The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of IBM WebSphere AS Liberty

computer vulnerability note CVE-2018-2783 CVE-2018-2790 CVE-2018-2794

Oracle Java: vulnerabilities of April 2018

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.
Impacted products: Debian, BIG-IP Hardware, TMOS, Fedora, AIX, DB2 UDB, IBM i, IRAD, Rational ClearCase, Security Directory Server, Tivoli Storage Manager, Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Liberty, WebSphere AS Traditional, IBM WebSphere ESB, WebSphere MQ, ePO, Java OpenJDK, openSUSE Leap, Java Oracle, Puppet, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: privileged access/rights, user access/rights, data reading, data creation/edition, data deletion, denial of service on service.
Provenance: document.
Number of vulnerabilities in this bulletin: 14.
Creation date: 18/04/2018.
Identifiers: 2016282, CERTFR-2018-AVI-188, cpuapr2018, CVE-2018-2783, CVE-2018-2790, CVE-2018-2794, CVE-2018-2795, CVE-2018-2796, CVE-2018-2797, CVE-2018-2798, CVE-2018-2799, CVE-2018-2800, CVE-2018-2811, CVE-2018-2814, CVE-2018-2815, CVE-2018-2825, CVE-2018-2826, DSA-4185-1, DSA-4225-1, FEDORA-2018-40c4930c83, FEDORA-2018-579ff80ed8, FEDORA-2018-77533e644b, FEDORA-2018-9aa8064e12, ibm10713455, ibm10715641, ibm10716001, ibm10717125, ibm10717149, ibm10717207, ibm10717275, ibm10717537, ibm10718843, ibm10719319, ibm10719993, K15217245, K33924005, K44923228, K70321874, openSUSE-SU-2018:1710-1, openSUSE-SU-2018:1719-1, RHSA-2018:1188-01, RHSA-2018:1191-01, RHSA-2018:1201-01, RHSA-2018:1202-01, RHSA-2018:1203-01, RHSA-2018:1204-01, RHSA-2018:1205-01, RHSA-2018:1206-01, RHSA-2018:1270-01, RHSA-2018:1278-01, RHSA-2018:1721-01, RHSA-2018:1722-01, RHSA-2018:1723-01, RHSA-2018:1724-01, SB10234, SUSE-SU-2018:1447-1, SUSE-SU-2018:1458-1, SUSE-SU-2018:1690-1, SUSE-SU-2018:1692-1, SUSE-SU-2018:1738-1, SUSE-SU-2018:1764-1, SUSE-SU-2018:1938-1, SUSE-SU-2018:1938-2, SUSE-SU-2018:2068-1, swg22016419, USN-3644-1, USN-3691-1, USN-3747-1, USN-3747-2, VIGILANCE-VUL-25899, ZDI-18-306, ZDI-18-307.

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2017-1788

WebSphere AS: privilege escalation via Form Login Spoofing

Synthesis of the vulnerability

An attacker can bypass restrictions via Form Login Spoofing of WebSphere AS, in order to escalate his privileges.
Impacted products: WebSphere AS Liberty, WebSphere AS Traditional.
Severity: 2/4.
Consequences: privileged access/rights, user access/rights.
Provenance: intranet client.
Creation date: 16/03/2018.
Identifiers: 2012341, CVE-2017-1788, VIGILANCE-VUL-25567.

Description of the vulnerability

An attacker can bypass restrictions via Form Login Spoofing of WebSphere AS, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2017-12624

Apache CXF: denial of service via JAX-WS/JAX-RS

Synthesis of the vulnerability

An attacker can generate a fatal error via JAX-WS/JAX-RS of Apache CXF, in order to trigger a denial of service.
Impacted products: WebSphere AS Liberty, WebSphere AS Traditional, JBoss EAP by Red Hat.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: intranet client.
Creation date: 09/03/2018.
Identifiers: 2013597, 7043863, 7048591, CVE-2017-12624, ibm10715641, ibm10738249, RHSA-2018:2423-01, RHSA-2018:2424-01, RHSA-2018:2425-01, VIGILANCE-VUL-25511.

Description of the vulnerability

An attacker can generate a fatal error via JAX-WS/JAX-RS of Apache CXF, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2017-1741

WebSphere AS: information disclosure via Admin Console Panel Fields

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Admin Console Panel Fields of WebSphere AS, in order to obtain sensitive information.
Impacted products: Security Directory Server, Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Liberty, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: data reading.
Provenance: user account.
Creation date: 07/03/2018.
Identifiers: 2012342, 2014351, 2016162, 2016521, 2016822, 7043863, 7048591, CVE-2017-1741, VIGILANCE-VUL-25462.

Description of the vulnerability

An attacker can bypass access restrictions to data via Admin Console Panel Fields of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2017-1731

WebSphere Application Server traditional: privilege escalation via Admin Console

Synthesis of the vulnerability

An attacker can bypass restrictions via Admin Console of WebSphere Application Server traditional, in order to escalate his privileges.
Impacted products: Security Directory Server, Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Liberty, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 3/4.
Consequences: administrator access/rights, privileged access/rights.
Provenance: internet client.
Creation date: 30/01/2018.
Identifiers: 2012345, 2013084, 2013942, 2016520, 2017074, 7043863, 7048591, CVE-2017-1731, VIGILANCE-VUL-25174.

Description of the vulnerability

An attacker can bypass restrictions via Admin Console of WebSphere Application Server traditional, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-2579 CVE-2018-2581 CVE-2018-2582

Oracle Java: vulnerabilities of January 2018

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.
Impacted products: Debian, Fedora, AIX, DB2 UDB, IBM i, IRAD, Rational ClearCase, Security Directory Server, QRadar SIEM, Tivoli Storage Manager, Tivoli System Automation, WebSphere AS Liberty, WebSphere AS Traditional, IBM WebSphere ESB, WebSphere MQ, Junos Space, ePO, Java OpenJDK, openSUSE Leap, Java Oracle, Puppet, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: privileged access/rights, user access/rights, data reading, data creation/edition, data deletion, denial of service on service.
Provenance: document.
Number of vulnerabilities in this bulletin: 21.
Creation date: 17/01/2018.
Identifiers: 2013818, 2014315, 2015656, 2016042, 2016207, 2016278, 2016496, 2016502, CERTFR-2018-AVI-036, cpujan2018, CVE-2018-2579, CVE-2018-2581, CVE-2018-2582, CVE-2018-2588, CVE-2018-2599, CVE-2018-2602, CVE-2018-2603, CVE-2018-2618, CVE-2018-2627, CVE-2018-2629, CVE-2018-2633, CVE-2018-2634, CVE-2018-2637, CVE-2018-2638, CVE-2018-2639, CVE-2018-2641, CVE-2018-2657, CVE-2018-2663, CVE-2018-2675, CVE-2018-2677, CVE-2018-2678, DLA-1339-1, DSA-4144-1, DSA-4166-1, FEDORA-2018-223d8fc52a, FEDORA-2018-a82015aa02, FEDORA-2018-d50769efa0, FEDORA-2018-e2e52fb0bf, ibm10715641, ibm10717143, ibm10717207, ibm10718843, ibm10719115, ibm10719319, JSA10873, N1022544, openSUSE-SU-2018:0679-1, openSUSE-SU-2018:0684-1, RHSA-2018:0095-01, RHSA-2018:0099-01, RHSA-2018:0100-01, RHSA-2018:0115-01, RHSA-2018:0349-01, RHSA-2018:0351-01, RHSA-2018:0352-01, RHSA-2018:0458-01, RHSA-2018:0521-01, SB10225, SUSE-SU-2018:0630-1, SUSE-SU-2018:0645-1, SUSE-SU-2018:0661-1, SUSE-SU-2018:0663-1, SUSE-SU-2018:0665-1, SUSE-SU-2018:0694-1, USN-3613-1, USN-3614-1, VIGILANCE-VUL-25082.

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2017-1681

WebSphere Application Server: file reading

Synthesis of the vulnerability

A local attacker can read a file of WebSphere Application Server, in order to obtain sensitive information.
Impacted products: Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Liberty, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: data reading.
Provenance: document.
Creation date: 12/01/2018.
Identifiers: 2010419, 2011863, 2013085, 2013815, 2016039, 2016519, 7043863, 7048591, CVE-2017-1681, VIGILANCE-VUL-25032.

Description of the vulnerability

A local attacker can read a file of WebSphere Application Server, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2013-6440

OpenSAML: information disclosure via XML Entities

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via XML Entities of OpenSAML, in order to obtain sensitive information.
Impacted products: WebSphere AS Liberty, RHEL, JBoss EAP by Red Hat.
Severity: 2/4.
Consequences: data reading.
Provenance: document.
Creation date: 15/11/2017.
Identifiers: 2010415, 2011863, CVE-2013-6440, RHSA-2014:0170-01, RHSA-2014:0171-01, RHSA-2014:0172-01, RHSA-2014:0195-01, RHSA-2014:0452-01, RHSA-2014:1290-01, RHSA-2014:1291-01, RHSA-2014:1995-01, VIGILANCE-VUL-24441.

Description of the vulnerability

An attacker can bypass access restrictions to data via XML Entities of OpenSAML, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2017-1583

WebSphere AS: information disclosure via JSF MyFaces Errors

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via JSF MyFaces Errors of WebSphere AS, in order to obtain sensitive information.
Impacted products: Tivoli System Automation, WebSphere AS Liberty, WebSphere AS Traditional.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 24/10/2017.
Identifiers: 2008707, 2010466, CVE-2017-1583, VIGILANCE-VUL-24223.

Description of the vulnerability

An attacker can bypass access restrictions to data via JSF MyFaces Errors of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2011-4343

Apache MyFaces Core: information disclosure

Synthesis of the vulnerability

An attacker can bypass access restrictions to data of Apache MyFaces Core, in order to obtain sensitive information.
Impacted products: Tivoli System Automation, WebSphere AS Liberty, WebSphere AS Traditional.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 24/10/2017.
Identifiers: 2008707, 2010466, CVE-2011-4343, VIGILANCE-VUL-24222.

Description of the vulnerability

An attacker can bypass access restrictions to data of Apache MyFaces Core, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about IBM WebSphere AS Liberty: