Security Bulletin: Multiple Security Vulnerabilities have been addressed in LMS 6.0 on Cloud

Summary Multiple Security Vulnerabilities have been addressed in LMS 6.0 on Cloud Vulnerability Details CVEID: CVE-2016-5938 DESCRIPTION: IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. CVSS Base Score: 4 CVSS Temporal Score: See...

Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection(CVE-2017-1175)

Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1175 DESCRIPTION: IBM Maximo...

Security Bulletin: IBM Atlas eDiscovery Process Management vulnerable to SQL injection.

Summary Atlas eDiscovery Process Management has addressed vulnerablility due to SQL injection, where a remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID:...

Security Bulletin:IBM Security Key Lifecycle Manager is affected by SQL injection (CVE-2017-1670 )

Summary IBM Security Key Lifecycle Manager is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1670 DESCRIPTION: IBM...

Security Bulletin: SQL Injection vulnerability affects IBM Security Guardium (CVE-2017-1269)

Summary A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-1269 DESCRIPTION: IBM Security Guardi...

Error: "Cannot Complete Your Request" Due to Call Back URL Misconfiguration on StoreFront

The following error is displayed due to call back URL misconfiguration on StoreFront: Cannot Complete Your Request...

Sql injection

RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malicious user with low privileges could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain...

Liberapay: Missing back-end user input validation can lead to DOS flaw

Hello Team, Usually such kind of reports are out of scope, however I still would like to report you the business logic weakness that should be eliminated, at least from my point of view. Due to missing user input validation it is can lead to application unavailability. Details: During brief revie...

Design/Logic Flaw

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara...

This Week in Security News: ePrivacy and Hack Back

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, the Council of the European Union reviewed a bill dubbed the “ePrivacy” Regulation, which targets message-sharing services like WhatsApp and...

CVE-2018-11413

BearAdmin 0.5 is affected by CVE-2018-11413. A remote attacker can trigger directory traversal via /admin/databack/download.html?name=, e.g., name=../application/database.php, to read configuration credentials (MySQL) from the server. Affected component: databack/download.html handling of the nam...

Why tech companies wanted Senate Bill 315 vetoed

When Georgia Senate Bill 315 SB-315 was introduced, people in the tech world anxiously awaited its fate, regardless of their geographic location. They knew that some laws initially restricted to single states become more widespread after politicians set precedents. And they knew that this law cou...

Oracle Retail Applications Retail Back Office Component Unauthorized Operation Vulnerability

Oracle Retail Applications is a suite of retail applications store solutions from Oracle Corporation, of which Retail Back Office is a retail back office component that provides retailers with real-time access to storage management and reporting capabilities. A security vulnerability exists in th...

Georgia Governor Vetoes Controversial Hack-Back Bill

Recognizing the concerns of tech giants and security researchers alike, Georgia Gov. Nathan Deal has vetoed a controversial “hack-back” bill that would have allowed companies in the state to perform offensive cyber-actions in the face of an attack. “Certain components of the legislation have led ...

Hacktivists, Tech Giants Protest Georgia’s ‘Hack-Back’ Bill

As Georgia Governor Nathan Deal considers whether to sign a controversial piece of legislation that would allow companies to “hack back” with offensive initiatives in the face of a cyberattack, companies from across the tech spectrum are lining up to protest the measure. Also, a hacktivist group...

CVE-2017-1722

IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 134811...

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2018-2861

CVE-2018-2861 affects Oracle Retail Back Office (Security subcomponent) in Oracle Retail Applications for versions 13.4.9, 14.0.4, and 14.1.3. The vulnerability allows an unauthenticated attacker with network access via HTTP to read a subset of data and cause a partial denial of service. The issu...

CVE-2018-2861

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.4.9, 14.0.4 and 14.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...