CVE-2019-4483
published 2019-08-20CVE-2019-4483: IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could…
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.96%
78.0th percentile
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164067.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | contract_management | — | — |
| ibm | contract_management | — | — |
| ibm | emptoris_contract_management | 10.1.0 – 10.1.3 | — |
| ibm | emptoris_spend_analysis | — | — |
| ibm | emptoris_spend_analysis | — | — |
| ibm | emptoris_spend_analysis | 10.1.0 – 10.1.3 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.6HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-19481 opensc: Improper handling of buffer limits for CAC certificates
bugzilla·2019-12-12·CVSS 4.6
CVE-2019-19481 [MEDIUM] CVE-2019-19481 opensc: Improper handling of buffer limits for CAC certificates
CVE-2019-19481 opensc: Improper handling of buffer limits for CAC certificates
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.
Reference:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/b75c002cfb1fd61cd20ec938ff4937d7b1a94278
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1782957]
Affects: fedora-all [bug 1782956]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://
Bugzilla
CVE-2019-19479 opensc: Incorrect read operation during parsing of a SETCOS file attribute
bugzilla·2019-12-11·CVSS 5.5
CVE-2019-19479 [MEDIUM] CVE-2019-19479 opensc: Incorrect read operation during parsing of a SETCOS file attribute
CVE-2019-19479 opensc: Incorrect read operation during parsing of a SETCOS file attribute
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.
Reference:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/c3f23b836e5a1766c36617fe1da30d22f7b63de2
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1782521]
Affects: fedora-all [bug 1782520]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will b
Bugzilla
CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
bugzilla·2019-10-24·CVSS 6.4
CVE-2019-15945 [MEDIUM] CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
CVE-2019-15945 opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d5608e68
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1765224]
Affects: fedora-all [bug 1765223]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-15945
Bugzilla
CVE-2019-15946 opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
bugzilla·2019-10-24·CVSS 6.4
CVE-2019-15946 [MEDIUM] CVE-2019-15946 opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
CVE-2019-15946 opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c
OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
Upstream commit:
https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb42740
Discussion:
Created opensc tracking bugs for this issue:
Affects: epel-6 [bug 1765232]
Affects: fedora-all [bug 1765231]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:4483 https://access.redhat.com/errata/RHSA-2020:4483
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-15946
2019-08-20
Published