Hardcoded credentials

IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the administrator. IBM X-Force ID: 144656...

CVE-2018-1650

CVE-2018-1650 affects IBM QRadar Incident Forensics (and relates to QRadar SIEM) with hard-coded credentials that could allow an attacker to bypass the administrator’s authentication. Affected versions for Incident Forensics: 7.2.0–7.2.8 Patch 13 and 7.3.0–7.3.1 Patch 4; IBM has remediation patch...

CVE-2018-1568

IBM QRadar SIEM versions 7.2.0–7.2.8 Patch 13 and 7.3.0–7.3.1 Patch 4 are affected by a vulnerability where browsers cache web pages containing sensitive information, enabling a local attacker with access to read data stored on the user’s hard drive. IBM/IBM X-Force ID: 143118. Remediation: upgra...

CVE-2018-1730

IBM QRadar SIEM is vulnerable to XML External Entity (XXE) injection when processing XML data. Affected versions are QRadar SIEM 7.2.0–7.2.8 Patch 13 and 7.3.0–7.3.1 Patch 6. The root cause is improper handling of external XML entities, enabling a remote attacker to exfiltrate sensitive informati...

CVE-2018-1648

IBM QRadar Incident Forensics is affected by CVE-2018-1648 due to use of outdated insecure cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Affected versions: QRadar Incident Forensics 7.2.0–7.2.8 Patch 13 and 7.3.0–7.3.1 Patch 5. Impact as described:...

HP Intelligent Management Java Deserialization Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "HP Intelligent Management Java Deserialization RCE", 'Description' = %q This vulnerability allows remote attackers to execute arbitrary code on...

CVE-2018-7114

HPE/iMC (HP/H3C Intelligent Management Center) PLAT before 7.3 E0605P06 is vulnerable to a stack-based buffer overflow in the dbman component when processing decryption/requests, leading to remote code execution or crashes. Affected product: iMC PLAT versions prior to 7.3 E0605P06. Root cause: im...

Fedora 27 : php-phpmailer6 (2018-46b92c9064)

Version 6.0.6 - SECURITY Fix potential object injection vulnerability. CVE-2018-19296. Reported by Sehun Oh of cyberone.kr. - Added Tagalog translation, thanks to StoneArtz - Added Malagache translation, thanks to Hackinet - Updated Serbian translation, fixed incorrect language code, thanks to...

Updated roundcubemail packages fix security vulnerability & bugs

This is a service release to update the stable version 1.3 of Roundcube Webmail. It contains fixes to several bugs backported from the master branch including a security fix for a reported XSS vulnerability in handling invalid style tag content plus updates to ensure compatibility with PHP 7.3 an...

Fedora 27 : php-pear-CAS (2018-95695b59c7)

Version 1.3.6 Security Fixes: - Fix XSS in proxy mode 271 Joachim Fritschi Bug Fixes: - Fix bad condition 252 Brice Vercoustre - Hash ticket strings to generate valid-length session-ids 224, 244, 248 Adam Franco - Fix 'phpCAS' class capitalization in code 273, 277 phy25 Improvement: - Remove...

Fedora 27 : roundcubemail (2018-d527206a77)

Version 1.3.8 This is a service release to update the stable version 1.3 of Roundcube Webmail. It contains fixes to several bugs backported from the master branch including a security fix for a reported XSS vulnerability plus updates to ensure compatibility with PHP 7.3 and recent versions of...

IBM QRadar Incident Forensics Denial of Service Vulnerability

IBM QRadar Incident Forensics is a suite of security forensic investigation software from IBM. The software supports in-depth forensic investigations of suspected malicious network security incidents, and the repair of network security vulnerabilities. A security vulnerability exists in IBM QRada...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with OpenPages GRC Platform (CVE-2018-1695)

Summary IBM WebSphere Application Server is shipped as a component of OpenPages GRC Platform. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM WebSphere...

CVE-2018-1647

CVE-2018-1647 affects IBM QRadar Incident Forensics 7.2.x and 7.3.x. The issue arises from insufficient restriction of the size/quantity of resources requested, enabling an unauthenticated user to cause a denial of service. Public details in the IBM security bulletin enumerate affected versions: ...

Fedora 27 : php-tcpdf (2018-187e212568)

Version 6.2.25 - Fix support for image URLs. ---- Version 6.2.24 - Support remote urls when checking if file exists. ---- Version 6.2.23 - Simplify fileexists function. ---- Version 6.2.20 - Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization o...

HPE Intelligent Management Center Remote Code Execution Vulnerability

HPE Intelligent Management Center iMC is a suite of network intelligent management center solutions from Hewlett Packard Enterprise HPE. The solution provides network-wide visibility and enables comprehensive management of resources, services, and users. wireless Service Manager WSM Software is o...

Remote code execution

A Remote Code Execution vulnerability was identified in HPE Intelligent Management Center iMC Wireless Services Manager Software earlier than version IMC WSM 7.3 E0506P02...

CVE-2018-1571

IBM QRadar SIEM is affected by CVE-2018-1571. A remote authenticated attacker could execute arbitrary commands by sending a specially crafted request, due to OS command injection where user-supplied data reaches the system shell. Affected: QRadar SIEM 7.2.x up to 7.2.8 Patch 13 (and interim fixes...

Information disclosure

IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log files. IBM X-Force ID: 134001...

CVE-2017-1679

IBM OpenPages GRC Platform versions 7.2–8.0 are affected by CVE-2017-1679, an information-disclosure vulnerability that could allow an attacker to obtain sensitive data from error log files. The IBM security bulletin confirms the affected products and provides remediation: apply fixes for each ve...