Security Bulletin: IBM MQ Passwords specified by MQ java or JMS applications can appear in WebSphere Application Server trace. (CVE-2017-1284)

Summary Passwords specified by MQ java or JMS applications can appear in WebSphere Application Server trace when establishing CLIENT transport mode connections. Vulnerability Details CVEID: CVE-2017-1284 DESCRIPTION: IBM MQ could allow a local user with ability to run or enable trace, to obtain...

Security Bulletin: IBM MQ, IBM WebSphere MQ and IBM MQ Appliance Open Source zlib is vulnerable to a denial of service (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

Summary Open Source zlib is vulnerable to a denial of service. By persuading a user to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of...

Security Bulletin: IBM MQ and IBM MQ Appliance Shared memory leak caused by MQ applications using dynamic queues. (CVE-2017-1283)

Summary Shared memory leak caused by MQ applications using dynamic queues. Vulnerability Details CVEID: CVE-2017-1283 DESCRIPTION: IBM WebSphere MQ could allow an authenticated user to cause a shared memory leak by MQ applications using dynamic queues, which can lead to lack of resources for othe...

Security Bulletin: Cross-site request forgery in WebSphere Application Server (CVE-2017-1194)

Summary There is a potential cross-site request forgery in WebSphere Application Server OAuth service provider. Vulnerability Details CVEID: CVE-2017-1194 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious a...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Enterprise Content Management System Monitor

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM Enterprise Content Management System Monitor. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: A...

Security Bulletin: IBM MQ and IBM MQ Appliance invalid requests cause denial of service to SDR and CLUSSDR channels (CVE-2017-1285)

Summary An authenticated user with authority to send a specially crafted message could cause a SDR or CLUSSDR channel to remain in a running state but not process messages. Vulnerability Details CVEID: CVE-2017-1285 DESCRIPTION: IBM MQ could allow an authenticated user with authority to send a...

DEBIAN-CVE-2019-14438

A heap-based buffer over-read in xiphPackHeaders in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file...

UBUNTU-CVE-2019-14438

A heap-based buffer over-read in xiphPackHeaders in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file...

Servicing stack update for Windows 10 version 1903: August 27, 2019

None None...

Update for Windows Server 2008 SP2: August 16, 2019

Update for Windows Server 2008 SP2: August 16, 2019 Summary This non-security update for Windows Server 2008 SP2 includes the quality improvements from KB4512491 released August 16, 2019, in addition to these key changes: Addresses an issue in which the following may stop responding and you may...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Business Service Manager

Summary IBM WebSphere Application Server is shipped as a component of Tivoli Business Service Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Remot...

Coda: Use Github pack with Coda employee github account (search code of Coda's private repositories)

Summary: When you use the Github formula, the information from the Github API is returned by the endpoint https://coda.io/coda.CalcService/InvokeFormula. From what I understand, this endpoint expects a gRPC request. In the request is sent: the formula Github..CodeSearch, the version of the Github...

The Hidden Bee infection chain, part 1: the stegano pack

About a year ago, we described the Hidden Bee miner delivered by the Underminer Exploit Kit. Hidden Bee has a complex and multi-layered internal structure that is unusual among cybercrime toolkits, making it an interesting phenomenon on the threat landscape. That's why we're dedicating a series o...

Security Bulletin: Information disclosure in Apache Commons HttpClient may affect WebSphere Application Server as part of IBM InfoSphere Identity Insight (CVE-2012-5783)

Summary There is a potential information disclosure in Apache Commons HttpClient used by WebSphere Application Server shipped as part of IBM InfoSphere Identity Insight. Vulnerability Details CVEs: CVE-2012-5783 Link to security bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg22016216...

Security Bulletin: IBM StoredIQ is affected by a cross-site request forgery (CVE-2019-4167)

Summary IBM StoredIQ has addressed the following vulnerability: Cross-site request forgery. Vulnerability Details CVEID: CVE-2019-4167 DESCRIPTION: IBM StoredIQ is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from...

WordPress social-buttons-pack plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. social-buttons-pack plugin is a social sharing plugin used in it. A cross-site scripting vulnerability exists in WordPress...

Microsoft Outlook 2010 Service Pack 2 Multiple Vulnerabilities (KB4475573)

This host is missing an important security update according to Microsoft KB4475573 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Office 2010 Service Pack 2 Remote Code Execution Vulnerability (KB4475506)

This host is missing an important security update according to Microsoft KB4475506 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Outlook 2013 Service Pack 1 Multiple Vulnerabilities (KB4475563)

This host is missing an important security update according to Microsoft KB4475563 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Word 2013 Service Pack 1 Remote Code Execution Vulnerability (KB4475547)

This host is missing an important security update according to Microsoft KB4475547 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...