Security Bulletin: Multiple vulnerabilities affect IBM Planning Analytics Workspace

Summary This Security Bulletin addresses multiple vulnerabilities in Node.js that have been remediated in IBM Planning Analytics Workspace Release 58. Vulnerability Details CVEID: CVE-2019-15604 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper certificate validation. ...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

Code injection

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

CVE-2020-4649

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 expose data to non-privileged users due to not invalidating TM1Web sessions (information disclosure). The issue affects Local 2.0.9.2 and Workspace 57, with remediation in IBM Planning Analytics Local 2.0.9.3 and Plannin...

PT-2020-18184

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local version 2.0.9.2 IBM Planning Analytics Workspace version 57 Description The issue could expose data to non-privileged users due to the failure to invalidate TM1Web user sessions. Recommendations For IBM Planning...

CVE-2020-4649: Exposure of Sensitive Information to an Unauthorized Actor

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022...

CVE-2020-7758

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server...

CVE-2020-7758

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server...

Security Bulletin: Multiple vulnerabilities affect IBM Planning Analytics

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Planning Analytics Local 2.0.9.3 and IBM Planning Analytics Workspace Release 58. There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by IBM Planning Analytics and IBM Planning...

CVE-2020-7758: Improper Limitation of a Pathname to a Restricted Directory

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server...

PT-2020-19771 · Browserless · Browserless-Chrome

Name of the Vulnerable Software and Affected Versions: browserless-chrome versions prior to 1.43.0 Description: The issue affects browserless-chrome, where user input from the "workspace endpoint" is used to create a file path filePath. This filePath is then fetched and sent back to the user,...

Path Traversal

Overview browserless-chrome is a web-service that allows for remote clients to connect, drive, and execute headless work; all inside of docker. It offers first-class integrations for puppeteer, playwright, selenium's webdriver, and a slew of handy REST APIs for doing more common work. Affected...

Unable to limit visibility of applications to specific user groups

Previously able to restrict apps visibility to specific users or user groups using the 'Limit Visibility' option through the app properties. Now all company's users can see all apps when logging to the Cloud Workspace...

The vulnerability of the BI Workspace module of the SAP BusinessObjects Business Intelligence platform allows a hacker to elevate their privileges by intercepting sessions or exposing protected information.

The vulnerability of the BI Workspace module of the SAP BusinessObjects Business Intelligence platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to elevate their privileges by intercepting sessions or disclose...

openSUSE Security Update : opera (openSUSE-2020-1713)

This update for opera fixes the following issues : opera was updated to version 71.0.3770.228 - DNA-87466 Hide extensions icon is black in dark theme - DNA-88580 Implement searchintabs telemetry benchmark - DNA-88591 Allow to scroll down the Keyboards Shortcuts section with URL - DNA-88693 Random...

CloudBees Jenkins Copy data to workspace Plugin Arbitrary File Read Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . An arbitrary file read...

Windows Media redirection fails on Citrix Workspace app for Mac

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Attempts to use Windows Media Redirection might fail even after choosing to be Allowed in theWindows...

Better Secure and Manage Endpoints in a Remote Work World

The global pandemic has quickly changed how and where we work. Remote work is now the ‘new normal.’ Amid the massive transition, a June survey by S&P Global found: More than two-thirds of companies may be working from home forever Offices that do remain will probably shrink: 47% of respondents sa...

Citrix Workspace App for Windows Security Update Privilege Escalation Vulnerability (CTX277662)

The version of Citrix Workspace installed on the remote host is affected by a privilege escalation vulnerability in the the automatic update service due to improper access control. An authenticated, remote attacker can exploit this issue, to gain administrator access to the system. Note that Ness...