Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere eXtreme Scale: CVE-2015-0138, CVE-2014-6593, CVE-2015-0410, CVE-2015-0383

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition. These vulnerabilities affect WebSphere eXtreme Scale version 7.1.0, 7.1.1, 8.5, and 8.6. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses t...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM MQ Light (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM WebSphere Application Server Liberty Profile Version 8.5.5 that is used by IBM MQ Light. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM SSL/TLS...

Security Bulletin: Multiple vulnerabilities in IBM SDK Java™ Technology Edition affect IBM Business Process Manager and WebSphere Lombardi Edition

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by WebSphere Application Server underneath IBM Business Process Manager and WebSphere Lombardi Edition. These issues were disclosed as part of the IBM SDK Java™ Technology Edition updates in January 2015...

Security Bulletin: Current release of IBM® WebSphere Real Time is affected by CVE-2015-0138

Summary "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An I...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Light (CVE-2014-6593, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7R1 Service Refresh 2 and earlier releases that is used by IBM MQLight. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK...

Security Bulletin: Vulnerability with RSA Export Keys may affect IBM WebSphere Application Server (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability CVE-2015-0138 may affect some configurations of IBM WebSphere Application Server Full Profile, IBM WebSphere Application Server Liberty Profile, and IBM WebSphere Application Server Hypervisor Edition...

Security Bulletin: SSL/TLS side channel timing vulnerability on WebSphere DataPower (CVE-2014-0852)

Summary DataPower appliances might be subject to side channel timing based attacks. Vulnerability Details CVE ID: CVE-2014-0852 DESCRIPTION: DataPower appliances might be subject to side channel timing based attacks resulting in the decryption of an SSL/TLS secured transaction. The attack can onl...

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by OpenSSL vulnerabilities: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID:CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and...

Security Bulletin: Security vulnerability in current IBM SDK for Java for WebSphere Application Server Community Edition 3.0.0.4 Jan 2014 CPU (CVE-2014-0411)

Summary Security vulnerability exists in the IBM SDK for Java that is shipped with IBM WebSphere Application Server Community Edition 3.0.0.4. Vulnerability Details CVE ID: CVE-2014-0411 DESCRIPTION: The vulnerability can be exploited over the 'SSL/TLS' protocol. This issue affects the 'JSSE'...

Security Bulletin: Potential Security vulnerability in IBM HTTP Server CVE-2013-6747

Summary Potential security exposure in IBM HTTP Server for WebSphere Application Server. Vulnerability Details CVE ID: CVE-2013-6747 DESCRIPTION: IBM HTTP Server may be vulnerable to a denial of service, caused by an error in the GSKit component. By initiating an SSL/TLS connection using a...

Security update for mariadb (moderate)

This update for mariadb to version 10.2.15 fixes the following issues: These security issues were fixed: - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library Return of BACKRONYM bsc1088681. - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent:...

The Digital Transformation Age Is Dawning: Do You Know Where Your Certificates Are?

How many digital certificates are in use in your organization? When do they expire? Do you have a way of discovering digital certificates from unapproved Certificate Authorities? Most organizations can't answer these questions with complete certainty, because they lack the necessary visibility an...

Gaining Control over Your Digital Certificates

Digital certificate management is in an inadequate state at most organizations, a serious problem, considering that SSL/TLS certificates are critical for a host of e-business functions. “If you’re doing something on the Internet, you’re using SSL,” Asif Karel, a Qualys Director of Product...

Sensitive File Disclosure (HTTP)

The script attempts to identify files containing sensitive data at the remote web server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2018-1000151

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default...

CVE-2018-1000151

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default...

Input validation

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default...

CVE-2018-1000151

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default...

CVE-2018-1000151

The CVE-2018-1000151 entry concerns Jenkins vSphere Plugin (versions 2.16 and older) where VSphere.java disables SSL/TLS certificate validation by default, creating a man‑in‑the‑middle risk. Connected documents corroborate the issue across multiple advisories (Red Hat, SUSE, GitHub GHSA, OSV, NVD...

Updated openssl packages fix security vulnerability

Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so...