Fixed in Apache Tomcat 7.0.99

Low: Session fixation CVE-2019-17563 When using FORM authentication there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a securit...

GitLab Doles Out Half a Million Bucks to White Hats

GitLab has awarded a total of $565,650 in security bug bounties to 171 researchers who reported valid vulnerabilities in the past year — and has announced the winners of its latest hacking contest. GitLab, which started out as a web-based Git repository manager before moving into the DevOps...

Red Hat 3scale Cross-Site Scripting Vulnerability

Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A cross-site scripting vulnerability exists in Red Hat 3scale, which stems from a user session cookie that fails to set HTTPOnly, and can be exploited by an attacker to conduct cross-sit...

Improve cyber supply chain risk management with Microsoft Azure

For years, Microsoft has tracked threat actors exploiting federal cyber supply chain vulnerabilities. Supply chain attacks target software developers, systems integrators, and technology companies. Tactics often include obtaining source code, build processes, or update mechanisms to compromise...

Multiple Dell Products DSA-2019-164 Multiple Security Vulnerabilities

Description Multiple Dell products are prone to the following vulnerabilities: 1. A cross-site scripting vulnerability 2. An authentication-bypass vulnerability 3. A session fixation vulnerability An attacker may leverage these issues to execute arbitrary script code in the browser of the victim...

Fixed in Apache Tomcat 9.0.29

Moderate: Local Privilege Escalation CVE-2019-12418 When Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and...

Fixed in Apache Tomcat 8.5.49

Note: The issue below was fixed in Apache Tomcat 8.0.48 but the release vote for the 8.0.48 release candidate did not pass. Therefore, although users must download 8.0.49 to obtain a version that includes the fix for this issue, version 8.0.48 is not included in the list of affected versions...

ThreatList: Admin Rights for Third Parties is the Norm

Organizations are continuing to fall down on the job when it comes to addressing cybersecurity risk around third parties; in fact, 61 percent of respondents in a recent survey said they’re unsure if partners, contractors, suppliers and others are accessing or attempting to access unauthorized dat...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CNVD-2020-00295)

Cisco Prime Infrastructure Software is the United States Cisco Cisco company's set of basic network lifecycle management solutions. The product integrates Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS. A cross-site scripting vulnerability exists in the web-bas...

PT-2019-5229

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.0.M1 through 9.0.28 Apache Tomcat versions 8.5.0 through 8.5.47 Apache Tomcat version 7.0.0 Apache Tomcat version 7.0.97 Description The issue is related to the JMX Remote Lifecycle Listener in Apache Tomcat, which c...

Notice of Status Change Announcement for Version 12.1 of the Citrix ADM

Citrix Systems, Inc. announces an update to End of Maintenance and End of Life dates for version 12.1 of the Citrix Application Delivery Management formerly referred to as NetScaler Management & Analytics System Citrix Application Delivery Management ADM product lifecycle model will change from 3...

Security Bulletin: Path traversal vulnerability affect WebSphere Application Server Admin Console shipped with with IBM Security Key Lifecycle Manager (CVE-2019-4442)

Summary IBM WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...

CloudBees Jenkins Bumblebee HP ALM Plugin Trust Management Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/testing project and some timed tasks . Bumblebee HP ALM Plugin is used in one ...

bumblebee unconditionally disabled SSL/TLS certificate validation

bumblebee unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. bumblebee no longer does that. Instead, it now allows users to opt out of certificate validation...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2019-4268)

Summary IBM WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2019-4270)

Summary IBM WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...

Exploit for Improper Privilege Management in Cloudcti Hip_Integrator_Recognition_Configuration_Tool

Author: Arn Vollebregt Introduction Creativity is at the c...

IBM Security Key Lifecycle Manager Cross-Site Scripting Vulnerability

IBM Security Key Lifecycle Manager Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A cross-site scripting vulnerability exists in IBM...

IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2019-34598)

IBM Security Key Lifecycle Manager Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. An information disclosure vulnerability exists in IBM...

Service workers at TPAC

Last month we had a service worker meeting at the W3C TPAC conference in Fukuoka. For the first time in a few years, we focused on potential new features and behaviours. Here's a summary: Resurrection finally killed reg.unregister; If you unregister a service worker registration, it's removed fro...