Security Bulletin: IBM Sterling Partner Engagement Manager has several issues with secrets management (CVE-2025-33093)

Summary IBM Sterling Partner Engagement Manager's JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret. This issue has been addressed in the latest Helm Chart. Vulnerability Details CVEID:CVE-2025-33093 DESCRIPTION: IBM Sterling Partner Engagement Manager's JWT secr...

IBM Sterling Partner Engagement Manager 安全漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from International Business Machines IBM. IBM Sterling Partner Engagement Manager suffers from an improper key storage vulnerability that stems from improper JWT key storage. An attacker could exploit the vulnerability to cau...

PT-2025-20069

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.0 through 6.2.2 Description The issue concerns the storage of the JWT secret in public Helm Charts, rather than as a Kubernetes secret. This affects IBM Sterling Partner Engagement Manager...

Race Condition

Overview @genkit-ai/core is a Genkit AI framework core libraries. Affected versions of this package are vulnerable to Race Condition via the asynchronous user engagement collection in the appendSpan and collectUserEngagement methods, where calls were not correctly awaited. Improper handling of...

Race Condition

Overview @genkit-ai/firebase is a Genkit AI framework plugin for Firebase including Firestore trace/state store and deployment helpers for Cloud Functions for Firebase. Affected versions of this package are vulnerable to Race Condition via the asynchronous user engagement collection in the...

Three Takeaways from the Gartner® Report: How to Grow Vulnerability Management Into Exposure Management

Security leaders today face a harsh reality: traditional vulnerability management isn’t enough. Threat actors are evolving, attack surfaces are expanding, and organizations need a more proactive approach to stay ahead of risk. Latest research from Gartner, How to Grow Vulnerability Management Int...

Generative AI in Financial Institution: a Global Survey of Opportunities, Threats, and Regulation

Generative Artificial Intelligence GenAI is rapidly reshaping the global financial landscape, offering unprecedented opportunities to enhance customer engagement, automate complex workflows, and extract actionable insights from vast financial data. This survey provides an overview of GenAI adopti...

A Sustainability Program with Regional Nuance

...

CVE-2025-29063

creationtimestamp| type| source ---|---|--- 2025-04-02 23:01:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lluiku77ef2x 2025-04-03 01:01:38+00:00| seen| https://t.me/cvedetector/21929 2025-04-03 17:48:24+00:00| seen|...

Enhancing Customer Engagement with Outsourced Telemarketing

In the competitive world where artificial intelligence AI has made it easy to use technology, companies are constantly…...

Security Bulletin: IBM Partner Engagement Manager is vulnerable to sensitive data exposure (CVE-2022-34354)

Summary IBM Sterling Partner Engagement Manager has addressed a client HTML5 vulnerability that allows encrypted storage of client data to be stored locally which can be read by another user on the system. Vulnerability Details CVEID:CVE-2022-34354 DESCRIPTION: IBM Sterling Partner Engagement...

Security Bulletin: IBM Partner Engagement Manager vulnerable to authentication bypass (CVE-2022-34334)

Summary IBM Sterling Partner Engagement Manager has addressed an authentication bypass vulnerability. Vulnerability Details CVEID:CVE-2022-34334 DESCRIPTION: IBM Sterling Partner Engagement Manager does not invalidate session after logout which could allow an authenticated user to impersonate...

Security Bulletin: XML External Entity Injection (XXE) attack Affects IBM Partner Engagement Manager (CVE-2022-34348)

Summary IBM Sterling Partner Engagement Manager is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID:CVE-2022-34348...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to Slowloris HTTP DOS attack (CVE-2022-35639)

Summary IBM Sterling Partner Engagement Manager is vulnerable to Slowloris attack is a type of denial-of-service DoS attack which targets threaded web servers. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-35639 DESCRIPTION: IBM Sterling Partner Engagement Manager do not limi...

Reddit will start warning users that upvote violent content

In a post on r/RedditSafety by a Reddit administrator, the platform announced that it will start sending warnings to users that upvote violent content. Reddit is a social media platform and online forum where users can share and discuss content across a wide range of topics. The platform's...

Linux Distros Unpatched Vulnerability : CVE-2024-5497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote attacker who convinced a user to engage in specific UI...

CVE-2025-1068

creationtimestamp| type| source ---|---|--- 2025-02-25 17:15:09+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114065651086000181 2025-02-25 17:23:24+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5337 2025-02-25 19:03:22+00:00| seen| https://t.me/cvedetector/18888 2025-02-25...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at Boskone 62 in Boston, Massachusetts, USA, which runs from February 14-16, 2025. My talk is at 4:00 PM ET on the 15th. I’m speaking at the Rossfest Symposium in Cambridge, UK, on March 25, 2025. The list is maintaine...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-21628

Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of queryoperator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by addi...