Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2020-14782, CVE-2020-14781, CVE-2020-27221)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 and Version 7 used by Watson Explorer and Watson Explorer Content Analytics Studio. Watson Explorer and Watson Explorer Content Analytics Studio have addressed the applicable CVEs. Vulnerability Details CVEID:...

MDR Vendor Must-Haves, Part 4: Ingestion of Authentication Data Across Local, Domain, and Cloud Sources

This blog post is part of an ongoing series about evaluating Managed Detection and Response MDR providers. For more insights, check out our guide, “10 Things Your MDR Service Must Do.” There isn’t a single threat or breach that doesn’t involve attackers using legitimate credentials to cause harm...

Knowage HTML Injection Vulnerability

Knowage is a suite of open source tools for modern business analytics. An HTML injection vulnerability exists in Knowage versions prior to 7.4. The vulnerability can be exploited to inject arbitrary HTML into "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters...

CVE-2021-30055

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'paryear' parameter when running a report...

CVE-2021-30055

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'paryear' parameter when running a report...

Sql injection

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'paryear' parameter when running a report...

CVE-2021-30055

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'paryear' parameter when running a report...

New Security Signals study shows firmware attacks on the rise; here’s how Microsoft is working to help eliminate this entire class of threats

Cybersecurity threats are always evolving, and today we’re seeing a new wave of advanced attacks targeting areas of computing that don’t have the protection of the cloud. New data shows that firmware attacks are on the rise, and businesses aren’t paying close enough attention to securing this...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Operations Analytics Predictive Insights (CVE-2020-4949)

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about WebSphere Application Server vulnerability to an XML External Entity Injection XXE attack when processing XML data CVE-2020-4949 has been published in a security...

Security Bulletin: Multiple vulnerabilities in affect IBM® SDK, Java™ Technology Edition may affect IBM Operations Analytics Predictive Insights

Summary Multiple vulnerabilities CVE-2020-14803, CVE-2020-27221 in IBM® SDK, Java™ Technology Edition affect IBM Operations Analytics Predictive Insights 1.3.6 and earlier and were disclosed as part of the IBM SDK, Java Technology Edition Quarterly CPU - Jan 2021. Vulnerability Details Refer to t...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server traditional shipped with IBM Operations Analytics Predictive Insights (CVE-2020-4629)

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about WebSphere Application Server vulnerability CVE-2020-4629 through exploiting access to FFDC logs file on the server has been published in a security bulletin...

GitLab Access Control Error Vulnerability (CNVD-2021-26066)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An access control error vulnerability exists in GitLab, which can be exploited by unauthorized user...

Uber: IDOR leads to See analytics of Loyalty Program in any restaurant.

Improper authorization allowed for disclosure any restaurant's analytics of the Loyalty Program on 3 endpoints...

UBUNTU-CVE-2021-22180

An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages...

CVE-2021-22180

Removed by vendor...

PT-2021-14892 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.4 and later Description: An issue has been discovered in GitLab, where improper access control allows unauthorized users to access details on analytic pages. Recommendations: For versions 13.4 and later, update to a version...

qianjunakasumi kongchuanhujiao 授权问题漏洞

qianjunakasumi kongchuanhujiao is qianjunakasumi an open source application . An online teaching quiz statistics deep learning analytics system . A security vulnerability exists in github.com/kongchuanhujiao/server before version 1.3.21, which stems from an authentication bypass...

GitLab 安全漏洞

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An access control error vulnerability exists in GitLab, which can be exploited by unauthorized user...

CVE-2021-29095 ArcGIS Server image service and raster analytics security update: uninitialized pointer

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 and earlier allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account...

CVE-2021-29093 ArcGIS Server image service and raster analytics security update: use-after-free

A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 and earlier allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account...