Security update for php5-smarty3 (moderate)

This update for php5-smarty3 fixes the following issues: - CVE-2018-16381: Prevent traversal vulnerability due to insufficient template code sanitization that allowed attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files...

CVE-2018-13982

SmartySecurity::isTrustedResourceDir in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files...

Path traversal

SmartySecurity::isTrustedResourceDir in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files...

Apache Struts 2.x < 2.3.16.2 Multiple Vulnerabilities (S2-020)

The version of Apache Struts running on the remote host is 2.x prior to 2.3.16.2. It, therefore, is affected by multiple vulnerabilities: - A denial of service vulnerability exists in MultipartStrea.java in Apache Commons FileUpload due to failure to handle exceptional conditions. A remote,...

Automattic: WooCommerce Blacklist in 'map_meta_cap' leads to Privilege Escalation of Shopmanagers

When the Shopmanager role is defined for the first time, it receives the following WordPress core privileges: // Shop manager role. addrole 'shopmanager', 'Shop manager', array 'level9' = true, 'level8' = true, 'level7' = true, 'level6' = true, 'level5' = true, 'level4' = true, 'level3' = true,...

CVE-2017-8988

A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00. The vulnerability impacts DevMgr Earlier than 8.5.3-00 for Windows, Linux, RepMgr earlier than 8.5.3-00 for Windows, Linux and HDLM earlier than 8.5.3-00 f...

Security Bulletin: Multiple vulnerabilities in curl affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been discovered in curl that is embedded in FSM. This bulletin addresses these issues. Vulnerability Details CVEID: CVE-2016-8615 DESCRIPTION: cURL/libcurl is vulnerable to cookie injection, caused by an error related to fgets function. By using a malicious...

Security Bulletin: Vulnerabilities in Struts v2 affect IBM Enterprise Records

Summary Struts v2 vulnerabilities affect IBM Enterprise Records has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-1181 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against unintended remot...

Security Bulletin: IBM Cognos Business Intelligence Server 2017Q1 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities.

Summary This bulletin addresses several security vulnerabilities. IBM Cognos Business Intelligence has addressed a vulnerability where sensitive information can be revealed in its logs files. There is a vulnerabilitiy in IBM® WebSphere Application Server Liberty. Liberty is used by IBM Cognos...

Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server for Bluemix

Summary Apache Struts vulnerabilities affect WebSphere Application Server and WebSphere Application Server Hypervisor Edition Administration Console. There is a potential denial of service with IBM WebSphere Application Server when using SIP services. There are several vulnerabilities that may...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Image Construction and Composition Tool. (CVE-2016-0705, CVE-2016-0798, CVE-2016-0797, CVE-2016-0799, CVE-2016-0702, and CVE-2016-0704)

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Image Construction and Composition Tool. IBM Image Construction and Composition Tool has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is...

CVE-2016-9900

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox 50.1, Firefox ESR 45.6, and Thunderbird 45.6...

CVE-2016-9900

CVE-2016-9900 describes that data: URLs used by SVG images can bypass security restrictions, enabling cross-domain data leakage. Affected products include Mozilla Firefox (non-ESR) prior to 50.1, Firefox ESR prior to 45.6, and Thunderbird prior to 45.6. Root cause is the handling of external reso...

KLA11640 Multiple vulnerabilities in Microsoft Devices

Microsoft released an advisory and security updates related to a newly discovered class of hardware vulnerabilities. Malicious can exploit these vulnerabilities to obtain sensitive information and bypass security restrictions. Original advisories ADV180012 ADV180013 Related products Windows-RT CV...

Adobe Creative Cloud Security Restriction Bypass Vulnerability

Adobe Creative Cloud is a cloud-based suite of software that includes graphic design, movie editing, and web development applications. A security restriction bypass vulnerability exists in Adobe Creative Cloud 4.4.1.298 and earlier versions. An attacker can exploit the vulnerability to bypass...

Trusted-Directory Bypass via Path Traversal

Smarty Trusted-Directory Bypass via Path Traversal\nVulnerability Overview\nSmarty 3.1.32 or below is prone to a path traversal vulnerability due\nto insufficient sanitization of code in Smarty templates. This allows\nattackers controlling the Smarty template to bypass the trusted\ndirectory...

Trusted-Directory Bypass via Path Traversal

Smarty Trusted-Directory Bypass via Path Traversal Vulnerability Overview Smarty 3.1.32 or below is prone to a path traversal vulnerability due to insufficient sanitization of code in Smarty templates. This allows attackers controlling the Smarty template to bypass the trusted directory security...

CVE-2017-8948

A Remote Bypass Security Restriction vulnerability in HPE Network Node Manager i NNMi Software versions v10.0x, v10.1x, v10.2x was found...

Security feature bypass

A Remote Bypass Security Restriction vulnerability in HPE Network Node Manager i NNMi Software versions v10.0x, v10.1x, v10.2x was found...

CVE-2017-8948

CVE-2017-8948 describes a remote bypass of security restrictions in HP/NNMi (HPE Network Node Manager i) software. Affected are NNMi versions v10.0x, v10.1x, and v10.2x. The CVSS metrics indicate high severity (CVSSv3: 9.8) with unauthenticated network access and no user interaction required; imp...