GHSA-86G5-2WH3-GC9J Path Traversal in Action View

File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents. Th...

GHSA-M63J-WH5W-C252 Denial of Service Vulnerability in Action View

Denial of Service Vulnerability in Action View Impact ------ Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views. All users running an affected...

Cisco Common Services Platform Collector Static Credential Vulnerability

A vulnerability in the Cisco Common Services Platform Collector CSPC could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the...

Denial of Service Vulnerability in Action View

There is a potential denial of service vulnerability in actionview. This vulnerability has been assigned the CVE identifier CVE-2019-5419. Impact ------ Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process...

Windows SMB Server CVE-2019-0630 RCE

Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to execute arbitrary code on the target system. Failed attacks will cause denial of service conditions. Mitigations Microsoft has not identified any mitigating factors for...

Security Bulletin: An XML External Entity (XXE) processing vulnerability is exposed in Case Manager administration client (CVE-2018-1844)

Summary IBM Case Manager has addressed the following vulnerability. An XML External Entity XXE processing vulnerability is exposed in Case Manager administration client with the ability to import solution packaged which are FileNet Deployment Manager exported zip packages. CVE-2018-1844...

Windows 7 may insecurely load Dynamic Link Libraries

Overview In standard DLL files provided by Windows 7, there are some DLL files read from the same directory where the program resides when executing the program CWE-427. Microsoft states that the root cause of this vulnerability is "Application Directory App Dir DLL planting", thus there is no pl...

JVN#69181574: Windows 7 may insecurely load Dynamic Link Libraries

In standard DLL files provided by Windows 7, there are some DLL files read from the same directory where the program resides when executing the program CWE-427. Microsoft states that the root cause of this vulnerability is "Application Directory App Dir DLL planting" , thus there is no plan to...

Security Bulletin: Password disclosure via trace log in IBM Spectrum Protect Operations Center (CVE-2018-1769)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center my display the password in plain text in the trace file when tracing is turned on. Vulnerability Details CVEID: CVE-2018-1769 DESCRIPTION: IBM Tivoli Storage Manager Operations Center could disclose sensitive informati...

Cisco HyperFlex Software Command Injection Vulnerability

A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster...

Security Bulletin: IBM i2 Enterprise Insight Analysis. CVE-2018-12539

Summary IBM i2 Enterprise Insight Analysis is delivered with the IBM Java Runtime. A vulnerability was discovered in the IBM Java Runtime that can leave the product vulnerable to attacks allowing arbitrary code to be injected. Vulnerability Details CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ...

Microsoft Confirms Serious 'PrivExchange' Vulnerability

Microsoft acknowledged an elevated privilege flaw in its Exchange Server could allow a remote attacker with a simple mailbox account to gain administrator privileges. Both a Microsoft advisory and a US-CERT alert were issued on Tuesday warning users of the elevation of privilege flaw, dubbed...

GHSA-HHXM-4F85-RGR8 High severity vulnerability that affects many_versioned_gem

Logs password in plaintext Impact Logs the password used in plaintext. The password should masked in logs to prevent it leaking. Patches Has the problem been patched? What versions should users upgrade to? Workarounds none See also Are there any links users can visit to find out more information?...

Microsoft Releases Security Advisory for Exchange Server

Microsoft has released an advisory to address an elevation of privilege vulnerability in Microsoft Exchange Server. An attacker could exploit this vulnerability to take control of an affected system. The National Cybersecurity and Communications Integration Center NCCIC, part of the Cybersecurity...

Security Bulletin: Financial Transaction Manager for ACH Services: Information Leakage in configuration listing (CVE-2018-1670)

Summary IBM Financial Transaction Manager for ACH Services FTM ACH for Multi-Platform could allow an authenticated user to obtain sensitive product configuration information from log files. Vulnerability Details CVEID: CVE-2018-1670 DESCRIPTION: IBM Financial Transaction Manager for ACH Services...

Security Bulletin: IBM Flex System Manager (FSM) is affected by a security vulnerability: (CVE-2014-6147)

Summary A security vulnerability has been discovered in the IBM FSM. Vulnerability Details Abstract A security vulnerability has been discovered in the IBM FSM. Content Vulnerability Details: CVE-ID: CVE-2014-6147 Description: An authenticated user could obtain sensitive data from the FSM and use...

DNS Flag Day & Akamai

Written by Jon Reed & Barry Greene DNS Flag Day is an industry event that promotes the adoption of the most up-to-date DNS features and ensures that non-standards-compliant servers don't negatively impact the global performance of the Internet. The 2019 DNS Flag Day will remove a number of...

CERT/CC Reports Microsoft Exchange 2013 and Newer are Vulnerable to NTLM Relay Attacks

The CERT Coordination Center CERT/CC has released information to address NTLM relay attacks affecting Microsoft Exchange 2013 and newer versions. A remote attacker could exploit this vulnerability to take control of an affected system. The National Cybersecurity and Communications Integration...

Cisco Firepower Threat Defense Software Packet Inspection and Enforcement Bypass Vulnerability

A vulnerability in the data acquisition DAQ component of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access control policies or cause a denial of service DoS condition. The vulnerability exists because the affected software...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Application Developer for WebSphere Software

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 that are used by IBM Rational Application Developer for WebSphere Software. These issues were disclosed as part of the IBM Java SDK updates in October 2018. Vulnerability Details CVEID: CVE-2018-3180...