Security Bulletin: Aspera Web Applications (Faspex, Console) and On Demand products are affected by OpenSSL Vulnerability (CVE-2017-7468)

Summary Aspera Web Applications Faspex, Console and On Demand products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID:CVE-2017-7468 DESCRIPTION: No CVE description. CVSS Base Score: 3.1 CVSS Temporal Score: See Not Applicable for the current score CVSS Environment...

CVE-2019-10199

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

CVE-2019-3639

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header...

CVE-2019-10199

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

Design/Logic Flaw

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

Design/Logic Flaw

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header...

CVE-2019-3639 MWG UI: Cross-Frame Scripting vulnerability

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header...

CVE-2019-10199

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

CVE-2019-10199

CVE-2019-10199 affects Keycloak up to version 6.0.1. The account console did not perform adequate header checks in some requests, enabling an attacker to trigger operations by crafting requests from an untrusted domain and persuading an authenticated user to perform actions. Red Hat advisories li...

CVE-2019-0346

Unencrypted communication error in SAP Business Objects Business Intelligence Platform Central Management Console, version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0335

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...

Server side request forgery (ssrf)

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0346

The CVE-2019-0346 entry concerns SAP Business Objects Business Intelligence Platform (Central Management Console) v4.2, where an unencrypted communication error can disclose the list of user names and roles imported from SAP NetWeaver BI systems. The affected component is the Central Management C...

CVE-2019-0345

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

CVE-2019-0335

SAP BusinessObjects BI Platform Central Management Console (versions 4.1–4.3) is affected by a stored XSS in the user description field. An attacker can store a payload in a user’s description that executes when the mouse hovers over the description in the UI’s info popup. The available documents...

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

Intel® RAID Web Console 2 Advisory

Summary: Intel has identified a potential vulnerability in the Intel® RAID Web Console 2 RWC2. Intel has issued a Product Discontinuation notice for RWC2. Intel recommends that users uninstall Intel® RWC2, then install RAID Web Console 3 RWC3. Vulnerability Details: CVEID: CVE-2019-0173...

HPE 3PAR StoreServ Management Console Authorization Bypass Vulnerability (CNVD-2019-28115)

The HPE 3PAR StoreServ Management Console SSMC is the HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A remote authorization bypass vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker...

HPE 3PAR StoreServ Management Console Information Disclosure Vulnerability

The HPE 3PAR StoreServ Management Console SSMC is the HPE 3PAR management and reporting console that provides converged file and block management on HPE 3PAR StoreServ storage systems. A remote information disclosure vulnerability exists in HPE 3PAR StoreServ Management Console 3.5.0. An attacker...