Citrix Endpoint Management (aka XenMobile Server) 10.9.0 Rolling Patch 5

Package name:xms10.9.0.10507.bin For: XenMobile Server 10.9.0 Deployment type: On-premises only Replaces:xms10.9.0.10405.bin, xms10.9.0.10303.bin, xms10.9.0.10204.bin, xms10.9.0.10105.bin Date:July, 2020 Languages supported:English US Readme version:1.00 Readme Revision History Version| Date|...

Security Bulletin: IBM QRadar SIEM in a multi tenant configuration could be vulnerable to information disclosure (CVE-2018-1725)

Summary In a multi tenant configuration IBM QRadar SIEM could be vulnerable to sensitive information disclosure. Vulnerability Details CVEID: CVE-2018-1725 DESCRIPTION: IBM QRadar SIEM in a multi tenant configuration could be vulnerable to information disclosure CVSS Base score: 3.2 CVSS Temporal...

Security Bulletin: IBM Security QRadar Packet Capture is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)

Summary A potential security vulnerability in CPUs may allow information disclosure. Vulnerability Details CVEID: CVE-2018-12126 Description: Microarchitectural Store Buffer Data Sampling MSBDS: Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user ...

Security Bulletin: IBM QRadar SIEM is vulnerable to deserialization of untrusted data

Summary IBM QRadar SIEM could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function Vulnerability Details CVEID: CVE-2020-4280 DESCRIPTION: IBM QRadar could allow a remote attacker to...

Security Bulletin: IBM QRadar SIEM is vulnerable to cross site scripting (XSS) (CVE-2019-4470)

Summary IBM QRadar SIEM is vulnerable to cross site scripting XSS Vulnerability Details CVEID: CVE-2019-4470 DESCRIPTION: CVSS Base score: 5.4 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/163779 for the current score. CVSS Vector:...

Security Bulletin: XStream as used by IBM QRadar SIEM is vulnerable to OS command injection (CVE-2019-10173)

Summary XStream as used by IBM QRadar SIEM is vulnerable to OS command injection Vulnerability Details CVEID: CVE-2019-10173 DESCRIPTION: It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been...

CVE-2015-7609

Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra...

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to Path Traversal (CVE-2018-1649)

Summary The product processes file paths in a download or upload functionality unsafely. This allows access to arbitrary files on the system. Vulnerability Details CVEID: CVE-2018-1649 Description: IBM QRadar Incident Forensics could allow a remote attacker to traverse directories on the system. ...

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to a cacheable SSL Page issue. (CVE-2015-1996)

Summary Cacheable SSL pages exist in QRadar Incident Forensics Vulnerability Details CVE-ID: CVE-2015-1996 Description: IBM QRadar Incident Forensics could allow a local user to obtain sensitive information due to cacheable SSL pages that have been stored locally. CVSS Base Score: 2.1 CVSS Tempor...

Security Bulletin: Open Source Apache Tomcat as used in IBM QRadar SIEM is vulnerable to a security bypass. (CVE-2014-7810)

Summary Open Source Apache Tomcat Security Manager bypass. Vulnerability Details CVE-ID: CVE-2014-7810 Description: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use of expression language. An attacker could exploit this vulnerability to bypass the...

Exponent CMS 2.4.1 Patch 5 - Privilege Escalation Vulnerability

Exponent CMS allows rogue admins to elevate their privileges. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

OpenEMR < 5.0.0 Patch 5 Database Disclosure Vulnerability

OpenEMR is prone to a database disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2015-1995

Multiple cross-site scripting XSS vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-1994

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2015-1996

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

CVE-2015-1997

Cross-site request forgery CSRF vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2015-1994

IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

InduSoft Web Studio Information Disclosure Vulnerability (Aug 2015) - Windows

InduSoft Web Studio is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Buffer overflow

Buffer overflow in Trend Micro URL Filtering Engine TMUFE in OfficeScan 8.0 before SP1 Patch 5 - Build 3510, possibly tmufeng.dll before 3.0.0.1029, allows attackers to cause a denial of service crash or OfficeScan hang via unspecified vectors. NOTE: it is likely that this issue also affects...