Description of the security update for SharePoint Server 2010: December 11, 2018

Description of the security update for SharePoint Server 2010: December 11, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microso...

Description of the security update for SharePoint Foundation 2013: December 11, 2018

Description of the security update for SharePoint Foundation 2013: December 11, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see...

Microsoft PowerPoint CVE-2018-8628 Remote Code Execution Vulnerability

Description Microsoft PowerPoint is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected...

KLA11883 ACE vulnerability in Microsoft Azure

A cross-site-scripting XSS vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2018-8652 Related products Microsoft-Windows Microsoft-Azure CVE list CVE-2018-8652 warning KB list 4480788 Solution Install...

Microsoft Windows Azure Pack CVE-2018-8652 Cross Site Scripting Vulnerability

Description Microsoft Windows Azure Pack is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Thi...

Security Bulletin: Potential cross-site request forgery in WebSphere Application Server Admin Console (CVE-2018-1926)

Summary There is a potential cross-site request forgery in WebSphere Application Server Admin Console CVE-2018-1926 Vulnerability Details CVEID: CVE-2018-1926 DESCRIPTION: IBM WebSphere Application Server Admin Console is vulnerable to cross-site request forgery, caused by improper validation of...

Security Bulletin: A vulnerability in IBM Java Runtime affect Rational Asset Analyzer (RAA).

Summary A vulnerability in IBM® Runtime Environment Java™ Version 8.0.5.15 used by Rational Asset Analyzer. Rational Asset Analyzer has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS Liberty vulnerability.

Summary Rational Asset Analyzer has addressed the following vulnerability. IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM...

Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos Insight (CVE-2018-1656, CVE-2018-0732, CVE-2018-12539, )

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Cognos Insight. These issues were disclosed as part of the IBM Java SDK updates in July 2018. An Open Source OpenSSL vulnerability has also been addressed. Vulnerability Details If you run your own...

UBUNTU-CVE-2018-19840

The function WavpackPackInit in packutils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service resource exhaustion caused by an infinite loop via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Impact (CVE-2018-1695)

Summary IBM WebSphere Application Server is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Potential...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Impact (CVE-2018-1567)

Summary IBM WebSphere Application Server is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Code...

Description of the Security and Quality Rollup for .NET Framework 2.0 SP2 and 3.0 SP2 for Windows Server 2008 SP2 (KB 4459933)

Description of the Security and Quality Rollup for .NET Framework 2.0 SP2 and 3.0 SP2 for Windows Server 2008 SP2 KB 4459933 Applies to: Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2 Notice This update is included in the Preview of Quality Rollup that's...

November 2018 Security and Quality Rollups for .NET Framework 2.0 SP2, 3.0 SP2, 4.5.2, and 4.6 for Windows Server 2008 (KB 4467243)

November 2018 Security and Quality Rollups for .NET Framework 2.0 SP2, 3.0 SP2, 4.5.2, and 4.6 for Windows Server 2008 KB 4467243 Applies to: Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6 Noti...

Description of the Security and Quality Rollup for .NET Framework 4.5.2 for Windows 7 SP1, Server 2008 R2 SP1, and Server 2008 SP2 (KB 4459945)

Description of the Security and Quality Rollup for .NET Framework 4.5.2 for Windows 7 SP1, Server 2008 R2 SP1, and Server 2008 SP2 KB 4459945 Applies to: Microsoft .NET Framework 4.5.2 Notice This update is included in the Preview of Quality Rollup that's dated November 27, 2018. This update was...

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats...

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats...

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats...

Security Bulletin: IBM® Db2®'s RCAC rules are not being enforced by CTAS sub-select statements (CVE-2018-1857).

Summary Db2's Row and Column Access Control RCAC rules are not being enforced when creating a table using AS CTAS sub-select statements. RCAC is not enforced when Db2 uses the 'WITH DATA' clause to select and insert data into the target table. Vulnerability Details CVEID: CVE-2018-1857 DESCRIPTIO...

Security Bulletin: IBM StoredIQ is affected by a cross-site request forgery

Summary IBM StoredIQ is affected by a cross-site request forgery. Vulnerability Details CVEID: CVE-2018-1927 DESCRIPTION: IBM StoredIQ is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website...