CVE-2019-4478

IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not normally have access to. IBM X-Force ID: 163998...

HackerOne: Unauthorized access to metadata of undisclosed reports that were retested

Summary: reportretests object in User node discloses some information about undisclosed report Description: An attacker can get some infomation such as "assetname" , "assettype" , "severityrating" , "weaknessname" of undisclosed report Steps To Reproduce 1. Invoke the below graphql call POST...

JVN#61849442: PALLET CONTROL vulnerable to arbitrary code execution

PALLET CONTROL provided by JAL Information Technology Co., Ltd. is IT asset management software. PALLET CONTROL contains an arbitrary code execution vulnerability due to improper file access permission CWE-284. Impact A user who can login to the computer where the vulnerable product is installed...

ManageEngine Asset Explorer Windows Agent Remote Code Execution Vulnerability

Exploit for php platform in category web applications ManageEngine Asset Explorer Windows Agent Remote Code Execution Vulnerability Identifiers ------------------------------------------------- CVE-2020-8838 XL-20-003 CVSSv3 score ------------------------------------------------- 7.5...

ManageEngine Asset Explorer Windows Agent Remote Code Execution

XL-2020-003 - Asset Explorer Windows Agent - Remote Code Execution =============================================================================== Identifiers ------------------------------------------------- CVE-2020-8838 XL-20-003 CVSSv3 score ------------------------------------------------- 7...

Teclib GLPI SQL Injection Vulnerability

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A SQL injection vulnerability exists in Teclib GLPI versions prior to 9.4.6...

Logic Flaw Vulnerability in GOAL Bonanza

GOAL Bonanza GOAL is an ethereum-based virtual currency.A security vulnerability exists in the 'mintToken' function in GOAL's smart contract implementation. An attacker could exploit the vulnerability to increase the balance of a digital asset at any address...

Logic flaw vulnerability in Globalvillage ecosystem

Globalvillage ecosystem GVE is a virtual currency system based on blockchain technology.A security vulnerability exists in the 'approveAndCallcode' function in GVE's smart contract implementation, which stems from the program's failure to validate the callcode. The vulnerability can be exploited ...

Logic Flaw Vulnerability in Internet Node Token

Internet Node Token TNT is an ethereum-based virtual currency.A security vulnerability exists in the 'mintToken' function in INT's smart contract implementation. An attacker could exploit the vulnerability to increase the balance of a digital asset at any address...

Aditus Security Vulnerabilities

Aditus ADI is an ethereum-based digital currency.A security vulnerability exists in the 'approveAndCall' function in ADI's smart contract implementation. The vulnerability can be exploited by an attacker to steal assets e.g., transfer all contract balances to the attacker's account...

Prototype Pollution

Overview lodash-rails is a lodash for the Rails asset pipeline. Affected versions of this package are vulnerable to Prototype Pollution. The function zipObjectDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects. PoC js...

Security Bulletin: Security vulnerability is identified in the WebSphere Application Server where the Rational Asset Manager is deployed (CVE-2020-4362)

Summary In the WebSphere Application Server Admin console where the Rational Asset Manager is deployed, a privilege escalation vulnerability is observed. Information about these security vulnerability affecting WebSphere Application Server is published in the respective security bulletins...

YLCToken has a flawed logic vulnerability

YLCToken is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function of YLCToken's smart contract implementation. An attacker could exploit this vulnerability to prevent the seller from obtaining the assets due to the exchange...

ETHEREUMBLACK Logic Flaw Vulnerability

ETHEREUMBLACK ETCBK is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in ETCBK's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...

Crowdnext has a flawed logic vulnerability

Crowdnext CNX is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function of CNX's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...

Security Bulletin: A security vulnerability has been identified in the WebSphere Application Server where the Rational Asset Manager is deployed. (CVE-2017-1741)

Summary In the WebSphere Application Server where the Rational Asset Manager is deployed, a potential information disclosure vulnerability is identified. Information about this security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability...

Security Bulletin: A security vulnerability has been identified in the WebSphere Application Server where the Rational Asset Manager is deployed. (CVE-2017-1743)

Summary In the WebSphere Application Server where the Rational Asset Manager is deployed, a potential information disclosure vulnerability is identified due to improper handling of Administrative Console panel fields. Information about this security vulnerability affecting WebSphere Application...

Security Bulletin: A security vulnerability has been identified in the Apache POI, which is vulnerable to Denial of Service. (CVE-2017-12626, CVE-2017-5644)

Summary The Apache POI has security vulnerability to exploit the application through denial of service. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details IBM Rational Asset Manager bundles Apache POI, which is used to set custom attribut...

CVE-2019-4446

IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490...

CVE-2019-4749

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308...