EUVD-2017-10458

Malware in sbrugna...

Security Bulletin: IBM Emptoris Services Procurement is affected by Information leakage vulnerability (CVE-2017-1547)

Summary The IBM Emptoris Services Procurement product is vulnerable to getting valid usernames through Forgot password process Vulnerability Details CVEID: CVE-2017-1547 DESCRIPTION: IBM Emptoris Services Procurement could allow an unauthorized user enumerate usernames through the use of the forg...

Security Bulletin:Multiple vulnerabilities in the IBM Emptoris Services Procurement product

Summary The security bulletin includes multiple vulnerabilities found and addressed in the IBM Emptoris Services Procurement product. Vulnerability Details CVEID: CVE-2017-1440 DESCRIPTION: IBM Emptoris Services Procurement could allow a remote attacker to include arbitrary files. A remote attack...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Emptoris Strategic Supply Management and IBM Emptoris Services Procurement products.

Summary The IBM Emptoris Strategic Supply Management Suite and IBM Emptoris Services Procurement products are affected by multiple security vulnerabilities that exist in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. The security bulletin includes issue...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM WebSphere Application Server affect IBM Emptoris Strategic Supply Management, and IBM Emptoris Services Procurement (CVE-2015-7575, CVE-2016-0466, CVE-2015-7417)

Summary The IBM Emptoris Strategic Supply Management Suite and IBM Emptoris Services Procurement products are affected by multiple security vulnerabilities that exist in IBM SDK Java Technology Edition and IBM WebSphere Application Server. The security bulletin includes issues disclosed as part o...

CVE-2017-1442

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107...

CVE-2017-1443: Improper Neutralization of Input During Web Page Generation

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 12810...

CVE-2017-1440: Improper Control of Generation of Code

IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM...

PT-2017-13464

Name of the Vulnerable Software and Affected Versions IBM Emptoris Services Procurement version 10.0.0.5 Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions from a user that the...

PT-2017-13443

Name of the Vulnerable Software and Affected Versions IBM Emptoris Services Procurement version 10.0.0.5 Description The issue allows a remote attacker to include arbitrary files by sending a specially-crafted URL, potentially leading to the execution of arbitrary code on the vulnerable web serve...

CVE-2017-1442: Cross-Site Request Forgery (CSRF)

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107...

PT-2017-13453

Name of the Vulnerable Software and Affected Versions IBM Emptoris Services Procurement version 10.0.0.5 Description The issue is related to improper access control, which could allow a local user to view sensitive information stored locally. Recommendations For IBM Emptoris Services Procurement...

CVE-2017-1441: Undefined Security Weakness

IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access control. IBM X-Force ID: 128106...

PT-2017-13473

Name of the Vulnerable Software and Affected Versions IBM Emptoris Services Procurement version 10.0.0.5 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...