tomcat -- Security constraints ignored or applied too late

The Apache Software Foundation reports: Security constraints defined by annotations of Servlets were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order...

naturalresources.house.gov XSS vulnerability

Open Bug Bounty ID: OBB-565431 Description| Value ---|--- Affected Website:| naturalresources.house.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-1758

IBM Financial Transaction Manager for ACH Services for Multi-Platform IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A...

Xxe

IBM Financial Transaction Manager for ACH Services for Multi-Platform IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A...

CVE-2017-1758

IBM Financial Transaction Manager for ACH Services for Multi-Platform IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender Advanced 9.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

CVE-2017-18088

Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 the fixed version for 5.3.x, from version 5.4.0 before 5.4.6 the fixed version for 5.4.x, from version 5.5.0 before 5.5.6 the fixed version for 5.5.x, from version 5.6.0 before 5.6.3 the fixed version for 5.6.x,...

Microsoft Office CVE-2018-0853 Information Disclosure Vulnerability

Description Microsoft Office is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Office 2010 Service Pack 2 32-bit editions Microsoft Office 2010 Service Pack 2 64-bi...

SUSE-SU-2018:0423-1 Security update for ipsec-tools

This update for ipsec-tools fixes one issue. This security issue was fixed: - CVE-2016-10396: The racoon daemon contained a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments that allowed a remote attacker to exhaust computational resources on the remot...

Oracle WebCenter Portal Multiple Vulnerabilities (January 2018 CPU)

Binary data oraclewebcenterportalcpujan2018.nbin...

Developing an effective cyber strategy

The word strategy has its origins in the Roman Empire and was used to describe the leading of troops in battle. From a military perspective, strategy is a top-level plan designed to achieve one or more high-order goals. A clear strategy is especially important in times of uncertainty as it provid...

Updated php-smarty packages fix security vulnerability

Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch or display functions on custom resources that does not sanitize template nameCVE-2017-1000480...

mctnhs.com XSS vulnerability

Open Bug Bounty ID: OBB-553600 Description| Value ---|--- Affected Website:| mctnhs.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-1199

Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...

How to Mitigate the Threat Cryptocurrency Mining Poses to Enterprise Security

The growing popularity of Bitcoin and other cryptocurrencies is generating curiosity—and concern—among security specialists. Crypto mining software has been found on user machines, often installed by botnets. Organizations need to understand the risks posed by this software and what actions, if...

sbcity.org XSS vulnerability

Open Bug Bounty ID: OBB-549984 Description| Value ---|--- Affected Website:| sbcity.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SQL Injection Vulnerability in Chiayi County's Management Resources Inquiry System

The Kiawah County Management Information System is a content management system. Chiayi County Management Information Query System suffers from SQL injection vulnerability, which can be exploited by attackers to access or modify sensitive database information...

Xxe

IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449...

CVE-2018-1364

IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449...

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

The version of libxml2 packaged with Nokogiri contains a vulnerability. Nokogiri has mitigated these issue by upgrading to libxml 2.9.5. Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause...