GHSA-V38P-MQQ3-M6V5 Keycloak Reflected XSS

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server...

Keycloak Reflected XSS

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server...

Security Bulletin: Content Collector for Email is affected by a embedded WebSphere Application Server Admin Console

Summary Embedded WebSphere Application Server traditional Admin Console is vulnerable to a directory traversal vulnerability CVE-2020-4782 Vulnerability Details CVEID: CVE-2021-23450 DESCRIPTION: Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype...

Security Bulletin: Client-side HTTP Parameter Pollution in WAS Intelligent Management Admin console

Summary Client-side HTTP Parameter Pollution in WAS Intelligent Management Admin console. TWAS pen testing uncovered an issue with the admin console that allows Client-side HTTP Parameter Pollution. The user must be navigating the affected resources. Client-side HTTP parameter pollution HPP...

The vulnerability of the VMware Workspace ONE Access application management platform, the VMware Cloud Foundation virtualization platform, the VMware vRealize Automation virtual infrastructure management tool, the vRealize Suite Lifecycle Manager application lifecycle management software, and the VMware Identity Manager (vIDM) administration console lies in insufficient checks on the HTTP request source. This allows attackers to carry out CSRF attacks.

The vulnerabilities of the application management platform VMware Workspace ONE Access, the virtualization platform VMware Cloud Foundation, the virtual infrastructure management tool VMware vRealize Automation, the application lifecycle management software vRealize Suite Lifecycle Manager, and t...

CVE-2021-33523

MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...

CVE-2021-33523

MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...

Design/Logic Flaw

MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...

CVE-2021-33523

MashZone NextGen (up to 10.7 GA) contains a vulnerability where a remote authenticated user with admin-console access can upload a JDBC driver via com.idsscheer.ppmmashup.business.jdbc.DriverUploadController, allowing execution of arbitrary commands on the underlying host. The Red Hat and NVD ent...

CVE-2021-33523

MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the underlying host. This occurs in com.idsscheer.ppmmashup.business.jdbc.DriverUploadController...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

CVE-2022-22354

CVE-2022-22354 affects IBM Spectrum Protect Plus (10.1.0.0–10.1.9.2) and IBM Spectrum Copy Data Management (2.2.0.0–2.2.14.3). The issue is that connections are not length-limited, enabling a Slowloris HTTP denial-of-service attack that can render the Admin Console unresponsive. Affected products...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

Security Bulletin: Potential denial of service in WebSphere Application Server Admin Console affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2019-4080)

Summary There is a potential denial of service in WebSphere Application Server Admin Console which affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details CVEID: CVE-2019-4080 DESCRIPTION: IBM WebSphere Application Server Admin Console is vulnerable to a...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center (CVE-2017-1137)

Summary A vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center. There is a potential for weaker than expected security with the Administrative Console in WebSphere Application Server. Tivoli Storage Productivity Center has addressed the applicable CVE...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center (CVE-2017-1380)

Summary A vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center. There is a potential cross-site scripting vulnerability in the Admin Console for WebSphere Application Server. Tivoli Storage Productivity Center has addressed the applicable CVE. Vulnerability...

Security Bulletin: Potential security vulnerability in the WebSphere Application Server Admin Console affects Tivoli Storage Productivity Center (CVE-2017-1501)

Summary There is a potential security vulnerability in the WebSphere Application Server Admin Console affecting Tivoli Storage Productivity Center if you have updated the web services security bindings settings. If you changed the cipher suites in the web services security bindings settings, they...

Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...