CVE-2020-4617

IBM Data Risk Manager iDNA 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 184930...

CVE-2020-4616

IBM Data Risk Manager iDNA 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929...

CVE-2020-4614

CVE-2020-4614 affects IBM Data Risk Manager (iDNA) 2.0.6. The issue is weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. Remediation is to upgrade to v2.0.6.4 and then apply subsequent fixpacks (2.0.6.5, 2.0.6.6) in order, as detailed in ...

CVE-2020-4613

CVE-2020-4613 affects IBM Data Risk Manager (iDNA) 2.0.6, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. The issue is tracked under iDNA remediation pages and IBM X-Force entries. Mitigation and Fix: upgrade to DRM 2.0.6.4 firs...

CVE-2020-4614

IBM Data Risk Manager iDNA 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 184927...

CVE-2020-4612

IBM Data Risk Manager iDNA 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. IBM X-Force ID: 184924...

CVE-2020-4611

IBM Data Risk Manager iDNA 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922...

CVE-2020-4612

CVE-2020-4612 affects IBM Data Risk Manager (iDNA) 2.0.6. An authenticated user can obtain sensitive information via a specially crafted HTTP request. Connected documentation confirms the issue and prescribes a remediation path: upgrade to DRM 2.0.6.4 first, then apply fixpacks 2.0.6.5 and 2.0.6....

openstack-nova: Soft reboot after live-migration reverts instance to original source domain XML

An information disclosure flaw was found in the live migration feature of OpenStack Nova. A user may gain access to destination host devices with the same path as those on the source host. This flaw allows an attacker to perform a soft reboot of an instance that has previously undergone live...

The vulnerability of the vhost-crypto module in the libraries and drivers for fast packet processing in dpdk allows a hacker to gain access to confidential data.

The vulnerability of the vhost-crypto module in the libraries and drivers for fast packet processing in dpdk is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

SQL injection vulnerability in pr***.asp page of Shijiazhuang Baicheng Network Technology Co.

Shijiazhuang Baicheng Network Technology Co. Shijiazhuang Baicheng Network Technology Co., Ltd. building system pr.asp page SQL injection vulnerability exists. Attackers can use the vulnerability to obtain sensitive database information...

Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities

Summary IBM Data Risk Manager has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2019-10172 DESCRIPTION: Jackson-mapper-asl could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. By sending a...

Baxter Phoenix Hemodialysis Delivery System Information Disclosure Vulnerability

The Baxter Phoenix Hemodialysis Delivery System is a hemodialysis device from Baxter. An information disclosure vulnerability exists in the Baxter Phoenix Hemodialysis Delivery System SW version 3.36 and 3.40, which arises from an unsupported encryption of transmitted data during the transfer of...

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

A Prototype Pollution vulnerability was found in lodash. Calling certain methods with untrusted JSON could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

Security Bulletin: Vulnerabilities exist in IBM Data Risk Manager (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429, and CVE-2020-4430)

Summary Multiple vulnerabilities were reported to exist in IBM Data Risk Manager IDRM V2.0.1 and greater. Two issues were already fixed in V2.0.4.1, and the rest are fixed in V2.0.6.2 and later. Vulnerability Details CVEID: CVE-2020-4427 DESCRIPTION: IBM Data Risk Manager could allow a remote...

IBM Data Risk Manager Vulnerabilities

Problem IBM customers running IBM Data Risk Manager version 2.0.1 and greater are advised to upgrade to the latest version of the product. IBM has provided a fix for a number of reported issues. See the Security Bulletin referenced below for details. Symptom Multiple vulnerabilities were reported...

CVE-2020-4350

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178424...

UBUNTU-CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data mu...

IBM Data Risk Manager Authentication Bypass (CVE-2020-4429)

An authentication bypass vulnerability exists in IBM Data Risk Manager. The vulnerability is due to the presence of previously unknown default credentials. A remote attacker can exploit this vulnerability by authenticating to the system using the default credentials. Successful exploitation resul...

Zoho ManageEngine DataSecurity Plus DataEngine Xnode Server Application Path Traversal Vulnerability

Zoho ManageEngine DataSecurity Plus is a sensitive data management solution from Zoho USA. The product features data leakage prevention, data risk assessment and file server auditing. A path traversal vulnerability exists in the Zoho ManageEngine DataSecurity Plus DataEngine Xnode Server...