Security Bulletin: IBM MQ is vulnerable to multiple Jetty vulnerabilities (CVE-2021-34428, CVE-2021-34429, CVE-2021-28169)

Summary Multiple issues were identified in Eclipse Jetty that IBM MQ Explorer uses and is affected by. Vulnerability Details CVEID: CVE-2021-34428 DESCRIPTION: Eclipse Jetty could allow a physical attacker to bypass security restrictions, caused by a session ID is not invalidated flaw when an...

GitLab Access Control Error Vulnerability (CNVD-2021-99768)

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.GitLab CE/EE is vulnerable to an access control error that stems from the...

GitLab Information Disclosure Vulnerability (CNVD-2021-99767)

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, etc. An information disclosure vulnerability exists in GitLab CE/EE, which stems from an informati...

Observable Discrepancy in Argo

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. Specific Go Packages Affected...

[SECURITY] Fedora 34 Update: ImageMagick-6.9.12.31-1.fc34

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

CVE-2021-38967

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441...

Information disclosure

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215...

CVE-2021-38967

CVE-2021-38967 affects IBM MQ Appliance (9.2 CD and 9.2 LTS). A vulnerability allows a local privileged user to inject and execute malicious code due to a code-injection flaw. The IBM Security Bulletin references APAR IT38788 as remediation. Possible mitigations include upgrading to IBM MQ Applia...

CVE-2021-38958

CVE-2021-38958 affects IBM MQ Appliance 9.2 CD and 9.2 LTS. The issue is a denial-of-service caused by a concurrency flaw in the appliance, leading to an availability impact. The vulnerability is documented with CVSS metrics (base score 5.5 in CVSS 3.1 with LOCAL, LOW complexity, HIGH availabilit...

CVE-2021-38958: Undefined Security Weakness

IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. IBM X-Force ID: 212042...

CVE-2021-39000: Exposure of Sensitive Information to an Unauthorized Actor

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2021-38958)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-38958 DESCRIPTION: IBM MQ Appliance is affected by a denial of service attack caused by a concurrency issue. CVSS Base score: 5.1 CVSS Temporal Score: See:...

Security Bulletin: IBM MQ Appliance is affected by a disclosure of sensitive information vulnerability (CVE-2021-39000)

Summary IBM MQ Appliance has resolved a disclosure of sensitive information vulnerability. Vulnerability Details CVEID: CVE-2021-39000 DESCRIPTION: IBM MQ could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. CVSS Base score: 5.9 CVSS...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

Security Bulletin: IBM MQ Java/JMS clients can inadvertently display cleartext credentials via diagnostic logs (CVE-2021-38949)

Summary An issue was idenitifed in IBM MQ Java and JMS clients where they could display clear text credentials in diagnostics log files automatically generated during system crashes. Vulnerability Details CVEID: CVE-2021-38949 DESCRIPTION: IBM MQ stores user credentials in plain clear text which...

CVE-2021-29843: Undefined Security Weakness

IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203...

Kingdia CD Extractor 3.0.2 Buffer Overflow

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Date: 31.10.2021 Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt...

Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Date: 31.10.2021 Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-91184)

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.GitLab CE/EE is vulnerable to a cross-site scripting vulnerability that could b...

Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH) Exploit

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt and copy All...