Security Bulletin: Asset Analyzer (RAA) is affected by two WebSphere Application Server vulnerabilities.

Summary Rational Asset Analyzer RAA has addressed the following vulnerabilities in WebSphere Application Server. Vulnerability Details CVEID: CVE-2020-4303 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WebSphere Application Server vulnerability

Summary Asset Analyzer RAA has addressed the following vulnerability. IBM WebSphere Application Server was affected by a cross-site scripting. Vulnerability Details CVEID: CVE-2019-17573 DESCRIPTION: Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied...

Security Bulletin: Asset Analyzer (RAA) is affected by a WebSphere Application Server vulnerability

Summary Rational Asset Analyzer RAA has addressed the following vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachments present in a...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in Websphere Application Server.

Summary IBM WebSphere Application Server used by Rational Asset Analyzer is vulnerable to a denial of service, caused by sending a specially-crafted request. . Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the failure to restri...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Asset Analyzer.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by Rational Asset analyzer. Rational Asset analyzer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in Websphere Application Server.

Summary IBM WebSphere Application Server used by Rational Asset Analyzer is vulnerable to a denial of service, caused by sending a specially-crafted request. . Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in Websphere Application Server.

Summary IBM WebSphere Application Server used by Rational Asset Analyzer is vulnerable to a denial of service, caused by sending a specially-crafted request. . Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial...

The vulnerability of the syntax analyzer and the YANG data modeling tool, Libyang, arises from writing beyond buffer boundaries in memory. This allows attackers to trigger service failures or execute arbitrary code.

The vulnerability of the syntax analyzer and the YANG data modeling language toolset lies in the writing beyond buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

The vulnerability of ENIP network traffic analyzer of Wireshark allows a hacker to cause a service failure.

The vulnerability of the ENIP network traffic analyzer of Wireshark relates to the use of memory after it is released. Exploiting this vulnerability can allow a hacker to cause a service failure...

The vulnerability of the YAML syntax analyzer plugin for working with the OpenShift Jenkins OpenShift Pipeline plugin allows a attacker to execute arbitrary code.

The vulnerability of the YAML syntax analyzer for the OpenShift Jenkins OpenShift Pipeline Plugin is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the TSDNS discriver and the traffic analyzer for computer networks, Wireshark, allows a hacker to cause a service failure.

The vulnerability of the TSDNS discoverer and the Wireshark traffic analyzer in computer networks is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the YAML syntax analyzer in the Jenkins Azure Container Service Plugin allows a perpetrator to execute arbitrary code.

The vulnerability of the YAML syntax analyzer in the Jenkins Azure Container Service Plugin is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Netscaler.c module, a traffic analyzer for computer networks developed by Wireshark, allows a hacker to cause a service failure.

The vulnerability of the Netscaler.c module, a traffic analyzer for computer networks developed by Wireshark, exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

The vulnerability of the Local Download Sharing Service, a traffic analyzer for computer networks by Wireshark, allows a hacker to cause a service failure.

The vulnerability of the Local Download Sharing Service, a traffic analyzer for computer networks in Wireshark, is related to the manipulation of the zero pointer. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

UPDATE: Ostinato 1.0

Ostinato 1.0 was released a while ago. I covered this open source tool some time ago in a post titled – Ostinato: The Network Traffic Generator and Analyzer! A lot has changed such as the code has now been ported to Qt5 with an improved UI for variable fields widget. What is Ostinato? Ostinato is...

Anchore Engine Command Execution Vulnerability

Anchore Engine is an open source service from US-based Anchore that analyzes Docker images and applies user-defined acceptance policies to allow automated container image validation and authentication. A security vulnerability exists in Anchore Engine version 0.7.0. An attacker can exploit the...

Design/Logic Flaw

In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user vi...

CVE-2020-11075

CVE-2020-11075 affects Anchore Engine 0.7.0. A specially crafted container image manifest fetched from a registry can trigger a shell escape in the anchore engine analyzer service during image analysis. Exploitation requires an authenticated API request or manipulation of a monitored image’s mani...

The vulnerability of the User Interface sub-component of the Oracle Insurance Accounting Analyzer component in the bank analytics system’s simulation model, Oracle Financial Services Applications, allows a perpetrator to create, delete, or modify access rights to protected information, or gain read-only access to data.

The vulnerability of the User Interface component of the Oracle Insurance Accounting Analyzer component in the bank analytics system’s simulation model application relates to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to create, delete, or modify...

The vulnerability of the XML analyzer for software that manages Cisco Firepower Device Manager On-Box allows a hacker to trigger a maintenance failure.

The vulnerability of the XML analyzer for software that manages Cisco Firepower Device Manager On-Box devices is related to an operation where data escapes beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failure...