MGASA-2020-0075 Updated openslp packages fix security vulnerability

A heap-based buffer overflow was discovered in OpenSLP in the way the slpd service processes URLs in service request messages. A remote unauthenticated attacker could register a service with a specially crafted URL that, when used during a service request message, would trigger the flaw and cause...

Security Bulletin: IBM InfoSphere QualityStage is affected by a Reflected Cross-site scripting vulnerability

Summary A Reflected cross-site scripting vulnerability was addressed by IBM InfoSphere QualityStage. Vulnerability Details CVEID: CVE-2019-4756 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code ...

Denial Of Service (DoS)

github.com/cloudfoundry/gorouter is vulnerable to denial of service. The vulnerability exists due to an improper validation of the nonce input, allowing a remote attacker to crash the application by sending a malicious route service request with an invalid nonce...

Security Bulletin: IBM InfoSphere Information Analyzer and Information Governance Catalog is affected by an Information Disclosure vulnerability

Summary An Information Disclosure vulnerability was addressed by IBM InfoSphere Information Analyzer and Information Governance Catalog. Vulnerability Details CVEID: CVE-2019-4257 DESCRIPTION: IBM InfoSphere Information Analyzer is affected by an information disclosure vulnerability. Sensitive...

The vulnerability of microprogrammed software in Schneider Electric’s Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 programmable logic controllers arises from an operation that escapes the buffer boundaries into memory, allowing a malicious actor to trigger a service failure.

The vulnerability of microprogrammed software in Schneider Electric’s Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 programmable logic controllers arises from the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability can allow a...

Security Bulletin: IBM Kenexa LCMS Premier on Cloud is affected by Open Source Commons FileUpload Apache Vulnerabilities

Summary IBM Kenexa LCMS Premier on Cloud has addressed a vulnerability that could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this vulnerability to...

Security Bulletin: Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0

Summary Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0 Vulnerability Details CVEID: CVE-2017-1142 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the...

Security Bulletin: IBM Kenexa LCMS Premier on Cloud has addressed (CVE-2016-5949)

Summary IBM Kenexa LCMS Premier on Cloud 10.1 has addressed a vulnerability that could allow an authenticated user to obtain sensitive user data with specically crafted HTTP request Vulnerability Details CVEID: CVE-2016-5949 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow an authenticat...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2017-1788)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2017-1741)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2017-1681)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection (CVE-2017-1124)

Summary IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection. Vulnerability Details CVEID: CVE-2017-1124 DESCRIPTION: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injectio...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-9736)

Summary IBM WebSphere Application Server is shipped with Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter...

Security Bulletin: Multiple vulnerabilities identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0201, CVE-2015-7420)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files (CVE-2015-7487)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files. Vulnerability Details CVEID: CVE-2015-7487 DESCRIPTION: IBM Maximo Asset Management contains a vulnerability which...

Security Bulletin: Security Vulnerability in IBM Maximo Asset Management (CVE-2015-1951) allows cacheable HTTPS response

Summary A vulnerability in Maximo Asset Management could allow an attacker to obtain sensitive information which is stored in a local cache. The vulnerability affects Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization,...

Security Bulletin: Cross-Site Scripting (XSS) and Remote Code Execution Vulnerabilities Affecting Asset and Service Management (CVE-2015-0104, CVE-2015-0107, CVE-2015-0108, CVE-2015-0109)

Summary There are cross-site scripting and remove code execution vulnerabilities in code that is used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: GSKit TLS Padding Vulnerability affects IBM Tivoli/Security Server on Asset and Service Management (CVE-2014-8730)

Summary IBM Tivoli/Security Directory Server ITDS/ISDS are affected by a TLS padding vulnerability, which could allow a remote attacker to obtain sensitive information. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: IBM Security Directory Server could allow a remote attacker to obtain...

Security Bulletin: Information Disclosure Vulnerability Addressed in Asset and Service Management (CVE-2014-4765)

Summary IBM Maximo Asset Management could allow an attacker to obtain directory information from an error message. This information could be used to aid in further attacks against the system. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management...

Security Bulletin: Security Bypass Vulnerability Addressed in Asset and Service Management (CVE-2014-3084)

Summary IBM Maximo Asset Management allows an authenticated attacker to modify calendar entries that they do not have access to by bypassing security restrictions. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry...