Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterprise

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM Integration Bus & IBM App Connect Enterprise. These issues were disclosed as part of the IBM Java SDK updates in October 2021. Vulnerability Details CVEID: CVE-2021-35578 DESCRIPTION: An unspecified...

CVE-2022-0001

creationtimestamp| type| source ---|---|--- 2022-03-10 11:08:32+00:00| seen| https://t.me/sysodmins/14260 2022-03-11 07:04:29+00:00| published-proof-of-concept| https://t.me/SecLabNews/11732 2022-03-11 16:40:00+00:00| published-proof-of-concept| https://t.me/truesecator/2723 2022-06-16...

CVE-2021-42950

Remote Code Execution RCE vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional...

CVE-2021-42951

A Remote Code Execution RCE vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm...

The vulnerability of the CMS system October CMS, related to improper verification of the cryptographic signature, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the CMS system October CMS is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Information Disclosure

october/october is vulnerable to Information Disclosure. Remote unauthenticated attackers are able to exfiltrate user private keys via non-authoritative gateway servers because the library does not validate gateway server signatures...

Remote Code Execution (RCE)

October CMS is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library does not properly sanitize the user input before rendering, allowing an attacker who has access to the backend to manipulate web pages via cms.safemode or cms.enableSafeMode to execute arbitrary...

Authenticated remote code execution in October CMS

Impact An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. - This issue only affects admin panels that rely on safe mode and restricted permissions. - T...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Control and Tivoli Storage Productivity Center October 2015 CPU and January 2016 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ Technology Edition that is shipped and used by IBM Spectrum Control and Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in October...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2017-10356, CVE-2018-2579, CVE-2018-2588, CVE-2018-2602, CVE-2018-2603, CVE-2018-2633, CVE-2018-2618)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped and used by IBM Spectrum Control formerly Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates for October 2017 and January 2018. U UPDATED 5/17/2018 to a...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in October 2021. Vulnerability...

Security Bulletin: Security vulnerability in IBM® Java SDK October 2021 CPU has been identified in Jazz Team Server shipped with Jazz Reporting Service

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about a security vulnerability in IBM® SDK Java Technology Edition from October 2021 CPU that is affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerabilit...

October CMS Authentication Bypass (CVE-2021-32648)

An authentication bypass vulnerability exists in October CMS. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

CVE-2021-46150

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October...

CVE-2022-21719

GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds...

Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure

The coordinated cyberattacks targeting Ukrainian government websites and the deployment of a data-wiper malware called WhisperGate on select government systems are part of a broader wave of malicious activities aimed at sabotaging critical infrastructure in the country. The Secret Service of...

October CMS Improper Authentication

In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request...

VulnCheck KEV: CVE-2021-32648

In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request...

Ukraine government entities targeted by a destructive malware “Whispergate”

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. A malware attack was carried out on Ukraine government, non-profit, and IT entities with a wiper disguised as ransomware. The threat actor, DEV-0586 targeted government bodies that provide critical executive branch or emergen...

Remote Code Execution (RCE)

October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the input via the theme import function allowing an attacker with access to the backend to execute maliciously crafted PHP code...