Security Bulletin: IBM PureApplication System is affected by vulnerabilities in VMWare component (CVE-2018-6981 CVE-2018-6982)

Summary There are vulnerabilities reported in the VMWare component that is used by IBM PureApplication System. IBM has released Version 2.2.5.3 for IBM PureApplication System, in response to CVE-2018-6981 and CVE-2018-6982. The following vulnerabilities have been addressed by IBM PureApplication...

Security Bulletin: Multiple Foreshadow Spectre Variant vulnerabilities affect IBM OS Image for Red Hat Linux Systems in IBM PureApplication System (CVE-2018-3615 CVE-2018-3620 CVE-2018-3646)

Summary There are multiple vulnerabilities that affect the IBM OS Image for Red Hat Linux Systems in IBM PureApplication System. IBM has released Version 2.2.5.3 for IBM PureApplication System, in response to CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646. The products that are identified for th...

Kibana ESA-2018-06

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross- site scripting XSS vulnerability. Users with manageml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructi...

Security Bulletin: A vulnerability in IBM Websphere affects IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2016-0306)

Summary There is a potential security vulnerability in IBM WebSphere Application Server, which is used by IBM Tivoli Netcool Configuration Manager ITNCM. The potential vulnerability is only applicable, if 'FIPS 140-2' is enabled. Vulnerability Details CVEID: CVE-2016-0306 DESCRIPTION: IBM WebSphe...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 6 security and bug fix update

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Cross-Site Scripting in Language Pack Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...

Cross-Site Scripting in Language Pack Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...

Cross-Site Scripting in Language Pack Handling

Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting...

January 22, 2019—KB4476976 (OS Build 17763.292)

None None...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2018-1770)

Summary IBM WebSphere Application Server is shipped as a component of IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the...

Denial Of Service (DoS) Memory Consumption, Arbitrary Code Execution And Object-injection Attacks

activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a...

Cross-site Scripting (XSS)

The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle newline characters, which makes it easier for remote attackers to condu...

The vulnerability affects the Microsoft Graphics component in the Microsoft Excel Viewer, Microsoft Office applications and Office 365, the Microsoft Office Compatibility Pack, the Microsoft Windows operating system, the Microsoft PowerPoint Viewer for presentation viewing, and the Microsoft Office Word Viewer for document reading. This allows an attacker to execute arbitrary code.

The vulnerability of the Microsoft Graphics component in the Microsoft Excel Viewer, a spreadsheet software; Microsoft Office and Office 365 applications; the Microsoft Office Compatibility Pack; the Microsoft Windows operating system; the Microsoft PowerPoint Viewer, a presentation software; and...

Microsoft Visual Studio Information Disclosure Vulnerability

Microsoft Visual Studio is a family of development tool suites from Microsoft and a largely complete set of development tools that includes most of the tools needed throughout the software lifecycle. An information disclosure vulnerability exists in Microsoft Visual Studio 2010 SP1 and Visual...

Microsoft Word 2013 Service Pack 1 Multiple Vulnerabilities (KB4461594)

This host is missing an important security update according to Microsoft KB4461594 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Excel Viewer 2007 Service Pack 3 Remote Code Execution Vulnerability (KB2596760)

This host is missing an important security update according to Microsoft KB2596760 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Office 2010 Service Pack 2 Information Disclosure Vulnerability (KB4461614)

This host is missing an important security update according to Microsoft KB4461614 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Office 2013 Service Pack 1 Remote Code Execution Vulnerability (KB3172522)

This host is missing an important security update according to Microsoft KB3172522 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Word 2010 Service Pack 2 Multiple Vulnerabilities (KB4461625)

This host is missing an important security update according to Microsoft KB4461625 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Outlook 2013 Service Pack 1 Information Disclosure Vulnerability (KB4461595)

This host is missing an important security update according to Microsoft KB4461595 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...