CVE-2019-4731

IBM MQ Appliance vulnerability CVE-2019-4731 allows a local attacker to obtain highly sensitive information by including sensitive data in traces. Affected: IBM MQ Appliance 9.1.4 CD. Root cause: information disclosure via trace data. Impact: partial confidentiality loss; no integrity/availabilit...

CVE-2020-4498

IBM MQ Appliance 9.1 LTS and 9.1 CD are affected by CVE-2020-4498, an information-disclosure vulnerability caused by inclusion of data in trace files. A local privileged user can obtain highly sensitive information from trace output. Remediation: upgrade IBM MQ Appliance to 9.1 LTS with fixpack 9...

Security Bulletin: IBM MQ Appliance is vulnerable to a buffer overflow vulnerability (CVE-2020-4465)

Summary IBM MQ Appliance has resolved a buffer overflow vulnerability. Vulnerability Details CVEID: CVE-2020-4465 DESCRIPTION: IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop are vulnerable to a buffer overflow vulnerability due to an error within the channel processing code. A remote attack...

IBM MQ Appliance Information Disclosure Vulnerability

The IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM USA. An information disclosure vulnerability exists in IBM MQ Appliance version 9.1 LTS and version 9.1 CD. A local attacker could exploit this vulnerability to obtain highly...

Free MP3 CD Ripper 2.8 - Stack Buffer Overflow (SEH + Egghunter) Exploit

Exploit Title: Free MP3 CD Ripper 2.8 - Stack Buffer Overflow SEH + Egghunter Exploit Author: Eduard Palisek Vendor Homepage: https://www.cleanersoft.com Software Link: https://www.cleanersoft.com/download/FMCRSetup.exe Version: 2.8 Build 20140611 Tested on: Windows XP, Professional, Version 2002...

Security Bulletin: IBM Connect:Direct for UNIX is Vulnerable to a Privilege Escalation Attack via its C/C++ API

Summary IBM Sterling Connect:Direct for UNIX could allow a user who is authorized for limited Connect:Direct privileges to attack through a custom application written using the Connect:Direct for UNIX C/C++ API by replacing the system implementation of getuid with a malicious implementation and...

Security Bulletin: Multiple Security Vulnerabilities in IBM MQ Affect IBM Sterling B2B Integrator

Summary IBM Sterilng B2B Integrator has addressed multiple security vulnerabilities in IBM MQ Vulnerability Details CVEID: CVE-2019-4619 DESCRIPTION: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion o...

Security Bulletin: IBM MQ Appliance is affected by an information disclosure vulnerability (CVE-2018-20852)

Summary IBM MQ Appliance has resolved an information disclosure vulnerability. Vulnerability Details CVEID: CVE-2018-20852 DESCRIPTION: Python could allow a remote attacker to obtain sensitive information, caused by the failure to correctly validate the domain by...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2019-13232)

Summary IBM MQ Appliance has addressed the following denial of service vulnerability. Vulnerability Details CVEID: CVE-2019-13232 DESCRIPTION: Info-ZIP UnZip is vulnerable to a denial of service, caused by mishandling the overlapping of files inside a ZIP container. By persuading a victim to open...

Security Bulletin: IBM MQ Appliance is affected by a buffer overflow vulnerability (CVE-2015-2716)

Summary IBM MQ Appliance has resolved a buffer overflow vulnerability. Vulnerability Details CVEID: CVE-2015-2716 DESCRIPTION: Expat, as used in Mozilla Firefox and Thunderbird, is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser. By persuading a victim to ope...

Security Bulletin: IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2019-1551)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x6464 Montgomery squaring procedure used in exponentiation with...

SUSE SLES12 Security Update : systemd (SUSE-SU-2020:1842-1)

This update for systemd fixes the following issues : CVE-2019-20386: Fixed a memory leak when executing the udevadm trigger command bsc1161436. Renamed the persistent link for ATA devices bsc1164538 shared/install: try harder to find enablement symlinks when disabling a unit bsc1157315 tmpfiles:...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2211

CVE-2020-2211 affects Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin (versions ≤ 1.3). The root cause is that the YAML parser is not configured to prevent instantiation of arbitrary types, enabling remote code execution. The CVE entry notes a questionable attack surface but does not provide e...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Add Ergonomic Security to Your CI/CD Pipeline

Wikipedia defines ergonomics as “the application of psychological and physiological principles to the engineering and design of products, processes, and systems. The goal … is to reduce human error, increase productivity, and enhance safety and comfort with a specific focus on the interaction...

How to Secure DevOps in Microsoft Azure

Want to establish best practices within Microsoft Azure? Learn how to integrate a Secure DevOps Kit for Azure AzSK at the subscription level, as well as in your development process during coding, CI/CD pipeline, and future alerting and reporting...

Code Injection in strider-cd/strider-git

Overview strider-git allows strider to use any git repository for a project. he issue occurs because a user input is formatted inside a command that will be executed without any check...

Security Bulletin: IBM MQ AMQP channels fail to block connections restricted by SSLPEER setting (CVE-2020-4320)

Summary An error was found within the SSLPEER logic within a AMQP channel that meant it would not block/allow certificates as expected. Vulnerability Details CVEID: CVE-2020-4320 DESCRIPTION: IBM MQ Appliance, IBM MQ, AMQP Channels do not correctly block or allow clients based on the certificate...