New Attack Group Clasiopa Targets Materials Research Organization in Asia with Custom Malware

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary A new attack group called Clasiopa has been observed targeting materials research organizations in Asia using a distinct toolset that includes a custom malware called Backdoor.Atharvan. It is unclear wher...

CVE-2020-4339

CVE-2020-4339 is a stored cross-site scripting (XSS) vulnerability reported in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.3.0. It arises from insufficient input validation and missing output encoding, allowing a malicious user-supplied value written to the database/file to be d...

CVE-2019-4664

CVE-2019-4664 affects IBM Spectrum Scale (V5.0.0.0–V5.0.4.0). A local attacker could exploit a specially crafted request to execute arbitrary commands on the system. IBM provides a fix in V5.0.4.1 via Fix Central; no workarounds are listed. Affected product details and remediation are documented ...

CVE-2019-4756

This CVE-2019-4756 entry corresponds to a reflected cross-site scripting vulnerability in IBM InfoSphere Information Server and IBM InfoSphere QualityStage. Affected products and versions: IBM InfoSphere QualityStage (11.3, 11.5, 11.7) and IBM InfoSphere Information Server on Cloud (11.5, 11.7). ...

Design/Logic Flaw

Cerebrate 1.12 does not properly consider organisationid during creation of API keys...

CVE-2018-1966

IBM Security Identity Manager Virtual Appliance (VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1966, where error messages disclose sensitive information about the environment, users, or data. This is part of multiple vulnerabilities addressed in the IBM bulletin for ISIM VA, which also lis...

CVE-2018-1965

IBM Security Identity Manager Virtual Appliance (ISIM VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1965, which stems from weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The bulletin lists remediation via the fix 7.0.1-IS...

CVE-2018-1964

IBM Security Identity Manager Virtual Appliance versions 7.0.1 through 7.0.1.11 are affected by CVE-2018-1964, which could allow a remote attacker to hijack a victim’s click actions by persuading them to visit a malicious site. The issue is tied to an application behavior that enables hijacking v...

CVE-2019-4573

IBM Maximo Asset Management is affected by CVE-2019-4573, where an error message can disclose sensitive information about the environment, users, or related data. Affected versions include Maximo Asset Management core product 7.6 (and dependent Industry Solutions and Control Desk products when in...

CVE-2019-4491

CVE-2019-4491 is an IBM MQ vulnerability where an error in the tracing functionality can be exploited to cause a denial-of-service. Connected IBM MQ advisories specify affected products and versions: IBM WebSphere MQ 7.1 (7.1.0.0–7.1.0.9), MQ 7.5 (7.5.0.0–7.5.0.9), MQ v8 (8.0.0.0–8.0.0.12), MQ v9...

CVE-2019-4466

IBM Cloud Pak System V2.3.0 is affected by CVE-2019-4466 in IBM Platform System Manager, where a local user could obtain highly sensitive information stored in JavaScript files. Remediation: upgrade to V2.3.0.1 fixpak as outlined by IBM. There is no exploitation detail provided in the connected d...

CVE-2019-4432

IBM MQ (including IBM MQ Appliance) is vulnerable to a denial-of-service attack caused by specially crafted messages that can stop queue manager responsiveness and drive high CPU. Affected products and versions include IBM WebSphere MQ v7.1 (7.1.0.0–7.1.0.9), IBM WebSphere MQ v7.5 (7.5.0.0–7.5.0....

CVE-2019-4407

CVE-2019-4407 is a confirmed CSRF vulnerability affecting IBM InfoSphere Information Server (and InfoSphere on Cloud) as detailed in IBM’s Security Bulletin. Affected versions: InfoSphere Information Server 11.3, 11.5, 11.7 and InfoSphere Information Server on Cloud 11.5 and 11.7. The issue allow...

CVE-2023-24384

Cross-Site Request Forgery CSRF vulnerability in WpDevArt Organization chart = 1.4.4 versions...

CVE-2023-24384

Cross-Site Request Forgery CSRF vulnerability in WpDevArt Organization chart = 1.4.4 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WpDevArt Organization chart = 1.4.4 versions...

CVE-2023-24384

CVE-2023-24384 affects the WordPress plugin WpDevArt Organization chart (versions

CVE-2023-24384 WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WpDevArt Organization chart = 1.4.4 versions...

CVE-2023-26468

Cerebrate 1.12 does not properly consider organisationid during creation of API keys...

WordPress Plugin Organization chart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...