CVE-2021-37861

Mattermost 6.0.2 and earlier: a vulnerability where passwords are not sufficiently sanitized in audit logs when user creation fails. Root cause is inadequate cleaning of the user’s password in audit logs, potentially exposing sensitive credentials in logs. The available documents do not specify a...

CVE-2021-37130

There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a directory that is located underneath a restricted parent directory, but the software does not properly valida...

ownCloud < 5.0.15, 6.0.x < 6.0.2 Multiple Vulnerabilities

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

CVE-2021-3051

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSO...

Security Bulletin: Security vulnerabilitiy has been fixed in IBM Security Identity Manager (93519)

Summary Security vulnerability has been fixed in IBM Security Identity Manager Vulnerability Details Third Party Entry: 93519 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when processing XML data. B...

Security Bulletin: Security vulnerabilities have been fixed in IBM Security Identity Manager (CVE-2021-29687, CVE-2021-29688)

Summary Security vulnerability has been fixed in IBM Security Identity Manager 6.0.2 Vulnerability Details CVEID: CVE-2021-29687 DESCRIPTION: IBM Security Identity Manager could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. CVSS...

IBM Sterling Secure Proxy 信任管理问题漏洞

IBM Sterling Secure Proxy creates a security barrier for trusted networks by preventing direct connections between external partners and internal servers. IBM Sterling Secure Proxy versions 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contain a hard-coded credential vulnerability. An attacker could use thi...

Security Bulletin: Multiple Vulnerabilities Affect IBM Secure Proxy

Summary There are multiple vulnerabilities in IBM Secure Proxy. IBM Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-29723 DESCRIPTION: IBM Sterling Secure Proxy uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

Code injection

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580 regex injection leading to DoS

User controlled request.getHeader"Referer", request.getRequestURL and request.getQueryString are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the...

CVE-2021-33580

Apache Roller suffers a vulnerability where user-controlled inputs from Referer, Request URL, and QueryString are used to build and execute a regex, enabling regular-expression DoS (ReDoS) via catastrophic backtracking on the server. Impact described as availability issues; fixed in Roller 6.0.2....

Security Bulletin: Unrestricted document type definition vulnerability affects IBM Sterling Secure Proxy

Summary IBM Sterling Secure Proxy is affected by an unrestricted document type definition vulnerability. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-29749 DESCRIPTION: IBM Sterling Secure Proxy is vulnerable to server-side request forgery SSR...

CVE-2021-20483

IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery SSRF. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197591...

CVE-2021-20488

CVE-2021-20488 affects IBM Security Identity Manager 6.0.2 with the Windows Password Synchronization Plug‑in. A remote authenticated attacker could change passwords for other users in a Windows AD environment, due to improper handling in the ISIM Password Sync Plug‑in flow. The issue is confirmed...

Security Bulletin: Security vulnerabilities affect IBM® Rational® Team Concert

Summary IBM Team Concert RTC is vulnerable to multiple cross-site scripting vulnerabilities. Vulnerability Details CVEID: CVE-2018-1408 DESCRIPTION: IBM Team Concert RTC is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Security Bulletin: Vulnerability in Rational Team Concert with potential for Cross-Site Scripting attack (CVE-2016-0331)

Summary IBM Team Concert RTC is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2016-0331 DESCRIPTION: IBM Team Concert RTC is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A...

Security Bulletin: Cross-site scripting Vulnerability in IBM® Rational® Quality Manager

Summary IBM® Rational® Quality Manager is affected by a potential cross-site scripting vulnerability Vulnerability Details CVEID: CVE-2017-1609 DESCRIPTION: IBM Quality Manager RQM is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Rational® Quality Manager

Summary IBM® Rational® Quality Manager is vulnerable to multiple security vulnerabilities. Vulnerability Details CVEID: CVE-2019-10173 DESCRIPTION: xstream API could allow a remote attacker to execute arbitrary commands on the system, caused by insecure XML deserialization. By sending a...