CVE-2019-9488

Trend Micro Deep Security Manager 10.x, 11.x and Vulnerability Protection 2.0 are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager DSM...

CVE-2019-9488

CVE-2019-9488 affects Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0). The vulnerability is a XML External Entity Attack triggered when parsing XML, with the prerequisite that an attacker already has root/admin access on a host approved to communicate with the De...

JDK: Out-of-bounds access in the String.getBytes method

In Eclipse OpenJ9 prior to 0.15, the String.getBytesint, int, byte, int method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Ja...

JDK: Out-of-bounds access in the String.getBytes method

In Eclipse OpenJ9 prior to 0.15, the String.getBytesint, int, byte, int method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Ja...

JDK: Out-of-bounds access in the String.getBytes method

In Eclipse OpenJ9 prior to 0.15, the String.getBytesint, int, byte, int method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Ja...

JDK: Out-of-bounds access in the String.getBytes method

In Eclipse OpenJ9 prior to 0.15, the String.getBytesint, int, byte, int method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Ja...

The vulnerability of the McAfee Enterprise Security Manager system, related to the lack of measures for cleaning input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the McAfee Enterprise Security Manager system relates to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...

The vulnerability of the McAfee Enterprise Security Manager system, which exists due to an incorrect restriction on the path to the restricted catalog, allows attackers to increase their privileges.

The vulnerability of the McAfee Enterprise Security Manager critical threat detection system exists due to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

The vulnerability of the McAfee Enterprise Security Manager system arises from an incorrect restriction on the path to the restricted directory. This allows attackers to elevate their privileges.

The vulnerability of the McAfee Enterprise Security Manager critical threat detection system exists due to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2019-30620)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in the AFM feed list in the F5 BIG-IP AFM and ASM, which can be exploited by an...

F5 BIG-IP Application Security Manager Resource Management Error Vulnerability

F5 BIG-IP Application Security Manager ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A resource management error vulnerability exists in F5 BIG-IP...

The vulnerability of the reporting software for Cisco Security Manager extended security environments is related to errors in restricting XML links to external objects. This allows attackers to access confidential information and trigger service failures.

The vulnerability of the reporting software for Cisco Security Manager extended security environments is related to errors in restricting XML links to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information and cause service failure...

CVE-2019-6637

On BIG-IP ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on...

McAfee Enterprise Security Manager Privilege Permission and Access Control Issues Vulnerability

McAfee Enterprise Security Manager ESM is a suite of security information and event management SIEM solutions from McAfee, USA. The solution supports viewing and analyzing threat intelligence as well as rapid threat prioritization and security response, and has a built-in embedded compliance...

McAfee Enterprise Security Manager Command Injection Vulnerability

McAfee Enterprise Security Manager ESM is a suite of security information and event management SIEM solutions from McAfee, USA. The solution supports viewing and analyzing threat intelligence as well as rapid threat prioritization and security response, and has a built-in embedded compliance...

McAfee Enterprise Security Manager Command Injection Vulnerability (CNVD-2019-21255)

McAfee Enterprise Security Manager ESM is a suite of security information and event management SIEM solutions from McAfee, USA. The solution supports viewing and analyzing threat intelligence as well as rapid threat prioritization and security response, and has a built-in embedded compliance...

McAfee Enterprise Security Manager Path Traversal Vulnerability

McAfee Enterprise Security Manager ESM is a suite of security information and event management SIEM solutions from McAfee, USA. The solution supports viewing and analyzing threat intelligence as well as rapid threat prioritization and security response, and has a built-in embedded compliance...

CVE-2019-3630

Command Injection vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters...

CVE-2019-3632

Directory Traversal vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input...

CVE-2019-3631

Command Injection vulnerability in McAfee Enterprise Security Manager ESM prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters...