Design/Logic Flaw

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

PYSEC-2020-101

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

CVE-2020-5252 Malicious package may avoid detection in python auditing

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

CVE-2020-5252

CVE-2020-5252 concerns the command-line Python package Safety. Reports describe a low-severity issue where two Python-related characteristics permit a malicious package to poison-pill or obfuscate other packages, allowing bypass of Safety’s detection routines. This is said to occur when Safety ru...

Security Bulletin: IBM Content Navigator includes the host IP address in an HTTP response.

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4309 DESCRIPTION: IBM Content Navigator could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. CVSS Base score:...

Adobe Reader DC (Continuous) Security Update (APSB20-13) - Mac OS X

Adobe Reader DC is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Adobe Acrobat DC (Continuous) Security Update (APSB20-13) - Windows

Adobe Acrobat DC Continuous Track is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Adobe Acrobat DC (Continuous) Security Update (APSB20-13) - Mac OS X

Adobe Acrobat DC Continuous Track is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Data corruption due to unreliable SMB (CIFS) shares

Challenge Storages that use the SMB CIFS protocol without the continuous availability and write-through features can cause data corruption in case of technical outages. This can lead to restore or backup problems. Cause If shares operate without the continuous availability feature in the...

Quality is Job One When it Comes to the HITRUST CSF Assurance Program

The HITRUST CSF® remains an essential security and privacy controls framework that addresses the multitude of security, privacy, and regulatory challenges facing both public and private sector organizations. As framework adoption increases across all industries, maintaining integrity is crucial,...

Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-4663)

Summary IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability Vulnerability Details CVEID: CVE-2019-4663 DESCRIPTION: IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - lodash (CVE-2019-10744)

Summary A Security Vulnerability affects IBM Cloud Private - lodash Vulnerability Details CVEID: CVE-2019-10744 DESCRIPTION: Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of...

CloudBees Jenkins Cross-Site Request Forgery Vulnerability (CNVD-2020-10430)

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Amazon EC2 Plugin is used in which an EC2 connection agen...

Adobe Acrobat DC (Continuous) Security Update (APSB20-05) - Mac OS X

Adobe Acrobat DC Continuous Track is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Security Bulletin: IBM MQ Appliance is affected by OpenSSL vulnerabilities (CVE-2018-0734 and CVE-2019-1559)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerabilities. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then OpenSSL can respond...

Input validation

A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service DoS condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability is due to...

Security Bulletin: IBM Content Navigator discloses operating system information in logon response.

Summary IBM Content Navigator includes information about the host operating system in the response after the user successfully authenticates. Vulnerability Details CVEID: CVE-2019-4679 DESCRIPTION: IBM Content Navigator could allow an authenticated user to gain information about the hosting...

Security Bulletin: IBM MQ Appliance is affected by an unauthorised access vulnerability (CVE-2019-4621)

Summary IBM MQ Appliance has addressed the following unauthorised access vulnerability. Vulnerability Details CVEID: CVE-2019-4621 DESCRIPTION: IBM DataPower Appliance and IBM MQ Appliance have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker...

Security Bulletin: IBM MQ Appliance could allow a local attacker to bypass security restrictions (CVE-2019-4620)

Summary IBM MQ Appliance has addressed the following security restrictions bypass vulnerability. Vulnerability Details CVEID: CVE-2019-4620 DESCRIPTION: IBM MQ Appliance could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. CVSS Base...

A Practical Guide to Zero-Trust Security

Employees are demanding that employers enable flexible workstyles. Apps are moving to the cloud. A company’s device and application mix are increasingly heterogeneous. All of these factors are breaking down the enterprise security perimeter, rendering traditional security approaches obsolete, and...