CVE-2018-0559

Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors...

CVE-2018-0605

Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0604

Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors...

CVE-2018-0604

Pixelpost v1.7.3 and earlier has an Arbitrary Code Execution vulnerability (CVE-2018-0604). Official records confirm remote code execution via unspecified vectors. The affected product is Pixelpost (versions up to 1.7.3). Several related sources/records (NVD, JVN, CNVD, CVE lists) consistently re...

CVE-2018-0608

Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service DoS via unspecified vectors...

CVE-2018-0602

Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0603

Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0608

Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service DoS via unspecified vectors...

kernel: memory leak when merging buffers in SCSI IO vectors

It was found that in the Linux kernel through v4.14-rc5, biomapuseriov and biounmapuser in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bioaddpcpage merges them into one, but the page reference is never dropped, causing a...

kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access

It was found that AIO interface didn't use the proper rwverifyarea helper function with extended functionality, for example, mandatory locking on the file. Also rwverifyarea makes extended checks, for example, that the size of the access doesn't cause overflow of the provided offset limits. This...

Security Bulletin: Vulnerabilities in MariaDB affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in MariaDB. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3600 DESCRIPTION: An unspecified vulnerability in Oracle MySQL related to the Server Client mysqldump component could allow an authenticated attacker to...

Security Bulletin: Vulnerabilities in mariadb affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in Oracle MySQL Server mariadb. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-3492 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Optimizer component could allow a remote...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affects IBM Storwize V7000 Unified

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by IBM Storwize V7000 Unified. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2663 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and IBM Tivoli Storage FlashCopy Manager for VMware (CVE-2016-3426)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware IBM Spectrum Protect™ for Virtual Environments and IBM Tivoli Storage FlashCopy Manager for VMware IBM...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427) shipped with Tivoli Netcool Performance Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the Oracle April 2016 Critical Patch Update, plus four additional vulnerabilities. These may affect some configurations of IBM...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer and Watson Content Analytics (CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3252, CVE-2016-5547, CVE-2016-2183)

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer and Watson Content Analytics. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An unspecified vulnerability in Oracle Java SE Java SE Embedded and...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Sensitive Information Leakage vulenrability (CVE-2017-1595)

Summary IBM Security Guardium Database Activity Monitor could allow a local attacker to obtain sensitive information via unspecified vectors. IBM Security Guardium Database Activity Monitor has provided a fix for this vulnerability. Vulnerability Details CVEID: CVE-2017-1595 DESCRIPTION: IBM...

Information disclosure

Information disclosure vulnerability in McAfee ePolicy Orchestrator ePO 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors...

Security Bulletin: CICS Transaction Gateway for Multiplatforms

Summary Multiple security vulnerabilities exist in the JREs shipped with CICS Transaction Gateway CICS TG for client applications. CICS TG itself is not vulnerable to all these risks but client side applications using the CICS TG supplied JREs might be. Vulnerability Details CVEID: CVE-2017-10198...

A New Paradigm For Cyber Threat Hunting

It's no secret that expecting security controls to block every infection vector is unrealistic. For most organizations, the chances are very high that threats have already penetrated their defenses and are lurking in their network. Pinpointing such threats quickly is essential, but traditional...