CVE-2015-5045

The Administration and Reporting tool in IBM Rational License Key Server RLKS before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via unspecified vectors. IBM X-Force ID: 106938...

New Relic: [NR Infrastructure] Bypass of #200576 through GraphQL query abuse - allows restricted user access to root account license key

@jonbottarini discovered an issue with our GraphQL implementation. This allowed a user without the proper authorization access to privileged account information on the same account. The writeup for this issue can read here: https://labs.detectify.com/2018/03/14/graphql-abuse/...

CVE-2017-9813

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

New Relic: Logic flaw enables restricted account to access account license key

Hello - this is a resubmission of my report 197071 that was sent to the public NewRelic program. You have a serious logic flaw which results in a restricted account being able to view the account license key. This is able to be performed by logging into a restricted account, clicking on the...

Overview of Windows activation with KMS server

Sometimes after properly following the preparation steps, on start up the Operating System shows only 3 days remaining to be activated, or Office prompts users to activate now, or similar. This doesn’t necessarily indicate an issue with PVS image preparation, or with the streamed image. It’s up t...

New Relic: Leaking license key in source code

Restricted role user has no way to view the license key, but the license key is leaking in the source code. Steps to reproduce Assume userA is owner, userB is restricted user. Login as userB and go to https://rpm.newrelic.com/accounts/accid/applications/setup Select any Web agent, view page sourc...

IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.7 XSS

The remote host is running a version of IBM Rational License Key Server Administration and Reporting Tool RLKS that is 8.1.4.x prior to 8.1.4.7. It is, therefore, affected by a cross-site scripting vulnerability that allows an attacker to steal cookies and impersonate a valid user. %NASLMINLEVEL...

IBM Rational License Key Server Administration and Reporting Tool Information Disclosure Vulnerability

IBM Rational License Key Server Administration and Reporting Tool is a license administration and reporting tool. A security vulnerability in IBM Rational License Key Server Administration and Reporting Tool allows remote attackers to exploit the vulnerability to obtain cookie-based authenticatio...

IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.4 Multiple Vulnerabilities

The remote host is running a version 8.1.4.x of IBM Rational License Key Server Administration and Reporting Tool RLKS that is prior to 8.1.4.4. It is, therefore, affected by multiple vulnerabilities : - The secure flag for session cookies is not properly set when in SSL mode. An attacker can...

IBM Rational License Key Server Administration and Reporting Tool Detection

Binary data ibmrlksadministrationreportingtool.nbin...

IBM Rational License Key Server Administration and Reporting Tool Default Credentials

Nessus was able to login to the remote web interface for the IBM Rational License Key Server Administration and Reporting Tool using a default set of known credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2014-4756

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...

CVE-2014-3079

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to bypass authorization checks and visit unspecified URLs with license-usage data via a DESCRIBE clause in a SPARQL query...

CVE-2014-0909

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Session fixation

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Code injection

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors...

CVE-2014-4756

The IBM RLKS Administration and Reporting Tool (RLKS) in versions 8.1.4.x prior to 8.1.4.4 is affected by CVE-2014-4756, allowing remote authenticated users to hijack sessions via unspecified vectors. The issue is documented with a Low risk score (CVSS v2 base 3.5) and is fixed in Rational Licens...

Release Information for Veeam Backup & Replication 7 Patch 4

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge Veeam Backup & Replication Patch 4 Release Notes Cause Please confirm you are running version 7.0.0.690, 7.0.0.715, 7.0.0.764, 7.0.0.771, 7.0.0.833, 7.0.0.83...

Amtelco miSecureMessages未授权访问漏洞

Bugtraq ID:66795 CVE ID:CVE-2014-0357 Amtelco miSecureMessages是一个可用于多个移动设备上的对消息进行加密的应用。 Amtelco miSecureMessages对用户消息访问缺少正确的验证，攻击者可在XML请求中提供contactID和合法许可证键值，就可以访问任意用户消息。 0 Amtelco miSecureMessages 目前没有详细解决方案： https://misecuremessages.com/...

Amtelco miSecureMessages未授权访问漏洞

Bugtraq ID:66795 CVE ID:CVE-2014-0357 Amtelco miSecureMessages是一个可用于多个移动设备上的对消息进行加密的应用。 Amtelco miSecureMessages对用户消息访问缺少正确的验证，攻击者可在XML请求中提供contactID和合法许可证键值，就可以访问任意用户消息。 0 Amtelco miSecureMessages 目前没有详细解决方案： https://misecuremessages.com/...