CVE-2021-29780

IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due to improper input validation. IBM X-Force ID: 203085...

Security Bulletin: IBM Security SOAR could allow a privileged user to import non-approved Python2 modules (CVE-2021-29780).

Summary It was possible for a privileged user to import non-approved Python2 modules to create a malicious script. Vulnerability Details CVEID: CVE-2021-29780 DESCRIPTION: IBM Resilient OnPrem could allow an authenticated user to perform actions that they should not have access to due to improper...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities - Handlebars.js ( CVE-2019-19919, CVE-2021-32820)

Summary The product includes an older version of Handlebars.js that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2019-19919 DESCRIPTION: Node.js handlebars could allow a remote attacker to execute arbitrary code on the system, caused by a prototype...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities - Apache Commons ( CVE-2021-29425)

Summary The product includes an older version of Apache Commons that may be identified and exploited with a specially-crafted URL request. Vulnerability Details CVEID: CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities - Eclipse Jetty ( CVE-2021-28163, CVE-2021-28165, CVE-2020-27223)

Summary IBM Security SOAR includes an older version of Eclipse Jetty that may be identified and exploited. Vulnerability Details CVEID: CVE-2021-28163 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when the $jetty.base...

Kill Chains: Part 3→What’s Next

Life, the Universe, and Kill Chains As the final entry in this blog series, we want to quickly recap what we have previously discussed and also look into the possible future of kill chains. If you haven’t already done so, please make sure to read the previous 2 entries in this series: Kill chains...

Security Bulletin: IBM Resilient SOAR is vulnerable to command injection (CVE-2021-20527)

Summary It was possible for a privileged user to inject malicious commands that could be executed as another user. This issue has been addressed. Vulnerability Details CVEID: CVE-2021-20527 DESCRIPTION: IBM Resilient SOAR could allow a privileged user to create create malicious scripts that could...

CVE-2021-20567

IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 199239...

CVE-2021-20567

IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 199239...

CVE-2021-20566

IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 199238...

Design/Logic Flaw

IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 199238...

CVE-2021-20567

IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 199239...

CVE-2021-20567

IBM Resilient OnPrem (Resilient App Host components) is affected by CVE-2021-20567 where secrets are stored unencrypted by default, enabling a local privileged attacker to access sensitive information. The issue arises from improper or nonexisting encryption within the App Host, which can expose ...

CVE-2021-20566

CVE-2021-20566 concerns IBM Resilient OnPrem (IBM Security SOAR) where TLS1.2 ciphers not enabled for Perfect Forward Secrecy allow potential decryption of sensitive data if an attacker records traffic. The IBM security bulletin notes the vulnerability stems from weaker cryptographic algorithms; ...

CVE-2021-20566

IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 199238...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Java SE (CVE-2020-14781)

Summary IBM Resilient SOAR is Using Components with Known Vulnerabilities - Java SE CVE-2020-14781 Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Eclipse Jetty (CVE-2021-28163, CVE-2021-28164, CVE-2021-28165)

Summary IBM Resilient SOAR is Using Components with Known Vulnerabilities - Eclipse Jetty. Vulnerability Details CVEID: CVE-2021-28163 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when the $jetty.base directory or the...

Security Bulletin: Resilient App Host secrets are not encrypted (CVE-2021-20567)

Summary Resilient App Host is a Kubernetes-based container deployment environment that hosts Resilient app containers. By default, the secrets are not encrypted, and can be viewed in the clear by the "root" user. Vulnerability Details CVEID: CVE-2021-20567 DESCRIPTION: IBM Resilient OnPrem could...

CVE-2021-20567

IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 199239...

CVE-2021-20566

IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 199238...