CVE-2013-2951

CVE-2013-2951 affects IBM WebSphere Portal 7.0.0.x and 8.0.0.x. When tracing is enabled for the Selfcare Portlet (Profile Management), the process writes passwords to a trace file, allowing local users to read sensitive information. Root cause: tracing writes credentials to a file; impact is info...

PT-2018-4077

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0.0.x through 8.0.0.x Description The issue allows local users to obtain sensitive information by reading a trace file when tracing is enabled for the Selfcare Portlet Profile Management. This is because passwor...

CVE-2013-2951: Undefined Security Weakness

IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet Profile Management, which allows local users to obtain sensitive information by reading the file. IBM X-Force ID: 83621...

CVE-2018-1621

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

Design/Logic Flaw

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

PT-2018-13437

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue is caused by improper handling of some datasource custom properties, which could allow a local attacker to obtain clear text passwords in a trace file...

CVE-2018-1621: Cleartext Storage of Sensitive Information

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

PT-2019-1900

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.4.0 through 2.4.11 Wireshark versions 2.6.0 through 2.6.5 Description The issue is related to a buffer overflow read in the RTSE dissector of the Wireshark network traffic analyzer, which could lead to a denial of service...

Wireshark DMP Parser Denial of Service Vulnerability

Wireshark formerly known as Ethereal is a suite of network packet analysis software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.DMP dissector is one of the DMP communication system parsers. A security...

PT-2018-18058

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.2.0 through 2.2.12 Wireshark versions 2.4.0 through 2.4.4 Description The issue concerns a denial of service crash that can be caused by a malformed packet trace file. This is due to a problem in the SIGCOMP dissector. The...

PT-2018-18059

Name of the Vulnerable Software and Affected Versions Wireshark versions 2.2.0 through 2.2.12 Wireshark versions 2.4.0 through 2.4.4 Description The NBAP dissector in Wireshark could crash due to incorrect initialization of the DCH ID. This issue allows attackers to cause a denial of service by...

PT-2019-8526 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.14.11 Description: An issue was discovered in the Linux kernel. A double free may be caused by the function allocate trace buffer in the file kernel/trace/trace.c. Recommendations: For Linux kernel versions...

KLA11095 Denial of service vulnerability in Wireshark

A buffer overflow vulnerability was found in the Profinet I/O dissector in Wireshark. By exploiting this vulnerability malicious users can cause a denial of service. This vulnerability can be exploited remotely via a specially designed packet, which is injected onto the wire, or by convincing a...

wireshark: Reassembly memory leak (wnpa-sec-2015-16)

A flaw was found in the way packet reassembly code of wireshark would parse a packet which could leak memory. An attacker could use this flaw to crash wireshark by sending a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file...

wireshark: WCP dissector crash (wnpa-sec-2015-14)

A flaw was found in WCP dissector of wireshark of which an attacker could crash wireshark by injecting a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file...

Wireshark LDSS Dissector 'epan/dissectors/packet-ldss.c' Denial of Service Vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A denial of service vulnerability exists in Wireshark LDSS Dissector...

Wireshark 1.12.x < 1.12.13 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 1.12.13. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.13 advisory. - The NDS dissector could crash. It may be possible to make Wireshark crash by injecting a malformed packet on...

Wireshark 1.12.x < 1.12.12 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 1.12.12. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.12 advisory. - epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 1.12.x before 1.12.12 mishandles offsets,...

wireshark-gtk: denial of service

CVE-2016-2522: The dissectberconstrainedbitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service out-of-bounds read and application...

CVE-2016-2527

wiretap/nettrace3gpp32423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service stack-based buffer overflow and application crash via a...