Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 and Version 8 that affect IBM Integration Designer for IBM Business Process Manager BPM and IBM Business Automation Workflow. Integration Designer has addressed the applicable CVEs. Vulnerability Details...

Security Update for Microsoft Dynamics 365 (on-premises) (May 2019)

The version of Microsoft Dynamics 365 on-premises installed on the remote Windows host is 7.x 7.0.3.147, 8.x 8.2.6.19, 9.x 9.0.4.5. It is, therefore, affected by a security feature bypass vulnerability. An unauthenticated, remote attacker could exploit this issue, to send attachment types that ar...

Debian DSA-4449-1 : ffmpeg - security update

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Apache Tomcat 7.0.x < 7.0.78 Remote Error Page Manipulation

Binary data 700672.pasl...

Security Bulletin: Vulnerability in Rational Functional Tester versions 8.5.1.1 and earlier due to security vulnerability in IBM SDK, Java Technology Edition Version 7 Service Refresh 6 (CVE-2013-5907, CVE-2014-0417)

Summary A security vulnerability exists in IBM SDK, Java Technology Edition Version 7 Service Refresh 6 that can affect the security of Rational Functional Tester RFT. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary Java SE issues disclosed in the Oracle April 2019 Critical Patch Update, plus one additional vulnerability Vulnerability Details DESCRIPTION: This bulletin covers all applicable Java SE CVEs published by Oracle as part of their April 2019 Critical Patch Update, plus one additional...

CVE-2019-10247

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

PHP 7.0.x < 7.0.0 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.x prior to 7.0.0. It is, therefore, affected by the following vulnerabilities: - A directory traversal vulnerability in the ZipArchive::extractTo function of ext/zip/phpzip.c script. An unauthenticated, remote...

PHP Memory Disclosure Vulnerability - Windows

dnsgetrecord misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects phpparserr in ext/standard/dns.c for DNSCAA and DNSANY queries. SPDX-FileCopyrightText: 2019 Greenbone A...

Immunity Canvas: DRUPAL_SERVICES_RCE

Name| drupalservicesrce ---|--- CVE| CVE-2019-6340 Exploit Pack| CANVAS Description| CVE-2019-6340 Notes| CVE Name: CVE-2019-6340 VENDOR: Drupal NOTES: An unauthenticated unserialization bug can be exploited on the RESTful Web Services module on the Drupal core for the following versions: 7.X...

Apache Traffic Server (ATS) sslheader Plugin Vulnerability

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

PHP 7.2.x < 7.2.8 Use After Free Arbitrary Code Execution in EXIF

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.31 or 7.2.x prior to 7.2.8 . It is, therefore, affected by a use after free arbitrary code execution vulnerability. Note that the scanner has not tested for these issues but has instead relied only ...

PHP 7.x < 7.0.2 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote host is 7.x prior to 7.0.2. It is, therefore, affected by multiple vulnerabilities : - An out-of-bounds read error exists in the gdImageRotateInterpolated function in file gdinterpolation.c when handling background colors. A remote...

Security Bulletin: Vulnerabilities in the Java runtime environment that IBM provides affect WebSphere DataPower XC10 Appliance

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Version 7 that affect the WebSphere DataPower XC10 Appliance. The issues were disclosed as part of the IBM SDK, Java™ Technology Edition updates in July and October 2018. Vulnerability Details CVEID: CVE-2018-2973 DESCRIPTION: An...

VMware vRealize Operations Manager 6.6.x < 6.6.1.11286876 / 6.7.x < 6.7.0.11286837 / 7.x < 7.0.0.11287810 Local Privilege Escalation Vulnerability (VMSA-2018-0031)

The version of VMware vRealize Operations vROps Manager running on the remote web server is 6.6.x prior to 6.6.1.11286876, 6.7.x prior to 6.7.0.11286837, or 7.x prior to 7.0.0.11287810. It is, therefore, affected by a privilege escalation vulnerability due to improper permissions of support...

Security Bulletin: Financial Transaction Manager for ACH Services for Multi-Platform is affected by vulnerabilities in IBM Java Runtime

Summary Financial Transaction Manager for ACH Services for Multi-Platform has addressed the following vulnerability. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 or Version 8 that has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-3180...

Security Bulletin: There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6, Version 7, Version 8, that is used by IBM Workload Scheduler. These issues were disclosed as part of the IBM Java SDK updates in July 2018.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6, Version 7, Version 8, that is used by IBM Workload Scheduler. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational ClearQuest (CVE-2018-1656, CVE-2018-12539)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6, 7 and 8, which are used by IBM Rational ClearQuest. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Apr 2018 - Includes Oracle Apr 2018 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions-RRT. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details...

Directory traversal

Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" in the parameter subpage allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application...