Security Bulletin: Open Source Apache Tomcat Vulnerabilities (CVE-2016-6817, CVE-2016-8735, CVE-2016-6816)

Summary Issues with Apache Tomcat Vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2016-6817 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service. By sending a specially crafted HTTP/2 header, a remote attacker could exploit this vulnerability to cause the...

Security Bulletin: Plugins can be uploaded to IBM UrbanCode Deploy without Authentication (CVE-2017-1749)

Summary A directory traversal attack can be used to upload new versions of a plugin, altering UCD deployments. Vulnerability Details CVEID: CVE-2017-1749 DESCRIPTION: IBM UrbanCode Deploy could allow a remote attacker to traverse directories on the system. An unauthenticated attacker could alter...

Security Bulletin: IBM UrbanCode Deploy diagnostics files may contain confidential data (CVE-2017-1286)

Summary Previous releases of IBM UrbanCode Deploy diagnostics files can contain highly confidential data. This can include passwords and/or encrypted values. Vulnerability Details CVEID: CVE-2017-1286 DESCRIPTION: Sensitive information about the configuration of the UCD server and database can be...

Security Bulletin: Multiple Vulnerabilities in Apache Tomcat affects IBM UrbanCode Deploy (CVE-2017-5647, CVE-2017-5650)

Summary Previous releases of IBM UrbanCode Deploy are affected by multiple vulnerabilities in Apache Tomcat. Vulnerability Details CVE-ID: CVE-2017-5647 Description: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security...

Security Bulletin: Authenticated Users in IBM UrbanCode Deploy can Obtain Secure Properties (CVE-2017-1752)

Summary Previous releases of IBM UrbanCode Deploy allow authenticated users to view secure information.. Vulnerability Details CVEID: CVE-2017-1752 DESCRIPTION: IBM UrbanCode Deploy could allow an authenticated privileged user to obtain highly sensitive information. CVSS Base Score: 6.8 CVSS...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

Design/Logic Flaw

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

CVE-2018-18850

In Octopus Deploy, CVE-2018-18850 affects versions 2018.8.0 through 2018.9.x before 2018.9.1. An authenticated user with permission to modify deployment processes could upload a malicious YAML configuration, potentially allowing remote code execution within the Octopus Server process (often SYSTE...

PT-2018-14689

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions 2018.8.0 through 2018.9.0 Description The issue allows an authenticated user with permission to modify deployment processes to upload a maliciously crafted YAML configuration. This could potentially allow for remote...

CVE-2018-18850: Undefined Security Weakness

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server f...

Security Bulletin: Multiple Vulnerabilities in Apache Tomcat affects IBM UrbanCode Deploy (CVE-2018-1304, CVE-2018-1305)

Summary Previous releases of IBM UrbanCode Deploy are affected by multiple vulnerabilities in Apache Tomcat. Vulnerability Details CVE-ID: CVE-2018-1305 Description: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2018-17415)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

CVE-2016-0373

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

Code injection

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

CVE-2016-0373

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

CVE-2016-0373

IBM UrbanCode Deploy CVE-2016-0373 enables information disclosure via REST endpoints not properly authorizing readers. Affected versions are 6.0 through 6.2.2.1 (inclusive). The root cause is an authorization failure in UCD REST endpoints that allows an authenticated user to read sensitive data. ...

CVE-2016-0373

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119...

PT-2018-4623

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 6.0 through 6.2.2.1 Description The issue allows an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. Recommendations For...