Weekly Update: a new vulnerability is published on the National Vulnerability Database (4 items)

New vulnerabilities from the NVD: CVE-2015-1503 Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php. Published at: May 08, 2018 at 11:29PM View on website May 09, 2018 at 02:42AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-5152 Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility (DCCU), which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted TaskResult.xml file. Published at: May 11, 2018 at 10:29PM View on website May 11, 2018 at 11:55PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-5151 The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior, independent of later disk changes. Published at: May 11, 2018 at 10:29PM View on website May 11, 2018 at 11:55PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-5150 Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a privileged local user to execute arbitrary code even after that user loses access and all disk partitions are reformatted. Published at: May 11, 2018 at 10:29PM View on website May 11, 2018 at 11:55PM via National Vulnerability Database