CVE-2017-5168

CVE-2017-5168 affects Hanwha Techwin Smart Security Manager (SSM) versions 1.5 and prior (also 1.4 and prior to 1.31). The issue is multiple path traversal flaws in the ActiveMQ Broker service bundled with SSM, where crafted HTTP requests from a malicious page can lead to arbitrary file access on...

CVE-2017-5168

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a...

CVE-2017-5169

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Po...

Hanwha Techwin Smart Security Manager Elevation of Privilege Vulnerability

Hanwha Techwin Smart Security Manager is the software management platform. Hanwha Techwin Smart Security Manager has an elevation of privilege vulnerability in the ActiveMQ Broker service that could allow an attacker to access arbitrary files on the server...

Hanwha Techwin Smart Security Manager Cross-Site Request Forgery Vulnerability

Hanwha Techwin Smart Security Manager is the software management platform. Hanwha Techwin Smart Security Manager has a cross-site request forgery vulnerability in an installed Redis/Apache Felix Gogo server that can be exploited by an attacker to access a remote shell session...

Hanwha Techwin Smart Security Manager

CVSS v3 7.5 ATTENTION: Remotely exploitable Vendor: Hanwha Techwin Equipment: Smart Security Manager Vulnerabilities: Remote Code Execution AFFECTED PRODUCTS The following Smart Security Manager, a software management platform, versions are affected: Smart Security Manager Versions 1.5 and prior...

Ubuntu 14.04 LTS : Tomcat regression (USN-3177-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3177-2 advisory. USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes...

Ubuntu: Security Advisory (USN-3177-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3177-2 tomcat6, tomcat7 regression

USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the Tomcat realm implementations...

USN-3177-2: Tomcat regression

USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the Tomcat realm implementations...

Ubuntu: Security Advisory (USN-3177-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3177-1 tomcat6, tomcat7, tomcat8 vulnerabilities

It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-0762 Alvaro Muno...

USN-3177-1: Tomcat vulnerabilities

It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-0762 Alvaro Muno...

FreeBSD : tomcat -- multiple vulnerabilities (3ae106e2-d521-11e6-ae1b-002590263bf5)

The Apache Software Foundation reports : Low: Unrestricted Access to Global Resources CVE-2016-6797 Low: Security Manager Bypass CVE-2016-6796 Low: System Property Disclosure CVE-2016-6794 Low: Security Manager Bypass CVE-2016-5018 Low: Timing Attack CVE-2016-0762 %NASLMINLEVEL 70300 C Tenable...

Local Authentication Bypass Vulnerability in Multiple McAfee Products

McAfee SIEM Enterprise Security Manager and SIEM Event Receiver are both products of McAfee, Inc. McAfee SIEM Enterprise Security Manager provides intelligent, fast, and accurate security and information SIEM and log management. SIEM Event Receiver collects third-party events and logs and...

CVE-2016-8006

Authentication bypass vulnerability in Enterprise Security Manager ESM and License Manager LM in Intel Security McAfee Security Information and Event Management SIEM 9.6.0 MR3 allows an administrator to make changes to other SIEM users' information including user passwords without supplying the...

CVE-2016-8006

The CVE-2016-8006 entry describes an authentication bypass in McAfee SIEM products, specifically Enterprise Security Manager (ESM) and License Manager (LM) used with SIEM 9.6.0 MR3. The vulnerability enables an administrator to modify other SIEM users’ information (including passwords) without su...

F5 Networks BIG-IP : libxml2 vulnerability (K14338030)

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document. CVE-2016-1762 File data f5bigipSOL14338030.nasl...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: tomcat 7.0.69. Security Fixes : - A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an...

SUSE-SU-2016:3079-1 Security update for tomcat

This update for Tomcat provides the following fixes: Feature changes: The embedded Apache Commons DBCP component was updated to version 2.0. bsc1010893 fate321029 Security fixes: - CVE-2016-0762: Realm Timing Attack bsc1007854 - CVE-2016-5018: Security Manager Bypass bsc1007855 - CVE-2016-6794:...