11339 matches found
Security Bulletin: Multiple vulnerabilities in IBM Java SDK (CVE-2015-0478, CVE-2015-0488, and CVE-2015-1916) and with Diffie-Hellman ciphers (CVE-2015-4000) may affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID)
Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by IBM Integration Designer IID and WebSphere Integration Developer WID. These issues were disclosed as part of the IBM Java SDK updates in April 2015. In addition, the LogJam Attack on TLS connections usin...
Security Bulletin: Missing authorization concept for document upload and download in IBM Business Process Manager (BPM) CMIS integration (CVE-2015-1904)
Summary IBM Business Process Manager offers integration with external Enterprise Content Management ECM systems. If a process app is configured to always connect to an external ECM system using a predefined technical system account rather than the actual end user, then the process app developer h...
Security Bulletin: Multiple security vulnerabilities have been identified in bundled products shipped with WebSphere Dynamic Process Edition (April 2015)
Summary WebSphere Business Modeler, WebSphere Integration Developer, WebSphere Business Services Fabric, WebSphere Process Server and WebSphere Business Monitor are shipped as components of WebSphere Dynamic Process Edition. Information about security vulnerabilities affecting these products have...
Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect server products in WebSphere Dynamic Process Edition (CVE-2015-4000)
Summary The LogJam Attack on Diffie-Hellman ciphers CVE-2015-4000 may affect some configurations of IBM WebSphere Application Server Full Profile that is shipped as a component of server products in WebSphere Dynamic Process Edition. The IBM HTTP Server used by WebSphere Application Server is not...
Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Integration Designer and WebSphere Integration Developer (CVE-2015-2808)
Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Integration Designer and WebSphere Integration Developer. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID)(CVE-2015-0138, CVE-2015-0410, CVE-2014-6593)
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 1.6 and 1.7 that is used by IBM Integration Designer IID and WebSphere Integration Developer WID. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses...
Security Bulletin: Vulnerability in SSLv3 affects IBM Integration Designer and WebSphere Integration Developer (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Integration Designer and WebSphere Integration Developer. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : IBM Integration Design...
Security Bulletin: Vulnerabilities in glibc affect ”WebSphere Message Broker v8 HVE” and “IBM Integration Bus V9 HVE” (CVE-2014-5119)
Summary A glibc vulnerability was disclosed in September 2014. This bulletin addresses this vulnerability that has been referred to as “glibc: off-by-one error leading to a heap-based buffer overflow flaw in gconvtranslitfind “. glibc is shipped with ”WebSphere Message Broker v8 HVE” and “IBM...
Security Bulletin: IBM Integration Bus Manufacturing pack is affected by Cross-site scripting
Summary IBM Integration Bus Manufacturing pack is vulnerable to cross-site scripting XSS Vulnerability Details CVE-ID: CVE-2014-4820 CVSS Base Score: 4.3 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/95457 for the current score CVSS Environmental Score: Undefined...
Extending Trend Micro’s Container Protection with Deep Security Smart Check
DevOps is not a single person or business unit, it is a development philosophy that exists within many organizations. DevOps teams build new applications for business growth, and extend critical monolithic applications into modern architectures. A key tenet of this philosophy uses microservices t...
AWS Invites Trend Micro to Give a Sneak Peek Of Our New Stuff
You can tell a lot by the company someone keeps. This is one of many reasons we are so proud to have been invited to present at an Amazon event today. Amazon is hosting an EKoS Day in San Francisco and will be highlighting their newly launched Amazon EKS offering. We are giving a sneak peek of th...
CVE-2011-4190
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...
CVE-2011-4190 Missing verification of host key for kdump server
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...
AutoSQLi - An Automatic SQL Injection Tool Which Takes Advantage Of Googler, Ddgr, WhatWaf And SQLMap
An Automatic SQL Injection Tool Which Takes Advantage Of DorkNet Googler, Ddgr, WhatWaf And Sqlmap. Features Save System - there is a complete save system, which can resume even when your pc crashed. - technology is cool Dorking - from the command line one dork : YES - from a file: NO - from an...
spring-data-commons: XXE with Spring Data’s XMLBeam integration
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict extern...
Cybersecurity Reference Architecture: Security for a Hybrid Enterprise
The Microsoft Cybersecurity Reference Architecture describes Microsofts cybersecurity capabilities and how they integrate with existing security architectures and capabilities. We recently updated this diagram and wanted to share a little bit about the changes and the document itself to help you...
Apple will let users run iOS apps on macOS
Apple is making it easier for mobile developers to port their iOS apps to the next-generation macOS Mojave desktop platform—a major step in bringing the two platforms closer together. However, at the same time, the company straightforward denied the idea of merging the iPhone and Mac operating...
Partner Perspectives: How TrapX & Carbon Black Use Deception Technology to Better Protect Your Enterprise
As organizations continue to move toward digital transformation, the digital workspace ecosystem of IoT devices, endpoints, and networks continues to grow and evolve. This new landscape creates many opportunities for potential attackers. Security becomes even more important for everyone in this n...
CVE-2018-10813
In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...