Security Bulletin: Multiple vulnerabilities in Jetty affect Netcool Agile Service Manager (CVE-2019-10247, CVE-2019-10246)

Summary There are multiple vulnerabilities in Eclipse Jetty used by Netcool Agile Service Manager. Netcool Agile Service Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-10247 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information,...

@devsisters/passport (>=1.1.0, <=1.1.2), @project-sunbird/ext-framework-server (8.0.0) +4 more potentially affected by CVE-2019-10157 via keycloak-connect (>=4.0.0-beta.1, <=4.5.0)

keycloak-connect NPM version =4.0.0-beta.1, =1.1.0, =0.0.2, =0.0.1, =0.0.1-alpha-1, =1.2.7 Source cves: CVE-2019-10157 Source advisory: OSV:GHSA-68HW-VFH7-XVG8...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018

Summary There are multiple vulnerabilities in Node.js used by IBM® Cloud App Management V2018. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID: CVE-2018-12122 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper...

Security Bulletin: A vulnerability in IBM Cloud App Management V2018 could allow an attacker to obtain sensitive configuration information

Summary There is a vulnerability in IBM® Cloud App Management V2018. IBM Cloud App Management V2018 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM® Cloud App Management has addressed the applicable CVE in a later version...

Security Bulletin: A vulnerability in Apache Commons Compress may affect IBM Cloud App Management V2018

Summary There is a vulnerability in Apache Commons Compress used by IBM® Cloud App Management V2018. IBM® Cloud App Management has addressed the applicable CVE in a later version. Vulnerability Details CVEID: CVE-2018-11771 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service...

A week in security (April 22 – 28)

Last week on Labs, we looked at security threats to headphones, privacy options in the world of law, and wandered through the FBI’s 2018 IC3 online crime report. We also explored another MageCart attack, and we released our 2019 Q1 Crime Tactics and Techniques report. Other cybersecurity news...

Security Bulletin: IBM Event Streams is affected by OpenSSL vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the OpenSSL versions shipped. Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature...

Security Bulletin: IBM Event Streams is affected by cURL vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the shipped cURL libraries. Vulnerability Details CVEID: CVE-2018-16890 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information. The function handling incoming NTLM type-2 messages fails to...

Security Bulletin: IBM Event Streams is affected by gettext vulnerability CVE-2018-18751

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-18751 DESCRIPTION: GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the defaultaddmessage function in read-catalog.c. By persuading a victim to open a...

Security Bulletin: IBM Event Streams is affected by Node.js vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime shipped. Vulnerability Details CVEID: CVE-2018-12122 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper validation of HTTP headers. By sending headers very slowly...

Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2018-1902

Summary IBM Event Streams has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. CVSS Base...

Envoy Passport Information Disclosure Vulnerability (CNVD-2019-08355)

Envoy Passport is a visitor management application. An information disclosure vulnerability exists in Envoy Passport versions 2.2.5 iPhone and 2.4.0 Android. A local attacker can exploit this vulnerability to gain access to sensitive information...

Envoy Passport Information Disclosure Vulnerability

Envoy Passport is a visitor management application. An information disclosure vulnerability exists in Envoy Passport versions 2.2.5 iPhone and 2.4.0 Android. A local attacker can exploit this vulnerability to gain access to sensitive information...

CVE-2018-17499

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...

CVE-2018-17499

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...

CVE-2018-17500

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

CVE-2018-17500

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

Hardcoded credentials

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information...

Information disclosure

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...

CVE-2018-17499

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information...