Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2017-1681)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection (CVE-2017-1124)

Summary IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection. Vulnerability Details CVEID: CVE-2017-1124 DESCRIPTION: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injectio...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-9736)

Summary IBM WebSphere Application Server is shipped with Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter...

Security Bulletin: Multiple vulnerabilities identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2016-0201, CVE-2015-7420)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files (CVE-2015-7487)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files. Vulnerability Details CVEID: CVE-2015-7487 DESCRIPTION: IBM Maximo Asset Management contains a vulnerability which...

Security Bulletin: Security Vulnerability in IBM Maximo Asset Management (CVE-2015-1951) allows cacheable HTTPS response

Summary A vulnerability in Maximo Asset Management could allow an attacker to obtain sensitive information which is stored in a local cache. The vulnerability affects Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization,...

Security Bulletin: Cross-Site Scripting (XSS) and Remote Code Execution Vulnerabilities Affecting Asset and Service Management (CVE-2015-0104, CVE-2015-0107, CVE-2015-0108, CVE-2015-0109)

Summary There are cross-site scripting and remove code execution vulnerabilities in code that is used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: Information Disclosure Vulnerability Addressed in Asset and Service Management (CVE-2014-4765)

Summary IBM Maximo Asset Management could allow an attacker to obtain directory information from an error message. This information could be used to aid in further attacks against the system. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management...

Security Vulnerabilities Addressed in Asset and Service Mgmt

Abstract Security Bulletin: Security vulnerabilities in Maximo Asset Mgmt, Tivoli Asset Mgmt for IT, Tivoli Service Request Manager, Change and Configuration Mgmt Database. See Vulnerability Details for CVE IDs Content VULNERABILITY DETAILS: CVE ID: CVE-2011-1394, CVE-2011-1395, CVE-2011-1396,...

Cisco FireSIGHT System VPN Policy Bypass Vulnerability

A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerabili...

Micro Focus Universal CMDB, CMS and UCMDB Browser Cross-Site Scripting Vulnerabilities

Micro Focus Universal CMDB, CMS and UCMDB Browser are all products of Micro Focus, a UK-based company. Micro Focus Universal CMDB is a resource management solution; CMS is a CMDB configuration management system; UCMDB Browser is a lightweight, web-based client for accessing UCMDB Universal...

PT-2018-17586 · Micro Focus · Hp Universal Cmdb +2

Name of the Vulnerable Software and Affected Versions: Micro Focus Universal CMDB versions 10.20 through 10.33, 11.0 Micro Focus CMS versions 4.10 through 4.15.1 Micro Focus UCMDB Browser versions 4.10 through 4.15.1 Description: The issue is related to Cross-Site Scripting XSS, which could be...

Katello Command Execution Vulnerability

Katello is a system management engine that provides workflows for configuration management, subscription management and content management. A security vulnerability exists in Katello. A remote attacker can exploit the vulnerability to invoke the 'system removedeletion' command...

A Cyber Engineering Primer: Automated Tools for Compliance Auditing

Cybersecurity practitioners sometimes forget to define and explain the terms we use during the course of our work. Thus, my colleagues and I have embarked on a series of posts that provide a primer on some of the most important cyber engineering practices. In this post, we will focus on...

Cisco IOS SNMP Community string write privileges.

According to its configuration, the Cisco IOS on the remote device has a SNMP community string with write access. This could allow remote configuration of the device, including copying and overwriting the running-config. TRUSTED...

CVE-2018-6488

Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could be remotely exploited to allow Arbitrary Code Execution...

Wickr Inc - Zero Day Vulnerability Research Report P1

Document Title: =============== Wickr Inc - Zero Day Vulnerability Research Report P1 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1994 Document: https://www.vulnerability-lab.com/resources/documents/56129965121925.rar Key: 3986592835691561956295629856195 Videos:...

Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities

Document Title: =============== Wickr Inc Bug Bounty Program - Zero Day Vulnerabilities References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2055 Playlist: https://www.youtube.com/playlist?list=PL2hnNNM3yw-3svLm9UdSzvlVVZcx5DxV Videos:...

Wickr Inc - Zero Day Vulnerability Research Report P1

Document Title: =============== Wickr Inc - Zero Day Vulnerability Research Report P1 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1994 Document: https://www.vulnerability-lab.com/resources/documents/56129965121925.rar Key: 3986592835691561956295629856195 Videos:...

The vulnerability of the Smart Network Configuration Manager’s automatic network configuration management system, related to authentication mechanisms that lack sufficient protection, allows attackers to circumvent network firewall restrictions.

The vulnerability of the Smart Network Configuration Manager’s automatic network configuration management system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass network firewalls by using a Zebedee client that connects t...