Security Bulletin: Apache ActiveMQ Client used in IBM Jazz for Service Management could allow a remote attacker to conduct a man-in-the-middle attack (CVE-2018-11775)

Summary Apache ActiveMQ Client used in IBM Jazz for Service Management could allow a remote attacker to conduct a man-in-the-middle attack CVE-2018-11775 Vulnerability Details CVEID: CVE-2018-11775 DESCRIPTION: Apache ActiveMQ Client could allow a remote attacker to conduct a man-in-the-middle...

Security Bulletin: Information disclosure vulnerability in WebSphere Application Server which is shipped with Jazz for Service Management (CVE-2019-4477)

Summary There is an information disclosure in WebSphere Application Server when using Security Auditing. Vulnerability Details CVEID: CVE-2019-4477 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information,...

Easy File Management Web Server 5.6 Unquoted Service Path

Exploit Title: Easy File Management Web Server v5.6 - 'Easy File Management Web Service' Unquoted Service Path Exploit Author: boku Date: 02/10/2020 Vendor Homepage: http://www.sharing-file.com/ Software Link: http://www.web-file-management.com/efmsetup.exe Version: 5.6 Tested On: Windows 10 32-b...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Design/Logic Flaw

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Security Bulletin: IBM Tivoli Common Reporting Security Updater: TCR, a part of IBM Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Cognos Business Intelligence. These issues were disclosed as part of the IBM Java SDK updates in October 2018, January 2019, April 2019, July 2019 and October 2019. IBM Cognos Business Intelligence...

Security Bulletin: Path traversal vulnerability in WebSphere Application Server Admin Console shipped with Jazz for Service Management (CVE-2019-4442)

Summary There is a path traversal vulnerability in the Admin Console of WebSphere Application Server shipped with Jazz for Service Management JazzSM Vulnerability Details CVEID: CVE-2019-4442 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to...

Moderate: Red Hat Security Advisory: Red Hat Process Automation Manager 7.6.0 Security Update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2020-2631

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Application Service Level Mgmt. Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via...

Security Bulletin: A vulnerability in IBM Jazz for Service Management affects IBM Performance Management products (CVE-2016-9975)

Summary IBM Jazz for Service Management is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Vulnerability Details CVEID: CVE-2016-9975 DESCRIPTION: IBM Jazz for Service Management ...

DEBIAN-CVE-2013-2625

An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified...

The vulnerability of SMF services and legacy daemons in the Oracle Solaris operating system allows a attacker to compromise the integrity of protected information or cause partial service interruptions.

The vulnerability of SMF services and legacy daemons in the Oracle Solaris operating system is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to compromise the integrity of protected information or cause partial service interruptions...

Important: Red Hat Security Advisory: Red Hat Process Automation Manager 7.5.0 Security Update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Unspecified Vulnerability in Oracle Solaris (CNVD-2019-38536)

Oracle Solaris is a Unix-like operating system. An unspecified vulnerability exists in the SMF services & legacy daemons component of Oracle Solaris 11. An attacker can exploit this vulnerability to unauthorized update, insert, or delete certain Oracle Solaris accessible data and cause a partial...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

Cross site scripting

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...

CVE-2019-4186

CVE-2019-4186 affects IBM Jazz for Service Management 1.1.3, via an HTTP header injection flaw caused by incorrect trust in the Host header during caching. A remote attacker could send a crafted HTTP GET to inject arbitrary headers, enabling attacks such as cross-site scripting, cache poisoning, ...

CVE-2019-4186

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow th...