Dont check return type

Lines of code Vulnerability details Impact Dont check return type Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Add suitable checks --- The text was updated successfully, but these errors were encountered: 👎 1 trust1995 reacted with thumbs down emoji All reactions 👎 1...

Assume that asset type passed from outside is valid

Lines of code Vulnerability details Impact Assume that asset type passed from outside is valid. Proof of Concept Tools Used Code analytics Recommended Mitigation Steps Better way is to case collection address to some interface, use method to obtain type. --- The text was updated successfully, but...

Passing chain id from outside

Lines of code Vulnerability details Impact Passing chain id from outside. Incorrect chain id can be passed. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Use assembly to obtain current chain id. --- The text was updated successfully, but these errors were encountered:...

Transfer reminder of msg.value is bad practice

Lines of code Vulnerability details Impact Transfer reminder of msg.value is bad practice. Can lead to out of gas, reentrancy and so on. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Can create method getReminder and user to call to get all reminders for him. --- The...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 Open Web Analytics OWA...

Security Bulletin: IBM Security Network Threat Analytics for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2022-1941, CVE-2022-34749, CVE-2022-1552)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2022-1941 DESCRIPTION: protobuf is vulnerable to a denial of service, caused by a parsing...

Security Bulletin: IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2021-40690, CVE-2022-25647, XFID: 233967)

Summary IBM Planning Analytics Workspace is affected by multiple vulnerabilities. Apache Santuario Security for Java provides a mechanism for XML-Signature & XML Encryption syntax and processing CVE-2021-40690. Google Gson is an open-source Java library to serialize and deserialize Java objects t...

Attack Analytics Helps You Find the Monsters Under the Bed

Alert fatigue kills data breach detection efforts Is there anything more frightening than missing a cyber attack? For most organizations, the answer is no. However, for many security teams, it’s challenging to tune alerts properly to minimize false positives and still be alerted to potential...

Security Bulletin: There is a vulnerability in moment.js used by IBM QRadar User Behavior Analytics (CVE-2022-24785)

Summary There is a vulnerability in moment.js used by IBM QRadar User Behavior AnalyticsUBA. This vulnerabiliity is addressed in UBA by upgrading to a version of moment.js that resolves the issue. Vulnerability Details CVEID:CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attacker to...

Security Bulletin: Multiple vulnerabilities in Zookeeper affecting IBM QRadar User Behavior Analytics (CVE-2022-2191, CVE-2022-2047, CVE-2022-2048, CVE-2022-24823, CVE-2020-36518)

Summary Multiple vulnerabilities exist in Zookeeper that are used by IBM QRadar User Behavior Analytics UBA. These vulnerabilities are addressed in UBA by upgrading to a version of Zookeeper and packages that are associated with Zookeeper that resolve the vulnerabilities. Vulnerability Details...

Analytics Cat < 1.1.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vlad Vector Patchstack in WordPress Analytics Cat plugin versions = 1.0.9. Solution Update the WordPress Analytics Cat plugin to the latest available version at least 1.1.0...

IBM QRadar User Behavior Analytics has an unspecified vulnerability

IBM QRadar User Behavior Analytics UBA is a user behavior analysis software from International Business Machines IBM, Inc. It can analyze user activity to detect suspicious insiders and determine whether user credentials have been stolen. Security analysts can easily view at-risk users, examine...

CVE-2022-36771

IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791...

CVE-2022-36771

IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791...

Information disclosure

IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791...

CVE-2022-36771

IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791...

CVE-2022-36771

IBM QRadar User Behavior Analytics (QRadar UBA) is affected by CVE-2022-36771. The vulnerability allows an authenticated user to obtain sensitive information to which they should not have access, due to authorization bypass for certain admin-level information. Affected product/version: QRadar UBA...

CVE-2022-36771

IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791...

IBM QRadar User Behavior Analytics 安全漏洞

IBM QRadar User Behavior Analytics UBA is a user behavior analysis software from International Business Machines IBM, Inc. It can analyze user activity to detect suspicious insiders and determine whether user credentials have been stolen. Security analysts can easily view at-risk users, examine...