CVE-2021-38967

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441...

Information disclosure

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215...

CVE-2021-38967

CVE-2021-38967 affects IBM MQ Appliance (9.2 CD and 9.2 LTS). A vulnerability allows a local privileged user to inject and execute malicious code due to a code-injection flaw. The IBM Security Bulletin references APAR IT38788 as remediation. Possible mitigations include upgrading to IBM MQ Applia...

CVE-2021-38958

CVE-2021-38958 affects IBM MQ Appliance 9.2 CD and 9.2 LTS. The issue is a denial-of-service caused by a concurrency flaw in the appliance, leading to an availability impact. The vulnerability is documented with CVSS metrics (base score 5.5 in CVSS 3.1 with LOCAL, LOW complexity, HIGH availabilit...

CVE-2021-39000: Exposure of Sensitive Information to an Unauthorized Actor

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. IBM X-Force ID: 213215...

CVE-2021-38958: Undefined Security Weakness

IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. IBM X-Force ID: 212042...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2021-38958)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2021-38958 DESCRIPTION: IBM MQ Appliance is affected by a denial of service attack caused by a concurrency issue. CVSS Base score: 5.1 CVSS Temporal Score: See:...

Security Bulletin: IBM MQ Appliance is affected by a disclosure of sensitive information vulnerability (CVE-2021-39000)

Summary IBM MQ Appliance has resolved a disclosure of sensitive information vulnerability. Vulnerability Details CVEID: CVE-2021-39000 DESCRIPTION: IBM MQ could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnostics. CVSS Base score: 5.9 CVSS...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

Security Bulletin: IBM MQ Java/JMS clients can inadvertently display cleartext credentials via diagnostic logs (CVE-2021-38949)

Summary An issue was idenitifed in IBM MQ Java and JMS clients where they could display clear text credentials in diagnostics log files automatically generated during system crashes. Vulnerability Details CVEID: CVE-2021-38949 DESCRIPTION: IBM MQ stores user credentials in plain clear text which...

CVE-2021-29843: Undefined Security Weakness

IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203...

Kingdia CD Extractor 3.0.2 Buffer Overflow

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Date: 31.10.2021 Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt...

Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH)

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Date: 31.10.2021 Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-91184)

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.GitLab CE/EE is vulnerable to a cross-site scripting vulnerability that could b...

Kingdia CD Extractor 3.0.2 - Buffer Overflow (SEH) Exploit

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt and copy All...

Workshop: Visibility Into Open Source Code

Learn how to leverage Trend Micro Cloud One - Open Source Security by Snyk with your code repositories and CI/CD pipelines to scan projects. Resulting in better visibility, tracking, and early awareness into open source issues...

Workshop: Visibility Into Open Source Code

Learn how to leverage Trend Micro Cloud One - Open Source Security by Snyk with your code repositories and CI/CD pipelines to scan projects. Resulting in better visibility, tracking, and early awareness into open source issues...

Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD

GoCD, written in Java, is a popular CI/CD solution with a large range of users from NGOs to Fortune 500 companies with billions of dollars in revenue. Naturally, this makes it a critical piece of infrastructure and an extremely attractive target for attackers. In order to automate build and relea...

How to Add Multiple CD or DVD Drives to XenServer Virtual Machines

This article describes how to add more than one CD/DVD drive to a Virtual Machine VM...

Security Bulletin: Vulnerability in the IBM Installation Manager script (CVE-2015-7442)

Summary IBM Installation Manager "consoleinst.sh" script is subject to a vulnerability that may allow a local user to obtain administrative access. Vulnerability Details CVEID: CVE-2015-7442 DESCRIPTION: There is a "/tmp" race condition in IBM's Installation Manager "consoleinst.sh" script that...