CVE-2018-1999032

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

CVE-2018-1999032

The CVE-2018-1999032 entry involves Jenkins' Agiletestware Pangolin Connector for TestRail Plugin (version 2.1 and earlier). The vulnerability resides in GlobalConfig.java and can be triggered by an attacker with Overall/Read permission via crafted HTTP requests to an unprotected endpoint to over...

CVE-2018-1999032

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint...

Fixed in Apache Tomcat Native Connector 1.2.17

Moderate: Mishandled OCSP invalid response CVE-2018-8019 When using an OCSP responder Tomcat Native did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates...

Sending FireEye HX data to Splunk

FireEye HX is an agent-based Endpoint Protection solution. Something like an antivirus, but focused on Advanced Persistent Threats APT. It has an appliance with GUI where you can manage the agents and see information about detected security incidents. As with any agent-based solution, it's...

How to change the timeouts for the vSphere Connector

Sometimes a customer's environment is much slower than we planned for. We saw a scenario where disk moves and copies were taking several hours while still completing successfully. The vSphere connector was timing out much earlier, though. The ability to configure the timeouts is in 4.3 and all...

CloudBees Jenkins z/OS Connector Plugin Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed tasks . z/OS Connector Plugin is used in one of the plug-in to support the z/OS...

Design/Logic Flaw

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

CVE-2018-1000608

The CVE-2018-1000608 affects Jenkins z/OS Connector Plugin (versions up to 1.2.6.1). The vulnerability resides in SCLMSCM.java where passwords could be exposed, allowing an attacker with local file-system access or a compromised Jenkins admin browser (e.g., malicious extension) to retrieve the co...

CVE-2018-1000608

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured password...

Fixed in Apache Tomcat 8.5.32

Important: Information Disclosure CVE-2018-8037 If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Workload Scheduler (CVE-2016-5983)

Summary IBM WebSphere Application Server is shipped as a component of Tivoli Workload Scheduler. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin for...

Security Bulletin: A security vulnerability has been identified in MySQL shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - January 2016)

Summary MySQL Client/Connector and Server are shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published. Vulnerability Details Please consult the Oracle Critical Patch Update Advisory - January 2016 for...

Security Bulletin: A security vulnerability has been identified in MySQL shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - October 2015)

Summary MySQL Server is shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published in a security bulletin Vulnerability Details Please consult the security bulletin for vulnerability details and information abo...

Security Bulletin:A security vulnerability has been identified in MySQL Server shipped with Tivoli Network Manager IP Edition (Oracle Critical Patch Update Advisory - July 2015)

Summary MySQL Server is shipped as a component of Tivoli Network Manager IP Edition. Information about a security vulnerability affecting MySQL Server has been published in a security bulletin Vulnerability Details Please consult the security bulletin...

Security Bulletin: Information Server Connector Migration Tool allows a user with limited role to create/modify/replace some jobs (CVE-2015-0180)

Summary A user with limited role may be able to create/modify/delete specific types of jobs. Vulnerability Details CVEID: CVE-2015-0180 DESCRIPTION: IBM Information Server Connector Migration Tool could allow a user with limited role to create/modify/delete specific types of jobs that they do not...

Security Bulletin: IBM InfoSphere Metadata Asset Manager is subject to a denial of service vulnerability from its use of Apache Tomcat (CVE-2014-0095)

Summary Apache Tomcat is vulnerable to a denial of service caused by the improper handling of an AJP request. A remote attacker could exploit this vulnerability to consume a request processing thread and cause a denial of service. Vulnerability Details CVE ID: CVE-2014-0095 CVSS: CVSS Base Score:...

Security Bulletin: Apache Tomcat vulnerability affects IBM Algo One - Counterparty Credit Risk (CVE-2016-8745)

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by the improper handling of the send file code for the NIO HTTP connector when the Connector code for Tomcat is refactored. An attacker could exploit this vulnerability to obtain the session ID and the...