Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Support Assistant Team Server

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8.0 used by IBM Support Assistant Team Server. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime deliver...

Security Bulletin: A security vulnerability has been identified in Apache Commons shipped with IBM Support Assistant Team Server (CVE-2016-3092)

Summary Apache Commons is shipped with IBM Support Assistant Team Server. Information about a security vulnerability affecting Apache Commons has been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caus...

Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with IBM Support Assistant Team Server (CVE-2016-0359, CVE-2016-0378, CVE-2016-5986)

Summary WebSphere Application Server is shipped with IBM Support Assistant Team Server. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: Vulnerability in IBM Java SDK affect IBM Support Assistant Team Server (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM Support Assistant Team Server. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Support Assistant Team Server  (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM® Support Assistant Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...

Security Bulletin: Vulnerability in SSLv3 affects IBM Support Assistant Team Server (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM® Support Assistant Team Server. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : Product could allow a remote attacker to obtain...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Support Assistant Team Server July 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM Support Assistant Team Server. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details The following two advisories are included in the IBM® SDK Jav...

Security Bulletin: IBM Support Assistant (CVE-2014-0050)

Summary The IBM® Support Assistant Team Server is shipped with the Apache Commons FileUpload™ library which contains a security vulnerability which may lead to a denial of service against IBM Support Assistant Team Server. Vulnerability Details CVEID:CVE-2014-0050 DESCRIPTION: Apache Commons...

Hacking Team to make a comeback it? CVE-2018-5002 Flash 0day vulnerability APT attack analysis and Association-bug warning-the black bar safety net

60 Enterprise Security Threat Intelligence Center recently captured an example of the use of the Flash 0day vulnerability with Microsoft Office documents initiated by the APT attack case, the attack of the samples used for the first time using the non-Flash file built-in technologies, the Office...

Custom Tokens - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-041

The Custom Tokens module enables you to create custom tokens for specific replacements that can improve other modules relying on the token API. The module doesn't sufficiently identify that its custom permissions are risky and should only be granted to highly trusted roles. This vulnerability is...

June 2018 Security Update Release

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. MSRC team...

June 2018 Security Update Release

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. MSRC team...

June 2018 Security Update Release

Today, we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. MSRC team...

WordPress Woocommerce Notifier Lite plugin <= 1.5.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by ThreatPress Security Research Team in WordPress Woocommerce Notifier Lite- Send automated web push desktop notifications plugin versions = 1.5.1. Solution Update the WordPress Woocommerce Notifier Lite- Send automated web push desktop...

WordPress Woocommerce Blocker Lite plugin <= 1.6.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by ThreatPress Security Research Team in WordPress Woocommerce Blocker Lite – Prevent fake orders and Blacklist fraud customers plugin versions = 1.6.5. Solution Update the WordPress Woocommerce Blocker Lite – Prevent fake orders and Blacklist...

envoy/h1_capture_fuzz_test: Heap-use-after-free in Envoy::IntegrationUtil::makeSingleRequest

Detailed report: https://oss-fuzz.com/testcase?key=5090066358599680 Project: envoy Fuzzer: libFuzzerenvoyh1capturefuzztest Fuzz target binary: h1capturefuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60b006c81240 Crash State:...

libreoffice/xlsfuzzer: Heap-use-after-free in FreetypeFont::ClearFontOptions

Detailed report: https://oss-fuzz.com/testcase?key=6216096523747328 Project: libreoffice Fuzzer: libFuzzerlibreofficexlsfuzzer Fuzz target binary: xlsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60f00043a838 Crash State:...

Debian DLA-1390-1 : procps security update

The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2018-1122 top read its configuration from the current working...

CVE-2018-1269: Loggregator does not properly close some TCP connections | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using loggregator-release Version 89.x prior to 89.5 Version 96.x prior to 96.1 Version 99.x prior to 99.1 Version 101.x prior to 101.9 Version 102.x prior to 102.2 Description Cloud Foundry...

CVE-2018-1268: Loggregator lacks app GUID validation | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using loggregator-release Version 89.x prior to 89.5 Version 96.x prior to 96.1 Version 99.x prior to 99.1 Version 101.x prior to 101.9 Version 102.x prior to 102.2 Description Cloud Foundry...