CVE-2018-17196

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to...

Security Bulletin: Path Traversal exposure in the Save/Export function of the FTM OAC

Summary The "Save/Export" function available on all search result displays tabulated results is potentially vulnerable to a Path Traversal type attack. Vulnerability Details CVEID: CVE-2018-1847 DESCRIPTION: IBM Financial Transaction Manager FTM for Multi-Platform MP could allow a remote attacker...

Security Bulletin: Financial Transaction Manager for ACH Services is affected by a potential cross-site request forgery vulnerability (CVE-2018-1790)

Summary IBM Financial Transaction Manager for ACH Services FTM ACH for Multi-Platform has addressed the following vulnerability. A potential cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for ACH Services for Multi-Platform

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 or Version 8 by Financial Transaction Manager for ACH Services for Multi-Platform FTM ACH. Financial Transaction Manager for ACH Services for Multi-Platform has addressed the applicable CVEs. Vulnerability...

Transaction Log Backup Job for Microsoft SQL Server with AlwaysOn Availability Groups fails after installing CU15 for SQL Server 2017

Challenge When utilizing Always On Availability Groups on a Windows Server Failover Cluster using Microsoft SQL Server 2017 and after installing Cumulative Update package 15 CU15 for SQL Server 2017, Veeam Transaction Log Backup Jobs may fail with the following error message in the the statistics...

Microsoft Windows - 'CmpAddRemoveContainerToCLFSLog' Arbitrary File/Directory Creation

Windows: CmpAddRemoveContainerToCLFSLog Arbitrary File/Directory Creation EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The kernel’s CmpAddRemoveContainerToCLFSLog function doesn’t...

Crypto tumbler BestMixer.io seized for large-scale money laundering

By Uzair Amir BestMixer.io was among the three largest cryptocurrency mixing services launched in May 2018. Europol in collaboration with the Dutch Fiscal Information and Investigative Service FIOD, Luxembourg has shut down a well-known and one of the world’s leading cryptocurrency tumblers...

CVE-2018-1790

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944...

Cross site request forgery (csrf)

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944...

CVE-2018-1790

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944...

CVE-2018-1790

CVE-2018-1790 affects IBM Financial Transaction Manager products across multiple platforms with a cross-site request forgery (CSRF) risk. Affected versions include: FT M Check (CHK) 3.0.0.0–3.0.0.15, 3.0.2.0–3.0.2.1, 3.0.5.0–3.0.5.2; FTM CPS 2.1.1.0–2.1.1.4; FTM CPS 3.0.2.0–3.0.2.1, 3.2.1.0; FTM ...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this...

CVE-2019-11636

Technical details about CVE-2019-11636 are not publicly provided in the supplied documents. Monitoring for updated advisories is advised; current sources describe a Sapling Wood-Chipper-like attack on Zcash 2.x but do not reveal affected versions, impact specifics, or fixes.

CVE-2018-20510

The printbindertransactionilocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading "from code flags" lines in a debugfs file...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this...

New Relic: Stored XSS firing at transaction map (applicationName field)

Hey team, I have discovered the stored XSS vulnerability which is triggered at transaction map. The transaction map is retrieved via GET-request to the URL like https://rpm.newrelic.com/accounts/2319495/applications/143826822/transactions/2877762416/transactionmap. The response contains the...

CVE-2019-9806

A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service DOS attack. This vulnerability affects Firefox 66...

The vulnerability of the TCAP component in the Wireshark network traffic analyzer allows a hacker to trigger a service failure. This vulnerability is related to the handling of the zero pointer, which enables a hacker to cause a system failure.

The vulnerability of the TCAP component epan/dissectors/asn1/tcap/tcap.cnf, which is part of the Wireshark network traffic analyzer, is related to the manipulation of the zero pointer. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for Corporate Payment Services for Multi-Platform v2.1.1

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by Financial Transaction Manager for Corporate Payment Services for Multi-Platform FTM CPS. Financial Transaction Manager for Corporate Payment Services for Multi-Platform has addressed the applicable CVEs...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-1871)

Summary IBM Financial Transaction Manager for Corporate Payment Services FTM CPS for Multi-Platform has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...