Security Bulletin: WebSphere Application Server Liberty API Discovery feature has potential vulnerability (CVE-2016-2945)

Summary There is a potential for weaker than expected security when using the WebSphere Application Server Liberty profile API Discovery feature and Swagger documents. Vulnerability Details CVEID: CVE-2016-2945 DESCRIPTION: IBM WebSphere Application Server Liberty Profile using the API Discovery...

RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier

Description: The RubyGems client supports a gem server API discovery functionality, which is used when pushing or pulling gems to a gem distribution/hosting server, like RubyGems.org. This functionality is provided via a SRV DNS request to the users gem source hostname prepended with...

CVE-2016-2945

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

CVE-2016-2945

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

Design/Logic Flaw

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

CVE-2016-2945

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

CVE-2016-2945

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

CVE-2016-2945

CVE-2016-2945 affects IBM WebSphere Application Server Liberty (8.5.5.8–8.5.5.9) before Liberty Fix Pack 16.0.0.2. Root cause: API Discovery feature in Liberty evaluates Swagger documents with external references, enabling an authenticated remote user to gain privileges via an external reference....

SevDesk v1.1 iOS - Persistent Dashboard Vulnerability

Document Title: =============== SevDesk v1.1 iOS - Persistent Dashboard Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1311 Release Date: ============= 2015-04-22 Vulnerability Laboratory ID VL-ID: ==================================== 1311...