Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

Authentication flaw

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks...

PEGA pega infinity 授权问题漏洞

PEGA pega infinity is an application from PEGA USA. Provides transition from digital chaos to true digital conversion. An authorization issue vulnerability exists in Pega Infinity versions 8.2.1 through 8.5.2, which stems from the fact that the password reset feature for local accounts can be use...

CVE-2020-15374

Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input...

Security Bulletin: A Security Vulnerability Has Been Identified In IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2020-4589)

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

Improper access control

Pega Platform 8.2.1 allows LDAP injection because a username can contain a character and can be of unlimited length. An attacker can specify four characters of a username, followed by the character, to bypass access control...

TIBCO Security Advisory: June 30, 2020 - TIBCO Managed File Transfer -2020-9413

TIBCO Managed File Transfer reflected XSS vulerability Original release date: June30, 2020 Last revised: CVE-2020-9413 Source: TIBCO Software Inc. TIBCO Managed File Transfer reflected XSS vulerability Original release date: June 30, 2020 Last revised: --- Source: TIBCO Software Inc. Systems...

Security Bulletin: A security vulnerability has been identified in Websphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2016-0359)

Summary Websphere Application Server is shipped as a component of IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security...

Unauthenticated user can check the whitelist rules for any URL

h3. Issue Summary This issue was discovered through our bug bounty program. An unauthenticated user can check if a URL is permitted through the whitelist. noformat /rest/whitelist/1/check?url=http://www.atlassian.comnoformat returns the whitelist rules associated with http://www.atlassian.com...

Path traversal

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

CVE-2019-9723

Summary: CVE-2019-9723 affects LogicalDOC Community Edition 8.x before 8.2.1. The vulnerability is a path traversal in the PluginRegistry that enables reading arbitrary files and creating directories outside the intended scope. Public sources in the connected set corroborate that the issue reside...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

LogicalDOC 8.2 Path Traversal Vulnerability

Impact In order to exploit this vulnerability an attacker needs to be an authenticated read-only user of the role guest. The attacker can read arbitrary files and create arbitrary directories on the server with the permissions of the user running the web server. It is recommended to update...

Jenzabar Cross-Site Scripting Vulnerability

Jenzabar is a set of student information management system from the American company Jenzabar. The system includes functions such as course management, enrollment management, financial management and human resource management. A cross-site scripting vulnerability exists in Jenzabar versions 8.2.1...

Brocade Fabric OS Session ID Interception and Manipulation Vulnerability

Fabric OS is the firmware for Brocade Communications Systems' Fibre Channel switches and Fibre Channel controllers. A session ID interception and manipulation vulnerability exists in the Web management interface of Brocade Fabric OS prior to 8.2.1, 8.1.2f, 8.0.2f, and 7.4.2d. An attacker could us...

CVE-2018-6442

A vulnerability in the Brocade Webtools firmware update section of Brocade Fabric OS before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow remote authenticated attackers to execute arbitrary commands...

CVE-2018-18020

In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a denial of service via a crafted PDF file...

BSA-2018-729

Security Advisory ID : BSA-2018-729 Component : Fabric OS CLI Revision : 1.0: Initial A vulnerability in the secryptocfg command of Brocade Fabric OS command line interface CLIcould allow a local attacker toescape the restricted shell and, gain root access. Affected Products Brocade Fabric OS...

BSA-2018-733

Security Advisory ID : BSA-2018-733 Component : Fabric OS Proxy Service Revision : 1.0: Initial A vulnerability in the proxy service of Brocade Fabric OS versions could allow remote unauthenticated attackersto obtain sensitive information and possibly cause a denial of service. Affected Products...

Pydio Remote Code Execution Vulnerability (CNVD-2018-21606)

Pydio formerly known as AjaXplorer is a web-based remote file manager. The manager supports uploading and downloading files, online file editing, image previewing and more. A security vulnerability exists in Pydio versions 4.2.1 through 8.2.1. A remote attacker can exploit the vulnerability to...