October 2019 - What's New in Security?

The October 2019 Release includes enhancements to Akamai security products with many new and updated capabilities. Highlights and capabilities that our customers have been particularly excited about include: The Bot Intelligence Console provides greater visibility into the bot landscape, allowing...

CVE-2019-16114

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...

CVE-2019-16114

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...

Knowage Access Control Bypass Vulnerability

Knowage is a suite of open source tools for modern business analytics. An access control bypass vulnerability exists in Knowage 6.1.1 and earlier versions. An attacker can exploit this vulnerability to bypass access control and gain access to the entire application...

CVE-2019-13188

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application...

CVE-2019-0341

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...

CVE-2019-0341

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...

Design/Logic Flaw

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...

Easy VPN Transition With Zero Trust Access

Akamai recently announced Enterprise Application Access capabilities designed to improve performance and user experience, as well as provide an easy migration away from VPN, reducing complexity and risk. The new capabilities -- IP address-based access, on-premises network detection, and captive...

Facebook HHVM Information Disclosure Vulnerability

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of loading dynamic pages in PHP. An information disclosure vulnerability exists in HHVM. An attacker can exploit this vulnerability to gain direct access to an application,...

Intercept SaaS Services with the Akamai EAA Client

I was quite fortunate to visit Tokyo for the first time last year, and it was an unforgettable experience to explore all the sights and sounds around the Ginza district and to interact with the very friendly Japanese people. It wasn't all play, though -- and I had to get some real work done as...

Insecure Session Management

infinispan spring-core contains insecure session management. In AbstractInfinispanSessionRepository.java, when getId returns a different value from getOriginalId, the original session is not deleted. An attacker can reuse the original ID to gain access to the application as the user...

Information Disclosure

Apache ZooKeeper is affected by unauthorized information disclosure. getACL command does not check permissions when retrieving the ACLs of the requested node. Consequently, plaintext information contained in the ACL Id field is returned. This allows an attacker to retrieve users' Id and...

[SECURITY] [DLA 1791-1] lemonldap-ng security update

Package : lemonldap-ng Version : 1.9.7-3+deb9u1 CVE ID : CVE-2019-12046 Debian Bug : 928944 An attack vector was discovered by the lemonldap-ng developers. When the SAML or CAS service provider is enabled and the administrator has chosen to store the SAML/CAS tokens in the session database, an...

Information Disclosure

Apache Tomcat is vulnerable to information disclosure. The character sequence " in a cookie value is incorrectly handled, allowing a remote user to exploit the vulnerability to obtain users' session tokens and gain access to the application as the victims...

Information Disclosure

Jenkins Repository Connector is vulnerable information disclosure. Usernames and passwords are stored in plaintext in its global configuration file on the Jenkins master. A local user will be able to retrieve the information and gain access to the application as other users...

Information Disclosure

yiisoft/yii2 is vulnerable to information disclosure. Confidential information such as HTTP authentication credentials containing username and password are logged in \yii\log\Target, which could allow an attacker to retrieve the information from log files and gain access to the application...

Citrix Web Application Firewall : 400 Bad Request

Getting the error "The request failed with HTTP status 400:." when opening an application hosted using a Load balancing Virtual Server when Application Firewall Profile is bound. Sample entry seen in /var/log/ns.log : Nov 22 09:49:45 172.25.224.219 11/22/2018:09:49:45 GMT qahvpxlb09 0-PPE-1 :...

Replay Attack

tendrl-api is vulnerable to replay attack. The server does not invalidate session tokens immediately when a user logs out of the application. This allows an attacker, who has obtained a user's session tokens via sniffing/MitM attack, to re-use or replay a user's session token or request to gain...

Insecure Cookies

noVNC did not provide support for secure cookies in an HTTPS session. This causes browsers to send session cookies in an insecure HTTP channel. An attacker who is able to intercept traffic will be able to capture cookie information and access the application on behalf of the user...