Design/Logic Flaw

IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks agains...

Authorization

IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link...

CVE-2019-4744

IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172882...

CVE-2019-4744

IBM Financial Transaction Manager for SWIFT Services 3.0.0 (Multiplatforms) is affected by CVE-2019-4744, a cross-site scripting vulnerability in the Web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials in a trusted session. Remediation: install ...

CVE-2019-4742

IBM Financial Transaction Manager for SWIFT Services 3.0 (3.0.0) is vulnerable to a remote clickjacking-type issue that could allow an attacker to hijack the victim’s click actions when the user visits a malicious page. The IBM bulletin for this CVE-2019-4742 entry confirms vulnerable web UI comp...

CVE-2019-4743

IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link...

CVE-2019-4742

IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks agains...

CVE-2019-4743

IBM Financial Transaction Manager for SWIFT Services 3.0 is affected by CVE-2019-4743: authorization tokens and session cookies do not have the Secure attribute set, allowing cookie exposure over insecure links (http). This is documented in IBM Security Bulletin (CVE-2019-4743) with a remediation...

CVE-2019-4736

IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706...

CVE-2019-4736

CVE-2019-4736 affects IBM Financial Transaction Manager for SWIFT Services 3.0.0 (Multiplatforms). The vulnerability is cross-site request forgery that could allow an attacker to perform malicious/unauthorized actions transmitted from a trusted user. The NVD lists a CVSS v3.1 base score of 4.3 (M...

CVE-2019-0383

Transaction Management in SAP Treasury and Risk Management corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilege...

Authorization

Transaction Management in SAP Treasury and Risk Management corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilege...

CVE-2019-0383

Transaction Management in SAP Treasury and Risk Management corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilege...

Insecure Random Generator

github.com/miekg/dns uses an insecure random generation for transaction IDs. The default Id function uses an insecure math/rand function, resulting in predictable output and allowing an attacker to exploit the vulnerability to forge responses without being on path...

PT-2019-6115 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel versions affected versions not specified Description: The issue is related to an out-of-bounds write operation in the binder transaction function of the Android kernel. This could allow an attacker to escalate their privileges...

Razer: Improper Authorization at https://api-my.pay.razer.com/v1/trxDetail?trxId=[Id] allowing unauthorised access to other user's transaction details

The tester determined that the Razer Pay backend server could be exploited to obtain transaction details from another user. Razer Fintech appreciates the detailed report and clear PoC...

Additional Information on “Cost Estimation” in Veeam Backup for AWS

Related User Guide Page This KB article provides additional information to the following pages: Creating EC2 Backup Policies Step 9. Review Estimated Cost Creating RDS Backup Policies Step 9. Review Estimated Cost Challenge Cost Estimation provides the administrator feedback on estimates of AWS...

Important: Red Hat Security Advisory: kpatch-patch security update

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2019-089)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - hw: Machine Check Error on Page Size Change IFU - hw: Intel GPU blitter manipulation can allow for...

RHEL 8 : kpatch-patch (RHSA-2019:3936)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3936 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...