IBM Security Guardium 信息泄露漏洞

IBM Security Guardium is a comprehensive data protection solution that provides full data security capabilities from compliance support to dynamic data masking. an information disclosure vulnerability exists in IBM Security Guardium version 11.3. An attacker could exploit the vulnerability to...

IBM Sterling File Gateway 信息泄露漏洞

IBM Sterling File Gateway, an application for transferring files between internal and external partners, allows you to more securely and reliably transfer files with trading partners. IBM Sterling File Gateway version 2.2.0.0-6.1.0.3 is vulnerable to an information disclosure vulnerability. An...

CVE-2021-20377

IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195569...

CVE-2021-20508

IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199322...

CVE-2021-20508

IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199322...

keycloak: Brute force attack is possible even after the account lockout

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality...

OPENSUSE-SU-2021:1253-1 Security update for nextcloud

This update for nextcloud fixes the following issues: Update to 20.0.12 Fix boo1190291 - CVE-2021-32766 CWE-209: Generation of Error Message Containing Sensitive Information - CVE-2021-32800 CWE-306: Missing Authentication for Critical Function - CVE-2021-32801 CWE-532: Insertion of Sensitive...

Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Vault

Summary Multiple vulnerabilities identified in IBM Security Verify Privilege Vault previously known as IBM Security Secret Server have been addressed in the release 11.0. Vulnerability Details CVEID: CVE-2021-20569 DESCRIPTION: IBM Security Verify Privilege could allow an attacker to enumerate...

Citrix gateway plugin executes PowerShell script obfuscated code which might be blocked by Antivirus software

We might see errors somewhat like below in AntiVirus : Event type: Process action blocked Component: Adaptive Anomaly Control Rule name: PowerShell executes obfuscated code Source process: c:\windows\system32\windowspowershell\v1.0\powershell.exe Application : "C:\Program Files\Citrix\Secure Acce...

CVE-2021-32766

Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link sha...

Information disclosure

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB has a vulnerability where error messages were not sufficiently HTML-encoded, allowing an authenticated user to exploit a specially crafted URL to trigger remote code execution and information disclosure. The issue is documented across multiple advisories (CVE-2021-3694 and related CVEs)...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2017-16629

In SapphireIMS 40971, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For...

CVE-2017-16629

In SapphireIMS 40971, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For...

Authentication flaw

In SapphireIMS 40971, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For...

CVE-2017-16629

SapphireIMS 4097_1 is affected by a username-enumeration issue. The login form reveals different error messages for incorrect user vs. incorrect password, enabling an attacker to guess registered usernames. The CVE description specifies two messages: “The application failed to identify the user. ...

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...

MGASA-2021-0391 Updated fetchmail packages fix security vulnerability

Updated fetchmail packages fix security vulnerability: reportvbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf valist argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages...