Security Bulletin: IBM MQ Console and REST API are vulnerable to a privilege escalation attack. (CVE-2019-4304)

Summary IBM WebSphere Application Server Liberty profile, which is used to host the IBM MQ Console and REST API, could allow an attacker to bypass security and gain access to the MQ Console and REST API. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server -...

Blackboard Learn/PeopleTool Cross-Site Scripting Vulnerability

Blackboard is a Web-based, student-centered instructional tool. A cross-site scripting vulnerability exists in Blackboard Learn/PeopleTool version v9.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability ...

Security Bulletin: IBM MQ Appliance is affected by OpenSSL vulnerabilities (CVE-2018-0734 and CVE-2019-1559)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerabilities. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then OpenSSL can respond...

Security Bulletin: IBM MQ Appliance is affected by an unauthorised access vulnerability (CVE-2019-4621)

Summary IBM MQ Appliance has addressed the following unauthorised access vulnerability. Vulnerability Details CVEID: CVE-2019-4621 DESCRIPTION: IBM DataPower Appliance and IBM MQ Appliance have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker...

GitLab Incorrect Access Control Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

Security Bulletin: IBM MQ Appliance is affected by a libcgroup vulnerability (CVE-2018-14348)

Summary IBM MQ Appliance has addressed the following libcgroup vulnerability. Vulnerability Details CVEID: CVE-2018-14348 DESCRIPTION: libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information. CVSS Base score...

Azure File Sync Agent v9.1 Release – December 2019 (KB4522360)

Update for Azure File Sync agent version 9.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v9.1 Release – December 2019 (KB4522360)

Update for Azure File Sync agent version 9.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

Adobe Bridge CC Security Updates (APSB19-53) - Windows

Adobe Bridge CC is prone to an information disclosure vulnerability SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Bridge CC Memory Corruption Vulnerability (CNVD-2019-41658)

Adobe Bridge CC is a file viewer from Adobe, USA. A memory corruption vulnerability exists in Adobe Bridge CC 9.1 and earlier versions based on Window and macOS platforms, which can be exploited by attackers to obtain sensitive information...

Security Bulletin: Cross-Site Request Forgery in IBM InfoSphere Master Data Management - Collaborative Edition (CVE-2013-5427)

Summary Due to insufficient safeguards against cross-site request forgery, an attacker can trick a legitimate user into opening a URL that results in an action being taken as that user, potentially without the knowledge of that user. Any actions taken require that the legitimate user be already...

Security Bulletin: IBM MQ clients are vulnerable to a denial of service attack caused by consuming specifically crafted messages (CVE-2019-4261)

Summary An error was found with the IBM MQ client message handling logic that causes a denial of service attack when specifically crafted messages are consumed. Vulnerability Details CVEID: CVE-2019-4261 DESCRIPTION: IBM MQ Clients are vulnerable to a denial of service attack caused by specially...

DNN Cross-Site Scripting Vulnerability

DNN formerly known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich and so on. DNN 9.1 version of the cross-site scripting vulnerability , remote attackers...

Micro Focus NetIQ eDirectory Authorization Check Error Vulnerability

Micro Focus NetIQ eDirectory is an identity management infrastructure platform from Micro Focus UK that combines identity management architecture and directory services technology. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. An...

CVE-2018-17950

Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Insufficient Authorization Checks vulnerability (CVE-2018-1368 )

Summary IBM Security Guardium Database Activity Monitor has addressed the following vulnerability Vulnerability Details CVEID: CVE-2018-1368 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a local user with low privileges to view report pages and perform some actions that...

Security Bulletin: IBM Security Guardium is affected by Sweet32: Birthday attacks on 64-bit block ciphers in TLS (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the in the Triple-DES on 64-bit block cipher, used as a part of the SSL/TLS protocol. This vulnerability is known as the SWEET32 Birthday attack. IBM Security Guardium has fixed this vulnerability...

Security Bulletin:  IBM Security Guardium Database Activity Monitor is affected by Missing HTTP Strict-Transport-Security Header vulnerability (CVE-2016-0240)

Summary IBM Security Guardium Database Activity Monitor does not force the HTTP Strict-Transport-Security Header. This could allow an attacker to obtain sensitive information using man in the middle techniques. Vulnerability Details CVEID: CVE-2016-0240 DESCRIPTION: IBM Security Guardium Database...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Improper Authorization Vulnerability (CVE-2016-0239)

Summary IBM Security Guardium Database Activity Monitor could allow a remote authenticated attacker to issue a specially HTTP request as administrator. Vulnerability Details CVEID: CVE-2016-0239 DESCRIPTION: IBM Security Guardium Database Activity Monitor could allow a remote authenticated attack...

Security Bulletin: A vulnerability in Struts affects IBM InfoSphere Metadata Workbench

Summary A Struts vulnerability affects IBM InfoSphere Metadata Workbench. Vulnerability Details CVEID: CVE-2017-15707 DESCRIPTION: Apache Struts is vulnerable to a denial of service. By sending a specially crafted JSON request using outdated json-lib with the Struts REST plugin, a remote attacker...