending specially crafted Address Prefix List APL data, a remote authenticated attacker could exploit this vulnerability to trigger an INSIST assertion failure and cause the named process to terminate...

AIX 7.1 TL 4 : ntp (IV79944) (deprecated)

Network Time Protocol NTP is vulnerable to a denial of service, caused by an error in the sntp program. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause the application to enter into an infinite loop. Network Time...

AIX 7.2 TL 0 : ntp (IV79945) (deprecated)

Network Time Protocol NTP is vulnerable to a denial of service, caused by an error in the sntp program. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause the application to enter into an infinite loop. Network Time...

CVE-2015-5024

The CVE-2015-5024 entry concerns IBM Emptoris Sourcing, affecting multiple 10.0.x releases (e.g., 10.0.2.0, 10.0.2.2, 10.0.2.3, 10.0.2.5–10.0.2.7, and 10.0.4.x) with remote authenticated access that can disclose sensitive supplier-bid information via unspecified vectors. The underlying cause is a...

Command injection

The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors...

CVE-2015-1974

CVE-2015-1974 affects IBM Tivoli/Security Directory Server: the web administration tool permits an authenticated remote user to bypass command restrictions. Affected products/versions include IBM Tivoli Directory Server 6.0 (iFix 75+), 6.1 (iFix 68+), 6.2 (iFix 44+), 6.3 (iFix 37+), 6.3.1 (iFix 1...

CVE-2015-2019

The CVE-2015-2019 issue affects IBM Tivoli Security Directory Server / IBM Security Directory Server where SSL pages can be cached, enabling a local attacker with physical access to obtain sensitive information from an unattended workstation. Affected versions (per initial description): IBM Tivol...

CVE-2013-5445

IBM Cognos Express contains CVE-2013-5445 where encrypted credentials can be remotely retrieved from the server due to knowledge of a static decryption key. Affected products/versions include Cognos Express 9.0 before IFIX 2, 9.5 before IFIX 2, 10.1 before IFIX 2, and 10.2.1 before FP1. IBM’s bul...

CVE-2013-6729

Cross-site scripting XSS vulnerability in IBM QuickFile 1.0.0.0 before iFix 4 and 1.1.0.1 before iFix 3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-6729

The provided data confirms a concrete XSS vulnerability (CVE-2013-6729) in IBM QuickFile. Affected versions are IBM QuickFile 1.0.0.0 prior to iFix 4 and 1.1.0.1 prior to iFix 3. The flaw allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, indicating a clie...

Cross site scripting

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

CVE-2013-5421

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

Catapult Software DNP3 Driver Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 24, 2013, and is now being released to the NCCIC/ICS-CERT Web site. Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation in Catapult Software’s DN...

GE Proficy DNP3 Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 24, 2013, and is now being released to the NCCIC/ICS-CERT Web site. General Electric GE Intelligent Platforms reported to NCCIC/ICS-CERT an improper input validation vulnerability in the DNP3 driver used...

GE Proficy Historian ihDataArchiver.exe Multiple Opcode Parsing Remote Code Execution Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE iFix. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ihDataArchiver.exe process which listens by default on TCP port 14000. Several errors are...

CVE-2012-2515

Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module aka the HTML Help component, as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian 3.1...

CVE-2012-2516

The CVE-2012-2516 issue is an ActiveX-based command-injection vulnerability in KeyHelp.ocx of GE Intelligent Platforms’ KeyWorks KeyHelp module, affecting Proficy Historian (3.1, 3.5, 4.0, 4.5), Proficy HMI/SCADA – iFIX (5.0, 5.1), Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Drive...

CVE-2012-2515

CVE-2012-2515 describes multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control (KeyHelp.ocx 1.2.312) in the KeyWorks KeyHelp Module (HTML Help component). The flaws allow remote code execution via a long string passed to the (1) JumpMappedID or (2) JumpURL methods, affecti...