X-force

IBM X-Force Exchange ライブラリ | IBM Security X-FORCE Exchange ライブラリ（Python 3）。検索対象: threatactivities, threatgroups, malwareanalysis, collector, industries。その他のアプリケーション向け。 を参照 ---|--- インストール root@kitploit: pip3 install XForce 使用方法 APIKEY を使用して基本認証を行います。 を参照してください。その後、base64 コードを作成します → Key + : +...

Security Bulletin: Authd service in the IBM Verify Gateway PAM components allows cleartext transmission of sensitive information (CVE-2020-4397)

Summary The IBM Verify Gateway IVG Authd service listens on TCP port 12. When the service is enabled, it's possible to detect cleartext transmission of sensitive information in the data traffic to and from the port. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the Authd servi...

Security Bulletin: IBM Verify Gateway PAM components default to cleartext storage of client secret (CVE-2020-4369)

Summary The IBM Verify Gateway IVG PAM components allow encryption of the client-secret property in the /etc/pamibmauth.json file, but it's not the default configuration. Instead, customers must remember to add an --obfuscation command-line flag to encrypt the property. As of v1.0.1 of IVG for AI...

Security Bulletin: IBM Verify Gateway PAM components include a leftover debug file (CVE-2020-4371)

Summary The IBM Verify Gateway IVG PAM components include a leftover header file in their installation packages. The file was needed for debugging during development and shouldn't be part of the delivered PAM components. As of v1.0.1 of IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM, the file h...

IBM Patches Reflected XSS in Worklight, MobileFirst

IBM fixed a cross-site scripting vulnerability in two products last month that could have let an attacker execute malicious JavaScript code in a victim’s browser to steal sensitive information, or user credentials. The vulnerability CVE-2017-1500 lingered in the products, Worklight and MobileFirs...

OSINT Chrome Extension: ThreatPinch Lookup

OSINT Chrome Extension ThreatPinch was designed to enable information security professionals quick reference checks for commonly looked up indicators without having to leave the comfort of their current webpage. Be it, IPv4 addresses, MD5/SHA2 hashes, these indicators are usually copied and paste...