Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearCase (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by Rational ClearCase. Rational ClearCase has addressed the applicable CVEs. Vulnerability...

Security Bulletin: Potential spoofing attack in IBM WebSphere Application Server in IBM Cloud (CVE-2017-1788)

Summary There is a potential spoofing attack in WebSphere Application Server using Form Login. Vulnerability Details CVEID: CVE-2017-1788 DESCRIPTION: IBM WebSphere Application Server installations using Form Login could allow a remote attacker to conducts spoofing attacks. CVSS Base Score: 5.3...

MS14-031: Vulnerability in TCP Protocol Could Allow Denial of Service (2962478)

The remote Windows host is affected by a denial of service vulnerability due to the Windows TCP/IP stack improperly handling certain traffic. An attacker could exploit this vulnerability by sending a sequence of specially crafted TCP packets to cause a target system to stop responding until it is...

MS13-064: Vulnerability in Windows NAT Driver Could Allow Denial of Service (2849568)

The remote Windows host is running a version of the Windows NAT Driver that is affected by a denial of service DoS vulnerability. An attacker could cause the host to stop responding until restarted by sending a specially crafted ICMP packet to the system. C Tenable Network Security, Inc...

MS13-003: Vulnerabilities in System Center Operations Manager Could Allow Elevation of Privilege (2748552)

The version of System Center Operations Manager installed on the remote host has multiple reflected cross-site scripting vulnerabilities in the Web Console component. An attacker could exploit this by tricking a user into requesting a specially crafted URL, resulting in arbitrary script code...

DNN (DotNetNuke) ErrorPage.aspx XSS

The version of DNN installed on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the 'error' parameter of the ErrorPage.aspx' script before using it to generate dynamic HTML output. An attacker can exploit this, via a...

MS08-060: Microsoft Windows Active Directory LDAP(S) Request Handling Remote Overflow (957280)

The remote version of Active Directory contains a vulnerability when processing LDAP requests. An attacker can exploit this flaw to execute arbitrary code on the remote Active Directory server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34405; scriptversion"1.28"...

MS08-037: Vulnerabilities in DNS Could Allow Spoofing (953230)

Flaws in the remote DNS library may let an attacker send malicious DNS responses to DNS requests made by the remote host, thereby spoofing or redirecting internet traffic from legitimate locations. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid33441;...

MS06-058: Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (924163)

The remote host is running a version of Microsoft PowerPoint that is subject to a flaw that could allow arbitrary code to be run. An attacker may use this to execute arbitrary code on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have it...

MS05-039: Vulnerability in Plug and Play Service Could Allow Remote Code Execution (899588) (uncredentialed check)

The remote version of Windows contains a flaw in the function 'PNPQueryResConfList' in the Plug and Play service that may allow an attacker to execute arbitrary code on the remote host with SYSTEM privileges. A series of worms Zotob are known to exploit this vulnerability in the wild. C Tenable...