CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

CVE-2020-27220: Missing Authorization

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

PYSEC-2021-876

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface...

CVE-2020-13922 Apache DolphinScheduler (incubating) Permission vulnerability

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface...

Stripe: GRAPHQL cross-tenant IDOR giving write access thought the operation UpdateAtlasApplicationPerson

@bubbounty discovered an Insecure Direct Object Reference IDOR vulnerability that allowed someone with prior Admin access to a Stripe account to add a co-founder to a Stripe Atlas application belonging to the merchant account they used to administer. The issue has been addressed by only allowing...

Uber: Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees

A Business employee with the user role was able to escalate their privilege to admin using a crafted request to the https://business.uber.com/rpc?rpc=updateEmployees endpoint, as long as the employeeUuid is known...

CentOS: Security Advisory for fence-agents-aliyun (CESA-2020:5003)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

IBM QRadar SIEM Information Disclosure Vulnerability (CNVD-2020-61017)

IBM QRadar is an enterprise security information and event management SIEM product that detects anomalies, finds advanced threats, and eliminates false positives. An information disclosure vulnerability exists in IBM QRadar SIEM 7.3 and 7.4 when using a multi-tenant configuration. Detailed...

CVE-2018-1725

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

CVE-2018-1725

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

Information disclosure

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

CVE-2018-1725

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

CVE-2018-1725

IBM QRadar SIEM in a multi-tenant configuration is vulnerable to information disclosure (CVE-2018-1725). Affected products/versions: IBM QRadar SIEM 7.3.0–7.3.3 Patch 5 and 7.4.0–7.4.1 Patch 1. The IBM bulletin cites CVSS v3.0 vector CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N with a base score ...

CVE-2018-1725: Undefined Security Weakness

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

PT-2020-8617

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.3 through 7.4 Description: The issue concerns information disclosure in a multi-tenant configuration. There is no information provided about the estimated number of potentially affected devices worldwide or real-wor...

Security Bulletin: IBM QRadar SIEM in a multi tenant configuration could be vulnerable to information disclosure (CVE-2018-1725)

Summary In a multi tenant configuration IBM QRadar SIEM could be vulnerable to sensitive information disclosure. Vulnerability Details CVEID: CVE-2018-1725 DESCRIPTION: IBM QRadar SIEM in a multi tenant configuration could be vulnerable to information disclosure CVSS Base score: 3.2 CVSS Temporal...

Guide: Scale or Fail — Why MSSPs Need Multitenant Security Solutions

Managed Security Services Providers MSSPs have it rough. They have the burden of protecting their client organizations from cyberattacks, with clients from different industries, different security stacks, and different support requirements. And everything is in a constant state of flux. MSSPs are...

TikTok: Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform

Due to an Insecure Direct Object Reference IDOR vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution. This report is one of my...

CVE-2020-15137

All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated kernel memory to userspace applications on the host, or can cause the kernel to crash. Kernel memory disclosure is especially likely on 32-b...