Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Spectrum Protect for Enterprise Resource Planning on Windows (CVE-2019-4732)

Summary Multiple vulnerabilities in IBM Java Runtime Environment were disclosed as part of the IBM Java SDK updates in January 2020. IBM Java Runtime Environment, used by IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning. has addressed the applicable CVE which...

Google Chrome Unauthorized Access

The vulnerability of Google Chrome lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML page...

Google Chrome Unauthorized Access

The vulnerability of Google Chrome lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to information through a specially created Chrome extension...

Firefox Service Data Unauthorized Access

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to information...

GNOME NetworkManager Information Disclosure

The vulnerability of the GNOME NetworkManage network connection management tool is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to information...

Principles of a Cloud Migration – Security, The W5H – Episode WHAT?

Teaching you to be a Natural Born Pillar! Last week, we took you through the “WHO” of securing a cloud migration here, detailing each of the roles involved with implementing a successful security practice during a cloud migration. Read: everyone. This week, I will be touching on the “WHAT” of...

Google Chrome Heap Buffer Overflow

The vulnerability of Google Chrome relates to the writing beyond the buffer of the memory buffer. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and compromise its integrity and availability through a specially created HTML file...

Dell EMC Integrated Data Protection Appliance Operating System Command Injection Vulnerability

Dell EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution from Dell, Inc.ACM is one of the application configuration management components. An operating system command injection vulnerability exists in the ACM component of the Dell EMC Integrated Data Protection...

Dell EMC Data Protection Central 1.0, 1.0.1, 18.1, 18.2, 19.1 Improper Certificate Chain of Trust (DSA-2019-135)

According to its self-reported version number, the version of Dell EMC Data Protection Central hosted on the remote web server is 1.0, 1.0.1, 18.1, 18.2 or 19.1. It is, therefore, affected by an improper certificate chain of trust vulnerability. An unauthenticated, remote attacker can exploit thi...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

Command injection

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0–2.4 contain a command injection vulnerability in the ACM component. A remote authenticated attacker with root privileges could pass crafted parameters to ACM APIs, enabling manipulation of passwords and execution of malicious comma...

CVE-2020-2821

The CVE-2020-2821 entry affects Oracle E-Business Suite, Trade Management (Budget) with affected versions 12.1.1–12.1.3 and 12.2.3–12.2.8. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management, with attacks requiring user interacti...

PT-2020-18421

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated Data Protection Appliance versions 2.0 through 2.4 Description The issue concerns a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in...

CVE-2020-5350: Improper Neutralization of Special Elements used in an OS Command

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability in the arch/powerpc/kernel/process.c component of the Linux operating system’s kernel PowerPC microprocessor architecture is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to compromise the confidentiality and accessibility o...

Google Chrome CORS Unauthorized Access

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information through a specially created HTML pa...

Rsyslog Buffer Overflow DoS

The vulnerability of the Rsyslog log-processing software utility is related to buffer overflow errors. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...