Security Bulletin: API Connect V5 is impacted by vulnerabilities in Bootstrap (CVE-2018-14040 CVE-2018-14041 CVE-2018-14042)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-14042 DESCRIPTION: Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the the data-container property of tooltip. A remote attacker could...

CVE-2019-3709

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

CVE-2019-3709

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

CVE-2019-3708

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

CVE-2019-3708

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

Cross site scripting

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

CVE-2019-3709 Cross-Site Scripting Vulnerability while registering vCenter servers

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

CVE-2019-3708 Cross-Site Scripting Vulnerability in OVA file upload feature

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user...

CVE-2019-3709

CVE-2019-3709 : IsilonSD Management Server 1.1.0 contains a cross-site scripting (XSS) vulnerability during the registration of vCenter servers. A remote attacker could entice an admin user to execute malicious HTML or JavaScript in the admin user’s context. The connected documents confirm the af...

CVE-2019-3708

The CVE-2019-3708 entry concerns Dell EMC IsilonSD Management Server version 1.1.0. A cross-site scripting (XSS) vulnerability exists when uploading an OVA file, which could allow a remote attacker to trick an admin user into executing malicious HTML or JavaScript in the admin’s browser session. ...

The vulnerability of the Certificate Management Server component in the Network Security Services library allows a perpetrator to trigger a service failure.

The vulnerability of the Certificate Management Server CMS component in the NSS library set is related to pointer assignment errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Security Bulletin: API Connect V5 is impacted by weak cryptographic algorithms (CVE-2018-2007)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-2007 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Score: 5.9 CVSS Temporal...

Security Bulletin: API Connect V2018 is impacted by weak cryptographic algorithms (CVE-2018-2007)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-2007 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Score: 5.9 CVSS Temporal...

CVE-2018-1932

IBM API Connect 5.0.0.0–5.0.8.4 is affected by a vulnerability in the role‑based access control of the management server that could allow an authenticated user to obtain highly sensitive information. The CVSS 3.0 vector is CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N with a base score of 4.9 (MED...

Design/Logic Flaw

IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175...

CVE-2018-1932

IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175...

CVE-2018-1932

IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

IBM API Connect Information Disclosure Vulnerability (CNVD-2019-00559)

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. An information disclosure vulnerability exists in the role-based access control feature of the...

Nuuo Central Management Server Authenticated SQL Server SQLi

Nuuo Central Management Server v3.3 and prior are vulnerable to an authenticated SQL injection vulnerability. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details Details from module documentation in Metasploit. The GETOPENALARM verb is used to obtain information about alar...

Nuuo Central Management Server Authenticated Arbitrary File Download

Nuuo Central Management Server allows authenticated users to download files. A directory traversal flaw in the FileType header allows the user to specify a file outside of the intended directories to download. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details Details fro...