CVE-2019-3763

CVE-2019-3763 affects RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.0 P08. The issue is an information exposure where an Office 365 user password can be logged in plain text in the Office 365 connector debug log file. An authenticated local attac...

CVE-2019-3761

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-site scripting vulnerability in the Access Request module. A remote authenticated malicious user could potentially exploit this vulnerability to store malicio...

CVE-2019-3759

CVE-2019-3759 affects RSA Identity Governance and Lifecycle / Aveksa prior to 7.1.0 P08. A code injection vulnerability allows a remote authenticated user to run Groovy scripts in the Workflow system, potentially gaining limited access to view or modify information. Public writeups describe remot...

On Cybersecurity Insurance

Good paper on cybersecurity insurance: both the history and the promise for the future. From the conclusion: Policy makers have long held high hopes for cyber insurance as a tool for improving security. Unfortunately, the available evidence so far should give policymakers pause. Cyber insurance...

BlockDev Sp. Z o.o: Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`

Summary: The flap contract provides the ability to auction DAI for MKR. That's a fundamental functionality of the MCD system, invoked usually from the vow contract. A flaw in the validation of calls to flap.kick, however, allows a malicious user to create "fake' auctions that can be later used to...

IBM Identity Governance and Intelligence SQL Injection (CVE-2018-1756)

An SQL injection vulnerability exists in IBM Identity Governance and Intelligence. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system...

IBM InfoSphere Information Governance Dashboard and InfoSphere Information Server on Cloud Information Disclosure Vulnerability

IBM InfoSphere Information Server on Cloud and IBM InfoSphere Information Server are both products of IBM Corporation, U.S.A. IBM InfoSphere Information Server on Cloud is a set of cloud-based data consolidation IBM InfoSphere Information Server is a data integration platform. IBM InfoSphere...

EyesOfNetwork 5.1 Remote Command Execution

Exploit Title: EyesOfNetwork 5.1 - Authenticated Remote Command Execution Google Dork: N/A Date: 2019-08-14 Exploit Author: Nassim Asrir Vendor Homepage: https://www.eyesofnetwork.com/ Software Link: https://www.eyesofnetwork.com/?pageid=48&lang=fr Version: 5.1 "; while$read = fread$handle,100 ec...

Making the case: How to get the board to invest in government cybersecurity

Security leaders are no longer simply expected to design and implement a security strategy for their organization. As a key member of the business—and one that often sits in the C-suite—CISOs and security managers must demonstrate business acumen. In fact, Gartner estimates by 2020, 100 percent o...

Facebook Agrees to Pay $5 Billion Fine and Setup New Privacy Program for 20 Years

The Federal Trade Commission FTC today officially confirmed that Facebook has agreed to pay a record-breaking $5 billion fine over privacy violations surrounding the Cambridge Analytica scandal. Besides the multibillion-dollar penalty, the company has also accepted a 20-year-long agreement that...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability (CVE-2018-5391)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. A vulnerability in the Linux kernel, included in IBM Security Identity Governance and Intelligence IGI, affects the way the Linux kernel handles reassembly of...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Identity Governance and Intelligence

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Security Identity Governance and Intelligence IGI. Vulnerability Details CVEID: CVE-2018-1890 DESCRIPTION: IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs whi...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability (CVE-2018-5407)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitive information. This vulnerability is known as PortSmash...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability (CVE-2019-4046)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. IBM WebSphere Application Server is vulnerable to a denial of service, caused by improper handling of request headers. Vulnerability Details CVEID: CVE-2019-4046...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability (CVE-2019-3863, CVE-2019-3857, CVE-2019-3856, CVE-2019-3855)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability concerns library libssh2 that is a library that implements the SSH2 protocol. Vulnerability Details CVEID: CVE-2019-3863 DESCRIPTION: libssh2 coul...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability (CVE-2015-6748)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. jsoup is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2015-6748 DESCRIPTION: jsoup is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. Vulnerability Details CVEID: CVE-2017-15708 DESCRIPTION: Apache Synapse could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in t...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities (CVE-2018-0732, CVE-2018-0739, CVE-2017-3735)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerabilities 3 issues for OpenSSL: 2 for a denial of service and 1 for an error while parsing an IPAdressFamily extension in an X.509 certificate. Vulnerability Details CVEID:...

Security Bulletin: Security vulnerability in IBM Java SDK affects IBM Security Identity Governance and Intelligence (CVE-2019-2684)

Summary There is one security vulnerability in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Security Identity Governance and Intelligence IGI. Vulnerability Details CVEID: CVE-2019-2684 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedde...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2017-1399)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to a security vulnerability. Use of a Broken or Risky Cryptographic Algorithm. Vulnerability Details CVEID: CVE-2017-1399 DESCRIPTION: IBM Security Identity Governance Virtual Appliance uses...