CVE-2018-10934

A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...

Veeam Availability Console 3.0 RESTful API backward compatibility

Challenge This article describes improved Veeam Availability Console v3 RESTful API functionality that may retrieve different data compared to previous versions. Cause /Jobs: LastRun or EndTime now returns 00:00:00.0000000 UTC, January 1, 0001 if the value is not populated in UI /HardwarePlans:...

CVE-2018-10934

CVE-2018-10934 is an XSS in the JBoss Management Console that affects JBoss EAP/JBoss AS versions prior to 7.1.6.CR1 and 7.1.6.GA, enabling attackers with object-creation privileges to target other privileged users. The linked Red Hat advisories indicate remediation via upgrading to 7.1.6.x (CR1/...

openSUSE Security Update : qemu (openSUSE-2019-1005)

This update for qemu fixes the following issues : Security issue fixed : - CVE-2018-16847: Fixed an out of bounds r/w buffer access in cmb operations bsc1114529. Non-security issue fixed : - Fixed serial console issue that triggered a qemu-kvm bug bsc1108474. This update was imported from the...

CVE-2019-8997

An XML External Entity Injection XXE vulnerability in the Management System console of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XM...

CVE-2019-9868

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator...

CVE-2019-9867

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator...

CVE-2019-9867

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator...

CVE-2019-9868

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator...

Design/Logic Flaw

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator...

Default credentials

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator...

CVE-2018-1836

IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2019-9868

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator...

CVE-2019-9867

An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator...

CVE-2019-9867

The CVE-2019-9867 issue affects Veritas NetBackup Appliance Web Console up to version 3.1.2, where the proxy server password is disclosed to an administrator. The available records do not specify the root cause details, vulnerable component version beyond the Web Console, or explicit exploitation...

CVE-2018-1836

CVE-2018-1836 affects IBM MQ Console (IBM WebSphere MQ) for CD: 9.0.2–9.0.5 and LTS: 9.1.0.0–9.1.0.1. The IBM bulletin attributes the issue to inadequate input validation in a Web UI form, enabling cross-site scripting that could permit an attacker to inject arbitrary JavaScript and potentially d...

HackerOne: Moving a report to a different program doesn't reassign the Custom Field Values

When a report is moved to a different program, all associated objects are either removed or copied to the new program. During an internal security review of the Custom Fields feature it was observed that this isn't the case for Custom Field Values. This means that even after a report has moved, t...

CVE-2019-3711

RSA Authentication Manager versions prior to 8.4 P1 have an insecure credential management vulnerability in the Operations Console that may allow an authenticated administrator to obtain the value of a domain password previously set by another administrator and use it for attacks. Root cause: ins...

Design/Logic Flaw

RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks...

CVE-2019-3711

RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks...