Design/Logic Flaw

On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support EoTS ar...

Design/Logic Flaw

On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online Certificate Status Protocol OCSP verification of a certificate that contains Authority Information Access AIA, undisclosed requests may cau...

MCS Unable to add machines to catalog Failed to create a computer account,due to an unknown error

You may be unable to add machines to catalog, receiving error "Failed to create a computer account , due to an unknown error." after 9 machines are added Error details: etting error. Transaction ID: Action Name: MCAddMachineInitialzation An error occurred. Contact Citrix Technical Support, and...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to SQL injection

Summary A SQL injection vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2021-29730 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the...

Security Bulletin: A cross-site scripting vulnerability in JQuery affects IBM InfoSphere Information Server

Summary A cross-site scripting vulnerability in JQuery used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could explo...

Security Bulletin: IBM InfoSphere Information Analyzer is vulnerable to cross-site scripting.

Summary A cross-site scripting vulnerability in IBM InfoSphere Information Analyzer was addressed. Vulnerability Details CVEID: CVE-2021-29712 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to a denial of service vulnerability in Angular.js

Summary A denial of service vulnerability in Angular.js used by IBM InfoSphere Information Analyzer was addressed. Vulnerability Details CVEID: CVE-2016-4055 DESCRIPTION: The Node.js moment module is vulnerable to a denial of service, caused by an error in the regular expression implementation. A...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Commons IO

Summary A vulnerability in Apache Commons IO that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the...

SNMP – Simply Not My Problem. Or is it?

TL;DR: Use SNMPv3; long gone is default community strings, hello complex passwords! Remove from the internet, if required, implement a VPN solution to restrict access to only authorised parties. SNMP is a protocol used for the remote management of devices on a network. By remote, we mean access...

Design/Logic Flaw

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

The DarkSide Ransomware Gang

The New York Times has a long story on the DarkSide ransomware gang. A glimpse into DarkSides secret communications in the months leading up to the Colonial Pipeline attack reveals a criminal operation on the rise, pulling in millions of dollars in ransom payments each month. DarkSide offers what...

Design/Logic Flaw

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when the BIG-IP ASM/Advanced WAF system processes WebSocket requests with JSON payloads using the default JSON Content Profile in the ASM Security Policy, the BIG-...

CVE-2021-23009

On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Data Plane traffic. TMM takes the configured HA action when the TMM process is aborted. There is no control plane exposure, this is a data...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Commons Codec

Summary A vulnerability in Apache Commons Codec that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details Third Party Entry: 177835 DESCRIPTION: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of...

XenApp UNIX Error : Latency Issue with Published Application or Desktops from XenApp for UNIX through Citrix Receiver

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. While using Citrix Receiver 3.x to access published application from Citrix XenApp for UNIX, users...

Failed to publish image with platform layer if offload Compositing feature is enabled.

When offload Compositing feature is enabled, you may failed to publish image, which contains a platform layer. ELM log shows the following error: "An unexpected error occurred; export the log files and notify Technical Support that this error occurred."...

Citrix ShareFile storage zones controller security update

Description of Problem A security issue has been identified in the Citrix ShareFile storage zones controller which, if exploited, would allow an unauthenticated attacker to remotely compromise the storage zones controller. The issue has been given the following identifier: CVE-ID | Description |...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Dojo Toolkit

Summary Multiple vulnerabilities in Dojo Toolkit used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or...

Check Point Identity Agent Arbitrary File Write

Advisory: Privileged File Write Description =========== The Check Point Identity Agent allows low privileged users to write files to protected locations of the file system. Details ======= Advisory ID: usd-2021-0005 Product: Check Point Identity Agent Affected Version: R81.018.0000 Vulnerability...

Check Point Identity Agent Arbitrary File Write Vulnerability

Check Point Identity Agent Arbitrary File Write Vulnerability Description =========== The Check Point Identity Agent allows low privileged users to write files to protected locations of the file system. Details ======= Advisory ID: usd-2021-0005 Product: Check Point Identity Agent Affected Versio...