Security Bulletin: Vulnerabilities in IBM SPSS Collaboration and Deployment Services (CVE-2013-5370 & CVE-2013-4042)

Abstract Vulnerabilities have been identified in IBM SPSS Collaboration and Deployment Services which make the product vulnerable to remote code execution. Content VULNERABILITY DETAILS: CVEID:CVE-2013-4042 DESCRIPTION: All users of Collaboration and Deployment Services are vulnerable. CVSS Base...

Security Bulletin: IBM Tivoli Monitoring clients affected by vulnerabilities in IBM JRE excuted under a security manager.

Abstract These vulnerabilities are only applicable to Java deployments where untrusted code may be executed under a security manager e.g. Java applets running in a web browser. Content DESCRIPTION: There are a number of vulnerabilities in the IBM JAVA SDK that affect various components ORB, XML a...

Security Bulletin: Vulnerability in IBM SPSS Data Collection due to issues in Eclipse Help System (CVE-2013-0464, CVE-2013-0467)

Abstract The version of IBM Eclipse Help System that is shipped with IBM SPSS Data Collection versions 6.0, 6.0.1 "Data Collection" and 7.0 has multiple security vulnerabilities. These vulnerabilities allow attackers to perform cross-site scripting and source code disclosure attacks. Content...

Security Bulletin: IBM WebSphere Extended Deployment Compute Grid Vulnerability (CVE-2013-4039)

Abstract Potential security vulnerability fixed in IBM WebSphere Extended Deployment Compute Grid V8.0.0.3 Content VULNERABILITY DETAILS: CVE ID:CVE-2013-4039PM84760 DESCRIPTION: WebSphere Extended Deployment Compute Grid could allow a remote attacker to obtain sensitive information and exploit...

Malwarebytes recognized as endpoint security leader by G2

G2 has released their Fall 2022 reports, ranking Malwarebytes as the leader across a number of endpoint protection categories. Based on factual customer reviews, Malwarebytes has been ranked 1 over top EDR vendors for endpoint malware and antivirus protection, detection and remediation of web-bas...

Security Bulletin: An Unspecified Vulnerability in Java runtime affects Predictive Maintenance and Quality and Predictive Maintenance Insights (CVE-2021-35603)

Summary IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises is bundled with IBM SPSS, IBM Cognos, IBM DB2 and IBM Websphere Application Server Liberty. Some of the component products are vulnerable to unspecified vulnerability in Java runtime CVE-2021-35603. Thi...

HashiCorp Vault vulnerable to incorrect metadata access

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checkin...

VariableSupplyERC20Token cannot be deployed due to wrong access control

Lines of code Vulnerability details Impact VariableSupplyERC20Token contract cannot be deployed resulting in not functioning contract. Proof of Concept mint function is called in the constructor of VariableSupplyERC20Token contract. constructorstring memory name, string memory symbol, uint256...

Unified Remote Authentication Bypass / Code Execution Exploit

This Metasploit module utilizes the Unified Remote remote control protocol to type out and deploy a payload. The remote control protocol can be configured to have no passwords, a group password, or individual user accounts. If the web page is accessible, the access control is set to no password f...

parse-server auth adapter app ID validation can be circumvented

Impact Validation of the authentication adapter app ID for Facebook and Spotify may be circumvented. This fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for Facebook or Spotify and where the server-side...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.33 packages and security update

Red Hat OpenShift Container Platform release 4.10.33 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

Rapid7 Metasploit 安全漏洞

Rapid7 Metasploit is a suite of penetration testing software from the US-based Rapid7. A security vulnerability exists in Metasploit version 3.11.0.248350, which originates from a module that utilizes the Unified Remote Telecontrol Protocol to enter and deploy payloads.The telecontrol protocol ca...

Remote Control Collection RCE

This module utilizes the Remote Control Server's, part of the Remote Control Collection by Steppschuh, protocol to deploy a payload and run it from the server. This module will only deploy a payload if the server is set without a password default. Tested against 3.1.1.12, current at the time of...

Mobile Mouse RCE

This module utilizes the Mobile Mouse Server by RPA Technologies, Inc protocol to deploy a payload and run it from the server. This module will only deploy a payload if the server is set without a password default. Tested against 3.6.0.4, current at the time of module writing Module Options msf u...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 8

Package name: xms10.14.0.10813.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10742.bin, xms10.14.0.10628.bin, xms10.14.0.10521.bin, xms10.14.0.10424.bin, xms10.14.0.10303.bin, xms10.14.0.10206.bin, and xms10.14.0.10118.bin. Date: September 2022 Languages...

rewarding is not started after StakingRewards contract deployment and there is no specific time set for contract start time of rewarding, users stacked their funds has no way knowing when is rewarding is going to be started

Lines of code Vulnerability details Impact after StakingRewards the constructor logic set value for rewardRate and rewardsDuration but rewarding is not started for stackers and users has no way to find out when is rewarding going to be started. only reward Distributer can start rewarding process...

GHSA-X996-7QH9-7FF7 Hyperledger indy-node vulnerable to denial of service

Impact An attacker can max out the number of client connections allowed by the ledger that was deployed using guidance provided in the indy-node repository, leaving the ledger unable to be used for its intended purpose. The ledger content will not be impacted by the attack, and the ledger will...

Hyperledger indy-node vulnerable to denial of service

Impact An attacker can max out the number of client connections allowed by the ledger that was deployed using guidance provided in the indy-node repository, leaving the ledger unable to be used for its intended purpose. The ledger content will not be impacted by the attack, and the ledger will...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products Java CPU October 2021

Summary WebSphere Application Server traditional is shipped as a component of IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Enterprise Service Bus. WebSphere Application Server Liberty profile is shipped as a component of IBM Business Automation Workflow and IBM...

GHSA-FMQ7-GH8V-MJVC WildFly vulnerable to Insecure Default Initialization of Resource

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain...