Security Bulletin: IBM SPSS Statistics ActiveX Control Buffer Overflow (CVE-2015-8530)

Summary An IBM SPSS Statistics ActiveX Control is vulnerable to a stack-based buffer overflow. By persuading a victim to visit a specially-crafted Web page that passes an overly long argument to the Initialize function, a remote attacker could overflow a buffer and execute arbitrary code on the...

Security Bulletin: Privilege escalation coverage gap in IBM SPSS Statistics (CVE-2015-7489)

Summary Harmful code may be executed because of privilege escalation coverage gap in IBM SPSS Statistics. Vulnerability Details CVEID: CVE-2015-7489 DESCRIPTION: IBM SPSS Statistics uses python scripts that have write permissions to Everyone. A local user can add malicious OS commands to the pyth...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allow an...

Security Bulletin: IBM SPSS Statistics is affected by CVE-2018-3139 and CVE-2018-3180 vulnerabilities

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-3139 DESCRIPTION: An unspecified vulnerability in Oracle Java SE relate...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. This CVE affects the windows platform only. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-12547 DESCRIPTION: In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6.0, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics. IBM SPSS Statistics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime Environment's Diagnostic...

Security Bulletin: IBM SPSS Statistics is affected by an Apache Poi vulnerability (CVE-2017-12626)

Summary IBM SPSS Statistics has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-12626 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by an error while parsing malicious WMF, EMF, MSG and macros and specially crafted DOC, PPT and XLS. By persuadin...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics Server (CVE-2017-10356, CVE-2017-10388)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics Desktop and Server Version 22, 23, 24, and 25. These issues were disclosed as part of the IBM Java SDK updates in Oct 2017. Vulnerability Details CVEID:...

Security Bulletin: IBM SPSS Statistics is affected by multiple GSKit vulnerabilities

Summary IBM SPSS Statistics has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel Sandy-Bridge microarchitecture...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2017-10115, CVE-2017-10116)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics Version 21, 22, 23, 24, and 25. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTIO...

COVID-19 Phishing: Exploiting a Global Pandemic

It's sad to think criminals are hard at work taking advantage of the extraordinary stress the world's population is currently experiencing. But they are. New phishing scams exploiting anxiety about COVID-19 are trending upward. Akamai's Carrier Data Science and Threat Research teams analyzing...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as the I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process...

postgresql: Selectivity estimators bypass row security policies

PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...

Mail.ru: [pulse.mail.ru] Доступ к статистике чужих площадок

Few API methods of pulse.mail.ru were not properly restricted and could be used to obtain statistics information for arbitrary domains...

MISP Cross-Site Scripting Vulnerability (CNVD-2020-16634)

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. MISP 2.4.122 A reflected cross-site scripting vulnerability exists related to app/View/Users/statisticsorgs.ct...

PT-2020-12002 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.122 Description: The issue is related to reflected XSS via unsanitized URL parameters, specifically in the app/View/Users/statistics orgs.ctp file. Recommendations: For MISP version 2.4.122, update to a version that sanitizes...

Business Email Compromise. What to do

The FBI has just released it’s annual Internet Crime Report for 2019, it makes for some really interesting and depressing reading. The mainstream media focused on the headline figure of $3.5Bn in losses in 2019, but what caught my eye is the Business Email Compromise BEC or CEO Fraud stats. I...

SoundCloud Tackles DoS, Account Takeover Issues

Online music platform SoundCloud, which can be thought of as an audio-based YouTube for music creators, has addressed several security bugs in its APIs that could lead to denial-of-service DoS or account takeover via credential-stuffing. SoundCloud recently sold a $75 million stake to satellite...

The Rise of the Open Bug Bounty Project

Can you imagine launching a global bug bounty platform with almost 500,000 submissions and 13,000 researchers without consuming a cent from venture capitalists? If not, this success story is for you. The once skyrocketing bug bounty industry seems to be not in the best shape today. While prominen...