CVE-2019-4383

Summary of CVE-2019-4383 : IBM Spectrum Protect Plus versions 10.1.0–10.1.3 are affected. A redirected restore operation when protecting Oracle or MongoDB databases may escalate the privileges of the user performing the restore. The IBM security bulletin notes a fix path in 10.1.4 (Linux) and rel...

CVE-2019-4357

IBM Spectrum Protect Plus vulnerable in 10.1.0–10.1.3 when protecting Oracle/DB2/MongoDB: a redirected restore operation with a target path may allow arbitrary code execution on the host. Affected components are the restore workflow and its path handling; user privileges required are HIGH with lo...

CVE-2019-4357: Undefined Security Weakness

When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,...

CVE-2019-4383: Undefined Security Weakness

When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalation of user privileges. IBM X-Force ID: 162165...

PT-2019-17051 · Ibm +2 · Ibm Spectrum Protect Plus +2

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Plus versions 10.1.0 through 10.1.3 Description: The issue concerns an escalation of user privileges that may occur during a redirected restore operation when protecting Oracle or MongoDB databases. Recommendations: For...

MongoDB Leak Exposed Millions of Medical Insurance Records

An online database belonging to insurance marketing website MedicareSupplement.com was found exposing more than 5 million records with personal information. MedicareSupplement.com is a U.S.-based marketing site that allows users to find supplemental medical insurance available in their area...

Security Bulletin: Privilege escalation and code injection vulnerabilities in IBM Spectrum Protect Plus application protection (CVE-2019-4383, CVE-2019-4357)

Summary IBM Spectrum Protect Plus application protection could allow a local attacker to gain elevated privileges or execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2019-4383 DESCRIPTION: When using Spectrum Protect Plus to protect Oracle or MongoDB databases, a redirected...

Qualys Cloud Platform (VM, PC) 8.20 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...

MongoDB Offers Field Level Encryption

MongoDB now has the ability to encrypt data by field: MongoDB calls the new feature Field Level Encryption. It works kind of like end-to-end encrypted messaging, which scrambles data as it moves across the internet, revealing it only to the sender and the recipient. In such a "client-side"...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

A Plan to Stop Breaches With Dead Simple Database Encryption

Database giant MongoDB has a new encryption scheme that should help slow the scourge of breaches...

RedwoodHQ 2.5.5 - Authentication Bypass Vulnerability

Exploit for multiple platform in category web applications -- encoding: utf-8 -- !/usr/bin/python3 Exploit Title: RedxploitHQ Create Admin User by missing authentication on db Date: 14-june-2019 Exploit Author: EthicalHCOP Version: 2.0 / 2.5.5 Vendor Homepage: https://redwoodhq.com/ Software Link...

RedwoodHQ 2.5.5 - Authentication Bypass

RedwoodHQ 2.5.5 - Authentication Bypass -- encoding: utf-8 -- !/usr/bin/python3 Exploit Title: RedxploitHQ Create Admin User by missing authentication on db Date: 14-june-2019 Exploit Author: EthicalHCOP Version: 2.0 / 2.5.5 Vendor Homepage: https://redwoodhq.com/ Software Link:...

RedwoodHQ 2.5.5 - Authentication Bypass

-- encoding: utf-8 -- !/usr/bin/python3 Exploit Title: RedxploitHQ Create Admin User by missing authentication on db Date: 14-june-2019 Exploit Author: EthicalHCOP Version: 2.0 / 2.5.5 Vendor Homepage: https://redwoodhq.com/ Software Link: https://redwoodhq.com/redwood-download/ Tested on: Ubuntu...

RedwoodHQ 2.5.5 Authentication Bypass

-- encoding: utf-8 -- !/usr/bin/python3 Exploit Title: RedxploitHQ Create Admin User by missing authentication on db Date: 14-june-2019 Exploit Author: EthicalHCOP Version: 2.0 / 2.5.5 Vendor Homepage: https://redwoodhq.com/ Software Link: https://redwoodhq.com/redwood-download/ Tested on: Ubuntu...

GHSA-M734-R4G6-34F9 NoSQL Injection in loopback-connector-mongodb

Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the special $where...

NoSQL Injection in loopback-connector-mongodb

Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the special $where...

@colmena/api (0.1.0), agneta-platform (>=0.13.0-beta.1, <=0.13.0-beta.9) +1 more potentially affected by unknown CVE via loopback-connector-mongodb (>=3.1.0, <=3.2.1)

loopback-connector-mongodb NPM version =3.1.0, =0.13.0-beta.1, =0.13.0-beta.9 - scheduler-service-api 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-M734-R4G6-34F9...

Moderate: Red Hat Enhancement Advisory: RHUI 3.1 bug fix and enhancement update

Updated RHUI 3 packages that fix several bugs and various enhancements are now available. Red Hat Update Infrastructure RHUI is a highly scalable, highly redundant framework that enables you to manage repositories and content. It also enables cloud providers to deliver content and updates to Red...