The vulnerability of the Trace File Analyzer (TFA) Collector utility, a clustering application for Oracle Clusterware, allows a malicious individual to gain unauthorized access to protected data or cause partial service failure.

The vulnerability of the Trace File Analyzer TFA Collector utility, a tool for clustering Oracle Clusterware, is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data or cause partial service failure through...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affect Rational Asset Analyzer.

Summary A vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.30 and IBM® Runtime Environment Java™ Version 8.0.5.30 used by Rational Asset Analyzer. Rational Asset Analyzer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2602 DESCRIPTION: An unspecified...

CVE-2019-2860

Vulnerability in the Oracle Clusterware component of Oracle Support Tools subcomponent: Trace File Analyzer TFA Collector. The supported version that is affected is 12.1.0.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

Oracle Support Tools Clusterware Component Denial of Service Vulnerability

Oracle Support Tools is a set of Oracle support tools from Oracle Corporation.Clusterware is a set of portable clusterware. A security vulnerability exists in the Trace File Analyzer TFA Collector subcomponent of the Clusterware component of Oracle Support Tools, version 12.1.0.2.0. An attacker...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS vulnerability.

Summary Asset Analyzer RAA has addressed the following vulnerability. IBM WebSphere Application Server is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. Vulnerability Details...

Security Bulletin: Asset Analyzer (RAA) is affected by a WebSphere Application Server vulnerability

Summary Asset Analyzer RAA has addressed the following vulnerability. IBM WebSphere Application Server could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. Vulnerability Details CVEID: CVE-2018-1901 DESCRIPTION: IBM...

UPDATE: OWASP Dependency-Check 5.1.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. Some days back, a new version was released. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP...

Security Bulletin: A vulnerability in Apache Solr affects IBM InfoSphere Information Server

Summary A vulnerability in Apache Solr was addressed by IBM InfoSphere Information Server. Vulnerability Details CVE-ID: CVE-2019-0192 Description: Apache Solr could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization of untrusted data flaw in...

Security Bulletin: IBM InfoSphere Information Analyzer and Information Governance Catalog is affected by an Information Disclosure vulnerability

Summary An Information Disclosure vulnerability was addressed by IBM InfoSphere Information Analyzer and Information Governance Catalog. Vulnerability Details CVEID: CVE-2019-4257 DESCRIPTION: IBM InfoSphere Information Analyzer is affected by an information disclosure vulnerability. Sensitive...

UPDATE: Ostinato 0.9!

PenTestIT RSS Feed This tool came to my rescue yet again today! If you remember, I had blogged about this tool in my older post titled - Ostinato: The Network Traffic Generator and Analyzer! As always, before using any tool I tried to update it and there it was - Ostinato 0.9. This update was...

bro -- Null pointer dereference and Signed integer overflow

Jon Siwek of Corelight reports: This is a security patch release to address potential Denial of Service vulnerabilities: Null pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. Signed integer overflow in BinPAC-generated...

RecScanSec - Reconnaisance Scanner Security

RecScanSec made for reconnaisance Scanner and information gathering with an emphasis on simplicity. It will do everything from. Features Information Security Headers WAF Analyzer Information Disclosure Banner Grabbing Url Crawl HTML Form Detector Port Scanner Get SSL Information Subdomain...

ZOHO ManageEngine Netflow Analyzer SQL Injection Vulnerability

ZOHO ManageEngine Netflow Analyzer is a set of web-based bandwidth monitoring tools. A SQL injection vulnerability exists in ZOHO ManageEngine Netflow Analyzer /client/api/json/v2/nfareports/compareReport, which can be exploited by remote attackers to submit a specially crafted SQL request to...

CVE-2018-10171

Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shel...

CVE-2019-12196

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

CVE-2019-12196

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

Sql injection

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

CVE-2019-12196

CVE-2019-12196 affects Zoho ManageEngine NetFlow Analyzer 12.3, with a SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport. The issue is exploitable via the DeviceID parameter, allowing an attacker to execute arbitrary SQL commands. Public references across sources (NVD, R...

CVE-2019-12196

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Asset Analyzer

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.27 used by Rational Asset analyzer. Rational Asset analyzer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-12547 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a buffer overflow,...