Dell EMC iDRAC9 SSL/TLS Protection Stripping Vulnerability

Dell EMC iDRAC9 is a system management solution comprising hardware and software from Dell USA. The solution provides remote management, crash system recovery and power control for Dell PowerEdge systems. A security vulnerability exists in Dell EMC iDRAC9 versions prior to 3.21.21.21, which stems...

Security Bulletin: IBM API Connect is affected by a Missing HTTP Strict Transport Security vulnerability (CVE-2018-1546)

Summary IBM API Connect has addressed the following vulnerability. IBM API Connect could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information...

Glusterfs elevation of privilege vulnerability

Red Hat GlusterFS is an open source distributed file system from Red Hat. The system is a combination of different storage servers , these servers by the Ethernet or unlimited bandwidth technology Infiniband and remote direct memory access RDMA convergence , and ultimately the formation of a larg...

Microsoft Windows: Remote server management (RM Service)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winrmservservermanagement.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Allow remote server management through WinRM Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.ne...

OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)

Vulnerability in the Java SE, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)

Vulnerability in the Java SE, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

USN-3691-1: OpenJDK 7 vulnerabilities

It was discovered that the Security component of OpenJDK did not correctly perform merging of multiple sections for the same file listed in JAR archive file manifests. An attacker could possibly use this to modify attributes in a manifest without invalidating the signature. CVE-2018-2790 Francesc...

BSA-2018-620

Security Advisory ID : BSA-2018-620 Component : TLS Revision : 2.0 The TLS protocol 1.2 and earlier supports the rsafixeddh, dssfixeddh, rsafixedecdh, and ecdsafixedecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations...

glusterfs: access trusted peer group via remote-host command

A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to...

The vulnerability of the implementation library for the Transport Layer Security protocol of Cisco’s microprogrammable network interface devices allows a attacker to induce a service failure.

The vulnerability of the implementation library for the Transport Layer Security TLS protocol in Cisco’s micro-programmed network interface devices exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending...

Security Bulletin: Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0

Summary Multiple Security Vulnerabilties have been addressed in LCMS Premier on Cloud 11.0 Vulnerability Details CVEID: CVE-2017-1142 DESCRIPTION: IBM Kenexa LCMS Premier on Cloud could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the...

Security Bulletin: IBM TRIRIGA is Missing HTTP Strict-Transport-Security Header (CVE-2017-1464)

Summary IBM TRIRIGA could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. Vulnerability Details CVEID: CVE-2017-1464 DESCRIPTION: IBM TRIRIGA could allow a remote attacker to obtain sensitive information, caused by...

Security Bulletin: IBM QRadar SIEM is missing HSTS header. (CVE-2016-9972)

Summary The product is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. Vulnerability Details CVEID: CVE-2016-9972...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by exposure of sensitive data due to missing HTTP Strict-Transport-Security Header (CVE-2016-6116)

Summary IBM Security Key Lifecycle Manager is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. IBM Security Key...

Security Bulletin: Multiple Security Vulnerabilities affect IBM Security Privileged Identity Manager Virtual Appliance

Summary There are multiple security vulnerabilities in various components fixed in the IBM Security Privileged Identity Manager Virtual Appliance Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive...

Security Bulletin:  IBM Security Guardium Database Activity Monitor is affected by Missing HTTP Strict-Transport-Security Header vulnerability (CVE-2016-0240)

Summary IBM Security Guardium Database Activity Monitor does not force the HTTP Strict-Transport-Security Header. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID: CVE-2016-0240 DESCRIPTION: IBM Security Guardium Database...

Security Bulletin: Multiple vulnerabilities addressed in IBM Emptoris Strategic Supply Management (CVE-2016-6021, CVE-2016-6029, CVE-2017-1190)

Summary The security bulletin includes multiple vulnerabilities found and addressed in IBM Emptoris Strategic Supply Management across various versions of the product. Vulnerability Details CVEID: CVE-2016-6021 DESCRIPTION: IBM Emptoris Strategic Supply Management Platform is vulnerable to...

UBUNTU-CVE-2018-11574

Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files...

DEBIAN-CVE-2018-7162

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service DoS by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshak...

DEBIAN-CVE-2018-0732

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...