Influence Operations Kill Chain

Influence operations are elusive to define. The Rand Corp.'s definition is as good as any: "the collection of tactical information about an adversary as well as the dissemination of propaganda in pursuit of a competitive advantage over an opponent." Basically, we know it when we see it, from bots...

Security Bulletin: IBM LMS On Premise - IBM SDK, Java Technology Edition Apr 2018 and Jul 2018 (CVE-2018-2783, CVE-2018-1517 , CVE-2018-2952)

Summary We have identified one or more security vulnerabilities that affect IBM Kenexa LMS for our on Premise customers. The Fix for these vulnerabilities is included in LMS version 6.1 only. IBM recommends updating to the latest release and following the instructions below to apply the needed fi...

Security Bulletin: IBM Event Streams is affected by Go vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the Go Runtimes shipped. Vulnerability Details CVEID: CVE-2019-9741 DESCRIPTION: Golang GO is vulnerable to HTTP header injection, caused by improper validation of input in the http.NewRequest. By sending a specially-crafted...

Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2019-4046

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4046 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to...

Security Bulletin: Multiple vulnerabilities in Jetty affect Netcool Agile Service Manager (CVE-2019-10247, CVE-2019-10246)

Summary There are multiple vulnerabilities in Eclipse Jetty used by Netcool Agile Service Manager. Netcool Agile Service Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-10247 DESCRIPTION: Eclipse Jetty could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018

Summary There are multiple vulnerabilities in Node.js used by IBM® Cloud App Management V2018. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID: CVE-2018-12122 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper...

Security Bulletin: A vulnerability in IBM Cloud App Management V2018 could allow an attacker to obtain sensitive configuration information

Summary There is a vulnerability in IBM® Cloud App Management V2018. IBM Cloud App Management V2018 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM® Cloud App Management has addressed the applicable CVE in a later version...

HackerOne: View HackerOne challenge scope before challenge begins

Summary: Hi team, I have come across an issue where I am able to view a HackerOne challenge scope before the challenge begins. The issue here being that I can get an understanding of what the in-scope assets are before a challenge starts, allowing myself to start researching and finding bugs to...

Security Bulletin: A vulnerability in Apache Commons Compress may affect IBM Cloud App Management V2018

Summary There is a vulnerability in Apache Commons Compress used by IBM® Cloud App Management V2018. IBM® Cloud App Management has addressed the applicable CVE in a later version. Vulnerability Details CVEID: CVE-2018-11771 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service...

Security Bulletin: IBM Event Streams is affected by OpenSSL vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the OpenSSL versions shipped. Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature...

Security Bulletin: IBM Event Streams is affected by gettext vulnerability CVE-2018-18751

Summary IBM Event Streams has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-18751 DESCRIPTION: GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the defaultaddmessage function in read-catalog.c. By persuading a victim to open a...

Security Bulletin: IBM Event Streams is affected by cURL vulnerabilities

Summary IBM Event Streams has addressed the following vulnerabilities in the shipped cURL libraries. Vulnerability Details CVEID: CVE-2018-16890 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information. The function handling incoming NTLM type-2 messages fails to...

Security Bulletin: IBM Event Streams is affected by Node.js vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime shipped. Vulnerability Details CVEID: CVE-2018-12122 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper validation of HTTP headers. By sending headers very slowly...

Security Bulletin: IBM Event Streams is affected by WebSphere Liberty Profile vulnerability CVE-2018-1902

Summary IBM Event Streams has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. CVSS Base...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - CVE-2018-1938

Summary Intra-service communications to IBM Cloud Private Identity and Access Management IAM pdp service uses http Vulnerability Details CVEID: CVE-2018-1938 DESCRIPTION: IBM Cloud Private could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. CVSS...

Security Bulletin: Multiple vulnerabilities were identified in Node.js that affect IBM Cloud App Management V2018

Summary Multiple vulnerabilities were identified in Node.js that affected IBM Cloud App Management V2018. The product was updated to use a later version of Node.js to address these security vulnerabilities. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial ...

Security Bulletin: A security vulnerability has been identified in Ansible shipped with Data Science Experience Local

Summary Ansible is shipped as a component of Data Science Experience Local. Information about a security vulnerability affecting Ansible has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-10874 DESCRIPTION: Ansible could allow a local authenticated attacker to execut...

Security Bulletin: Vulnerability in Apache Commons affects IBM System Networking Switch Center (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM System Networking Switch Center. Vulnerability Details Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM System...

Security Bulletin: Multiple vulnerabilities in IBM SDK Java Technology Edition affect IBM Cloud App Management V2018

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM® Cloud App Management V2018. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime Environment''s...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private Cloud Foundry (CVE-2018-3646, CVE-2018-3615, CVE-2018-3620)

Summary IBM Cloud Private Cloud Foundry is vulnerable to multiple security vulnerabilities Vulnerability Details CVEID: CVE-2018-3646 DESCRIPTION: Multiple Intel CPU's could allow a local attacker to obtain sensitive information, caused by a flaw in the CPU speculative branch instruction executio...