CVE-2024-39725

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2024-39727 IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser...

CVE-2024-39727 IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser...

CVE-2024-39727

CVE-2024-39727 affects IBM Engineering Lifecycle Optimization components. The IBM bulletin describes that IBM Engineering Insights 7.0.2 and 7.0.3 use a web link with untrusted references to an external site, enabling a remote attacker to expose sensitive information or perform unauthorized actio...

CVE-2024-39725 IBM Engineering Lifecycle Optimization - Engineering Insights information disclosure

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2024-39725

CVE-2024-39725 affects IBM Engineering Lifecycle Optimization – Engineering Insights (DOORS Next family): versions 7.0.2 and 7.0.3 are susceptible to information exposure via detailed error messages returned in the browser, enabling a remote attacker to view sensitive data. The IBM bulletin also ...

CVE-2024-39725: Generation of Error Message Containing Sensitive Information

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2024-39727: Use of Web Link to Untrusted Target with window.opener Access

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser...

PT-2024-28653 · Ibm · Ibm Engineering Lifecycle Optimization - Engineering Insights

Name of the Vulnerable Software and Affected Versions: IBM Engineering Lifecycle Optimization - Engineering Insights versions 7.0.2 through 7.0.3 Description: The issue concerns the use of a web link with untrusted references to an external site, which could allow a remote attacker to expose...

IBM Engineering Lifecycle Optimization security vulnerabilities

IBM Engineering Lifecycle Optimization - Engineering Insights ENI is a collaborative, Web-based application from IBM. An information disclosure vulnerability exists in IBM Engineering Lifecycle Optimization - Engineering Insights. The vulnerability is due to the fact that the affected version cou...

IBM Engineering Lifecycle Optimization security vulnerabilities

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from International Business Machines IBM. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that...

Qualys Performance Tuning Series: Remove Stale Compliance Data for the Best Performance

In our first post in the Performance Tuning Series, we talked about removing stale assets to improve performance. In this installment, we will address the benefits of removing data once it becomes stale. Why does data become stale? The IT environment of any enterprise is very dynamic, and more so...

SUSE-SU-2024:4300-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency bsc1233856 Other fixes: - Updated to 20.18.1: Experimental Network Inspection Support in Node.js Exposes X509VFLAGPARTIALCHAIN to tls.createSecureContext New...

Intel Neural Compressor Privilege Escalation

The vulnerability of the Intel Neural Compressor library for optimizing machine learning models is related to the lack of measures taken to neutralize special elements in the template creation mechanism. Exploiting this vulnerability can allow a remote attacker to enhance their privileges...

PT-2024-36892

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A vulnerability in the Linux kernel has been resolved, specifically related to the LoongArch architecture and PREEMPT RT kernels. The issue arises from the replacement of normal spinlocks with ...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

Summary IBM Engineering Lifecycle Optimization - Engineering Insights ENI is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. In XML parsers, when XML...

CVE-2024-39726: Improper Restriction of XML External Entity Reference

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

IBM Engineering Lifecycle Optimization code issues and vulnerabilities

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from International Business Machines IBM. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that...

PT-2024-28652

Name of the Vulnerable Software and Affected Versions IBM Engineering Lifecycle Optimization - Engineering Insights versions 7.0.2 through 7.0.3 Description The issue allows a remote attacker to exploit an XML External Entity Injection XXE attack when processing XML data, potentially exposing...

python3.12 security update

3.12.5-2 - Security fix for CVE-2024-8088 Resolves: RHEL-55963 3.12.5-1 - Update to 3.12.5 - Security fix for CVE-2024-6923 Resolves: RHEL-53041 3.12.4-3 - Properly propagate the optimization flags to C extensions 3.12.4-2 - Build Python with -O3 -...