Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities

Summary IBM Data Risk Manager has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2021-20227 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by a use-after-free flaw in the SELECT query function in src/select.c. By sending a specially-crafted request, a...

openSUSE 15 Security Update : curl (openSUSE-SU-2021:3298-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3298-1 advisory. - A user can tell curl = 7.20.0 and = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to...

Fortinet FortiManager VM和FortiAnalyzerVm 信息泄露漏洞

Fortinet FortiManager VM is a centralized network security management platform for virtual machines. FortiAnalyzer Vm is a virtual machine that provides the ability to group devices into different management domains ADOMs for security deployment and management. FortiAnalyzer Vm is a virtual machi...

Bosch Rexroth IndraMotion Mlc 授权问题漏洞

Bosch Rexroth IndraMotion Mlc is a new device that combines motion and logic control, as well as robotics control.A security vulnerability exists in Bosch Rexroth IndraMotion Mlc, which stems from a network system or product that does not properly use the relevant cryptographic algorithms, and...

CVE-2021-41302

ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...

Default credentials

ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...

CVE-2021-41302

CVE-2021-41302 affects ECOA BAS controller family (ECS Router Controller - ECS (FLASH); RiskBuster Terminator - E6L45; RiskBuster System RB 3.0.0; TRANE 1.0; Graphic Control Software; SmartHome II - E9246; RiskTerminator). The issue is that backup exports and other sensitive data are stored in cl...

CVE-2021-41302

ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...

Ecoa Bas controller 安全漏洞

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp in China. Ecoa Bas controller is vulnerable to an access control error, which can be exploited by attackers to compromise administrative account credentials in clear text to cause privilege escalation...

PT-2021-23257 · Unknown · Ecoa Bas Controller

Name of the Vulnerable Software and Affected Versions: ECOA BAS controller affected versions not specified Description: The ECOA BAS controller stores sensitive data, including backup exports, in clear-text. This allows an unauthenticated attacker to remotely query user passwords and obtain user...

Ricon Industrial Cellular Router S9922L 安全漏洞

Ricon Mobile Ricon Industrial Cellular Router S9922L is a mobile network router based on 4G/4.5G, WiFi and Vpn technology from Ricon Mobile Canada. It is used in intelligent transportation, Scada, Pos, industrial automation, telemetry, finance, environmental protection and many other fields. A...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in kcal-app/kcal

Description Implement both Secure flag and httponly flag in the application. Proof of Concept Impact The secure flag is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure flag is to prevent cookies from bein...

Exchange/Outlook Autodiscover Bug Spills $100K+ Email Passwords

Guardicore security researcher Amit Serper has discovered a severe design bug in Microsoft Exchange’s autodiscover – a protocol that lets users easily configure applications such as Microsoft Outlook with just email addresses and passwords. The flaw has caused the Autodiscover service to leak...

CVE-2021-29904

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbusGUI displays user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 207610...

CVE-2021-38863

IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. IBM X-Force ID: 208154...

CVE-2021-20434

IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 196346...

CVE-2021-38863

IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. IBM X-Force ID: 208154...

Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Bridge (CVE-2021-20434, CVE-2021-38864, CVE-2021-20435)

Summary Multiple vulnerabilities fixed in IBM Security Verify Bridge Vulnerability Details CVEID: CVE-2021-20434 DESCRIPTION: IBM Security Verify Bridge stores user credentials in plain clear text which can be read by a local user. CVSS Base score: 4.1 CVSS Temporal Score: See:...

clear-diamond.com Cross Site Scripting vulnerability OBB-2147245

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

clear-institute.org Cross Site Scripting vulnerability OBB-2147246

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...