Unchecked hostname resolution could allow access to local network resources by users outside the local network

Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...

curl: Leak of authentication credentials in URL via automatic Referer

It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Referer HTTP request header while handling HTTP redirects. This could lead to exposure of the credentials to the server to which requests were redirected...

Security Bulletin: A vulnerability in Apache ActiveMQ affects IBM Operations Analytics Predictive Insights (CVE-2020-13947)

Summary Apache ActiveMQ is used by IBM Operations Analytics Predictive Insights. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-13947 DESCRIPTION: Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper...

CVE-2020-15381

Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the jmx server...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-1962)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.9.1 : curl (EulerOS-SA-2021-1962)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way libcurl handled TLS 1.3 session tickets. A malicious HTTPS proxy could possibly use this flaw to make...

Security Bulletin: A vulnerability in the GSKit component of Informix Dynamic Server (IDS) (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit, component of Informix Dynamic Server IDS . Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this...

Security Bulletin: A vulnerability in the GSKit component of Client Software Development Kit (CSDK) (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit, component of Informix Client Software Development Kit CSDK Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4996)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability concerns sensitive data leakage via screenshots in ISAR Apps. Vulnerability Details CVEID: CVE-2020-4996 DESCRIPTION: IBM Security Access Manager...

Security Bulletin: Security vulnerabilities have been identified in GSKIT and/or GSKit Crypto and Fork that are integrated with IBM DB2 and shipped with IBM InfoSphere BigInsights. (CVE-2015-7420, CVE-2015-7421, CVE-2016-0201)

Summary Security vulnerabilities have been identified in GSKIT and/or GSKit Crypto and Fork that are integrated with IBM DB2 and shipped with IBM InfoSphere BigInsights. Information about security vulnerabilities affecting GSKIT/ Crypto and Fork has been published in a security bulletin...

CVE-2021-20445

IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621...

Design/Logic Flaw

IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621...

CVE-2021-20445

IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621...

CVE-2021-20445

CVE-2021-20445 affects IBM Maximo for Civil Infrastructure 7.6.2. The vulnerability stems from insecure storage of authentication credentials, potentially allowing a user to obtain sensitive information. The issue is documented across multiple sources (NVD entry for the CVE and IBM bulletin) and ...

PT-2021-13970

Name of the Vulnerable Software and Affected Versions: IBM Maximo for Civil Infrastructure version 7.6.2 Description: The issue allows a user to obtain sensitive information due to insecure storage of authentication credentials. Recommendations: For IBM Maximo for Civil Infrastructure version...

IBM Maximo for Civil Infrastructure 信息泄露漏洞

IBM Maximo for Civil Infrastructure integrates inspection, defect tracking and maintenance activities to help organizations improve asset life, keep critical systems up and running and reduce the total cost of ownership of civil infrastructure. An information disclosure vulnerability exists in IB...

CVE-2021-20445

IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621...

CVE-2021-27187

The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked...

CVE-2021-27187

The FX Aggregator terminal client 1 from Sovremennye Delovye Tekhnologii stores authentication credentials in cleartext in login.sav when the Save Password box is checked. Affected item: login credential storage within the client. Root cause: credentials are kept unencrypted in a local file. Impa...

PT-2021-17306

Name of the Vulnerable Software and Affected Versions: Sovremennye Delovye Tekhnologii FX Aggregator terminal client version 1 Description: The issue concerns the storage of authentication credentials in cleartext in the login.sav file when the Save Password box is checked. This affects the...