Security Bulletin: IBM Automation Decision Services December 2023 - Multiple CVEs addressed

Summary IBM Automation Decision Services is vulnerable to denial of service attacks in third party and open source used in the product for various functions. See full list below. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-32681 DESCRIPTION: python-requests could...

Malicious code in sync-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 335de7612c8237e0a74d2c894424bda2c8a5e6547fa9bb6782ec0a94d4353226 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: A vulnerability in axios affects IBM Robotic Process Automation and may result in cross-site request forgery (CVE-2023-45857).

Summary axios is used by IBM Robotic Process Automation as part of control center CVE-2023-45857. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By inserting the X-XSRF-TOKEN header...

Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to cross-site request forgery (CVE-2023-45857)

Summary There is a vulnerability in Axios used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery,...

Security Bulletin: IBM Maximo Application Suite uses axios-0.25.0.tgz which is vulnerable to CVE-2023-45857

Summary IBM Maximo Application Suite uses axios-0.25.0.tgz which is vulnerable to CVE-2023-45857. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by...

Exploit for Missing Authorization in Zoneminder

CVE-2023-26035 ZoneMinder Snapshots - Unauthenticated !image...

Security Bulletin: Vulnerabilities in axios affect IBM Voice Gateway

Summary Security Vulnerabilities in axios affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By inserting the X-XSRF-TOK...

CVE-2023-45857

A flaw was found in Axios that may expose a confidential session token. This issue can allow a remote attacker to bypass security measures and view sensitive data. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Securi...

Cross-Site Request Forgery

axios is vulnerable to Cross-Site Request Forgery. The vulnerability is due to the xhr.js setting config.withCredentials to true which enables the sending of a confidential XSRF-TOKEN cookie within the X-XSRF-TOKEN HTTP header for all requests. This allows attackers to view sensitive information...

2.typescript-init (1.0.0), 5p-buyform (>=0.0.1, <=0.0.4) +3991 more potentially affected by CVE-2023-45857 via axios (>=1.0.0, <=1.5.1)

axios NPM version =1.0.0, =0.0.1, =0.0.1, =0.0.74, =0.0.14, =1.0.5, =1.14.5, =1.0.30, =6.0.0, =0.0.1, =0.0.1, =1.2.3, =0.1.39, =1.43.0-update-pkgs.0, =1.132.0 and more Source cves: CVE-2023-45857 Source advisory: OSV:GHSA-WF5P-G6VW-RHXX...

GHSA-WF5P-G6VW-RHXX Axios Cross-Site Request Forgery Vulnerability

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

Axios Cross-Site Request Forgery Vulnerability

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

DEBIAN-CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

UBUNTU-CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

Design/Logic Flaw

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

CVE-2023-45857 - Axios XSRF token exposure : The issue in Axios 1.5.1 causes the confidential XSRF-TOKEN stored in cookies to be included in the HTTP header X-XSRF-TOKEN for every request, potentially allowing an attacker to view sensitive information. The public metrics indicate a CVSS v3.1 base...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...