CVE-2013-3710

SUSE Lifecycle Management Server SLMS before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere...

CVE-2013-3710

SUSE Lifecycle Management Server SLMS before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere...

CVE-2013-7042

SUSE Lifecycle Management Server SLMS before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors...

CVE-2013-7042

CVE-2013-7042 affects SUSE Lifecycle Management Server (SLMS) prior to version 1.3.7. The issue is that secret keys are stored with world-readable permissions, enabling local users to gain privileges through unspecified vectors. The affected component is the SLMS secret key storage mechanism; roo...

CVE-2013-3710

The provided documents identify CVE-2013-3710 as affecting SUSE Lifecycle Management Server (SLMS) before version 1.3.7. The root cause is that SLMS does not generate a new secret key when the service starts, enabling remote attackers to defeat intended cryptographic protections by deriving knowl...

PT-2013-6250

Name of the Vulnerable Software and Affected Versions SUSE Lifecycle Management Server SLMS versions prior to 1.3.7 Description The issue allows local users to gain privileges due to world-readable permissions for secret keys. Recommendations For versions prior to 1.3.7, update to version 1.3.7 o...

PT-2013-4577

Name of the Vulnerable Software and Affected Versions SUSE Lifecycle Management Server SLMS versions prior to 1.3.7 Description The issue allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of a secret key from a product installation elsewhere, d...

CVE-2013-7042: Undefined Security Weakness

SUSE Lifecycle Management Server SLMS before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors...

CVE-2013-3710: Undefined Security Weakness

SUSE Lifecycle Management Server SLMS before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere...

HP Application Lifecycle Management GossipService SOAP Request Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Application Lifecycle Management. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service named GossipServiceSoapBinding. This web service i...

[security bulletin] HPSBMU02932 rev.1 - HP Application LifeCycle Management, ALM client component, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969433 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969433 Version: 1 HPSBMU02932 rev....

[security bulletin] HPSBMU02934 rev.1 - HP Application LifeCycle Management, GossipService SOAP Request, Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03969436 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03969436 Version: 1 HPSBMU02934 rev....

Design/Logic Flaw

Unspecified vulnerability in the client component in HP Application LifeCycle Management ALM before 11 p11 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1327...

CVE-2013-4836

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

PT-2013-5232

Name of the Vulnerable Software and Affected Versions HP Application LifeCycle Management ALM versions prior to 11 p11 Description The issue allows remote attackers to execute arbitrary code. The exact vectors used for the attack are not specified. Recommendations For versions prior to 11 p11,...

CVE-2013-4836: Undefined Security Weakness

Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management ALM allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1759...

CVE-2013-4834: Undefined Security Weakness

Unspecified vulnerability in the client component in HP Application LifeCycle Management ALM before 11 p11 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1327...

PT-2013-5234

Name of the Vulnerable Software and Affected Versions HP Application LifeCycle Management versions prior to 1.4.2 Description The issue allows remote attackers to execute arbitrary code via unknown vectors. This is related to an unspecified vulnerability in the GossipService SOAP Request...

CVE-2013-4810

HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager IDM 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplica...

Design/Logic Flaw

HP ProCurve Manager PCM 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager IDM 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to 1 EJBInvokerServlet or 2 JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplica...