PT-2018-14043

Name of the Vulnerable Software and Affected Versions IBM Security Key Lifecycle Manager version 3.0 Description The issue allows a security-critical resource to be read or modified by unintended actors due to improper permission specifications. Recommendations For IBM Security Key Lifecycle...

Security Bulletin: IBM Security Key Lifecycle Manager Uses Hard-coded Credentials (CVE-2018-1742)

Summary IBMSecurity Key Lifecycle Manager contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Vulnerability Details CVEID: CVE-2018-1742...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Hazardous Input Validation ( CVE-2018-1749)

Summary IBM Security Key Lifecycle Manager uses incomplete blocklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. Vulnerability Details CVEID: CVE-2018-1749 DESCRIPTION: IBM Tivoli Key Lifecycle Manager...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Information Exposure (CVE-2018-1743)

Summary IBM Security Key Lifecycle Manager discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. Vulnerability Details CVEID: CVE-2018-1743 DESCRIPTION: IBM Tivoli Key Lifecycle Manager discloses sensitive information to...

Security Bulletin: IBM Security Key Lifecycle Manager generates Application Error (CVE-2018-1753)

Summary IBM Security Key Lifecycle Manager generates an error message that includes sensitive information about its environment, users, or associated data. Vulnerability Details CVEID: CVE-2018-1753 DESCRIPTION: IBM Tivoli Key Lifecycle Manager generates an error message that includes sensitive...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Authentication (CVE-2018-1738)

Summary IBM Security Key Lifecycle Manager could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to improper authentication mechanisms. Vulnerability Details CVEID: CVE-2018-1738 DESCRIPTION: IBM Tivoli Key Lifecycle Manager could allow an...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Path Traversal (CVE-2018-1744)

Summary IBM Security Key Lifecycle Manager could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. Vulnerability Details CVEID: CVE-2018-1744 DESCRIPTION:...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Improper Control of Interaction Frequency (CVE-2018-1741)

Summary IBM Security Key Lifecycle Manager does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other consequences. Vulnerability Details CVEID: CVE-2018-1741 DESCRIPTION: IBM Tivoli Key Lifecycle Manager does...

Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection (XXE) attack (CVE-2018-1747)

Summary IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2018-1747 DESCRIPTION:...

PT-2018-16220

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 6.0.0-beta1 through 6.2.4 Description A disclosure flaw was found in the snapshot API. When the access key and security key parameters are set using the snapshot API, they can be exposed as plain text by users able to...

Google 'Titan Security Key' Is Now On Sale For $50

Google just made its Titan Security Key available on its store for $50. First announced last month at Google Cloud Next '18 convention, Titan Security Key is a tiny USB device—similar to Yubico's YubiKey—that offers hardware-based two-factor authentication 2FA for online accounts with the highest...

Google 'Titan Security Key' Is Now On Sale For $50

Google just made its Titan Security Key available on its store for $50. First announced last month at Google Cloud Next '18 convention, Titan Security Key is a tiny USB device—similar to Yubico's YubiKey—that offers hardware-based two-factor authentication 2FA for online accounts with the highest...

JioFi 4G M2S 1.0.2 - Denial of Service Exploit

Exploit for hardware platform in category dos / poc Exploit Title: JioFi 4G M2S 1.0.2 - Denial of Service PoC Exploit Author: Vikas Chaudhary Vendor Homepage: https://www.jio.com/ Hardware Link:...

JioFi 4G M2S 1.0.2 - Denial of Service (PoC)

JioFi 4G M2S 1.0.2 - Denial of Service PoC Exploit Title: JioFi 4G M2S 1.0.2 - Denial of Service PoC Exploit Author: Vikas Chaudhary Date: 2018-07-26 Vendor Homepage: https://www.jio.com/ Hardware Link:...

CVE-2018-15181

JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service secure configuration outage via an XSS payload in the SSID name and Security Key fields...

CVE-2018-15181

JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service secure configuration outage via an XSS payload in the SSID name and Security Key fields...

CVE-2018-15181: Improper Neutralization of Input During Web Page Generation

JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service secure configuration outage via an XSS payload in the SSID name and Security Key fields...

PT-2018-12928

Name of the Vulnerable Software and Affected Versions JioFi 4G Hotspot M2S affected versions not specified Description The issue allows attackers to cause a denial of service, specifically a secure configuration outage, by injecting an XSS payload into the SSID name and Security Key fields...

Security Bulletin: Multiple vulnerabilities in IBM® Db2® affects IBM Security Key Lifecycle Manager.

Summary There are multiple vulnerabiltities in the IBM® Db2® that is shipped with IBM Security Key Lifecycle Manager. These issues were disclosed as part of the IBM® Db2® updates published. These may affect some configurations of IBM Security Key Lifecycle Manager. Vulnerability Details Please...

Titan Security Keys – Google launches its own USB-based FIDO U2F Keys

At Google Cloud Next '18 convention in San Francisco, the company has introduced Titan Security Keys —a tiny USB device, similar to Yubico's YubiKey, that offers hardware-based two-factor authentication for your online accounts with the highest level of protection against phishing attacks. These...