CVE-2021-38891

CVE-2021-38891 affects IBM Sterling Connect:Direct Web Services (versions 1.0 and 6.0). The issue is weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM advisory (B1E... bulletin) confirms affected products and versions, and ...

CVE-2021-38890

CVE-2021-38890 affects IBM Sterling Connect:Direct Web Services (Products/Versions: 1.0 and 6.0). The root cause is an inadequate account lockout setting that could allow a remote attacker to brute-force credentials. Impact per sources includes potential credential disclosure with no explicit rem...

CVE-2021-38890

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 209507...

mongo-java-driver: client-side field level encryption not verifying KMS host name

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...

Security Bulletin: Account Lockout Vulnerability Affects IBM Sterling Connect:Direct Web Services (CVE-2021-38890)

Summary An account lockout vulnerability has been addressed by IBM Connect:Direct Web Service. Vulnerability Details CVEID: CVE-2021-38890 DESCRIPTION: IBM Sterling Connect:Direct Web Services uses an inadequate account lockout setting that could allow a remote attacker to brute force account...

Security Bulletin: PostgreSQL Sensitive Information Exposure Vulnerability Affects IBM Connect:Direct Web Services (CVE-2021-32029)

Summary IBM Connect:Direct Web Services has addressed a PostgreSQL vulnerability that potentially exposes sensitive information to a remote attacker. Vulnerability Details CVEID: CVE-2021-32029 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensitive information,...

Security Bulletin: Weak Cryptographic Control Vulnerability Affects IBM Sterling Connect:Direct Web Services (CVE-2021-38891)

Summary IBM Sterling Connect:Direct Web Services used weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-38891 DESCRIPTION: IBM Sterling Connect:Direct Web...

PYSEC-2021-864

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer...

PYSEC-2021-862

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.4.2, Python versions prior to 1.6.1, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.3 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in the...

Amazon AWS IoT Device SDK 信任管理问题漏洞

The Amazon AWS IoT Device SDK is a collection of C source files under the MIT Open Source License from Amazon.com, Inc. that can be used in embedded applications to securely connect IoT devices to the AWS IoT Core.It includes an MQTT, JSON parser, and the AWS IoT Device Shadow library. It is...

Improper Certificate Validation

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer...

Cisco Firepower Threat Defense XSS (cisco-sa-asaftd-xss-webui-gQLSFyPM)

According to its self-reported version, Cisco FTD Software is affected by a cross-site scripting XSS vulnerability in its web services interface due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a us...

Amazon AWS IoT Device SDK 信任管理问题漏洞

The Amazon AWS IoT Device SDK is a collection of C source files under the MIT Open Source License from Amazon.com, Inc. that can be used in embedded applications to securely connect IoT devices to the AWS IoT Core.It includes an MQTT, JSON parser, and the AWS IoT Device Shadow library. It is...

Liferay Portal 6.2.x < 6.2.5 / 7.0.x < 7.0.6 / 7.1.x < 7.1.3 / 7.2.x < 7.2.1 RCE

The version of Liferay Portal installed on the remote host is affected by a remote code execution vulnerability in its JSON web services component. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Nessus has not tested for thi...

Cisco Adaptive Security Appliance XSS (cisco-sa-asaftd-xss-webui-gQLSFyPM)

According to its self-reported version, Cisco ASA Software is affected by a cross-site scripting XSS vulnerability in its web services interface due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a us...

CVE-2021-38890

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 209507...

CVE-2021-38891

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 209508...

IBM Sterling Connect:Direct 加密问题漏洞

IBM Sterling Connect:Direct is a file-based, peer-to-peer file transfer solution from IBM in the United States. A security vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from the use of weaker-than-expected encryption algorithms that could allow an attacker to decrypt...

IBM Sterling Connect:Direct 安全漏洞

IBM Sterling Connect:Direct is a file-based, peer-to-peer file transfer solution from IBM in the United States. A security vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from the Direct Web Services' use of improper account lockout settings, which could allow a remote...

Amazon AWS IoT Device SDK 信任管理问题漏洞

The Amazon AWS IoT Device SDK is a collection of C source files under the MIT Open Source License from Amazon.com, Inc. that can be used in embedded applications to securely connect IoT devices to the AWS IoT Core.It includes an MQTT, JSON parser, and the AWS IoT Device Shadow library. It is...