CVE-2021-38896

IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209566...

Information Disclosure Vulnerability in Hitachi Tuning Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer

Overview Hitachi Tuning Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer contains information disclosure vulnerability. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section...

New Rapid7 MDR Essentials Capability Sees What Attackers See: “It’s Eye-Opening”

The pandemic and remote work shattered your perimeter. Your attack surface has changed — and will keep changing. It’s our mission to help customers strengthen security defenses and stay ahead of evil. As the modern perimeter expands, new and old vulnerabilities emerge as open doors for attackers;...

CVE-2020-5351

Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only...

CVE-2020-5351

Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only...

Hardcoded credentials

Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only...

CVE-2020-5351

Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only...

CVE-2020-5351

Dell EMC Data Protection Advisor (versions 6.4, 6.5, and 18.1) contains an undocumented account protected by a hard-coded password. A remote unauthenticated attacker who knows the password can log in and gain read‑only privileges. This is supported by multiple sources in the connected documents (...

CVE-2020-5351: Use of Hard-coded Password

Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only...

Dell EMC Data Protection Advisor 安全漏洞

Dell EMC Data Protection Advisor is a data protection management solution from Dell Dell. The product supports data backup, data recovery, and data replication management. A security vulnerability exists in Dell EMC Data Protection Advisor versions 6.4, 6.5, and 18.1, which arises from the affect...

WordPress KONTXT Content Advisor plugin <= 2.1 - Unauthorized AJAX call via Cross-Site Request Forgery (CSRF) vulnerability

Unauthorized AJAX call via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress KONTXT Content Advisor plugin versions = 2.1. Solution Update the WordPress KONTXT Content Advisor plugin to the latest available version at least 2.3...

Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8.0.6.25 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVE. This issue was disclosed as part of the IBM Java SDK update. Vulnerability Details CVEID: CVE-2021-2161...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2021-33502 Vulnerability Details CVEID: CVE-2021-33502 DESCRIPTION: Node.js normalize-url module is vulnerable to a denial of service, caused by a ReDoS regular expression denial of service flaw in the data URLs. By...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2021-31597 Vulnerability Details CVEID: CVE-2021-31597 DESCRIPTION: Node.js xmlhttprequest-ssl module is vulnerable to a man-in-the-middle attack, caused by the disalbe of SSL certificate validation by default. An...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerabilities CVE-2021-3450 and CVE-2021-3449 Vulnerability Details CVEID: CVE-2021-3450 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by a a missing check in the validation logic of X.50...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-5258)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability: CVE-2020-5258 Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2021-26296)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability: CVE-2021-26296 Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an...

CVE-2021-29084

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in Security Advisor report management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors...

Design/Logic Flaw

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in Security Advisor report management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2021-29084

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in Security Advisor report management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors...