CVE-2019-4133

IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side with access to client computer to run a custom script. IBM X-Force ID: 158278...

CVE-2019-4132

IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274...

Information disclosure

IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274...

Design/Logic Flaw

IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side with access to client computer to run a custom script. IBM X-Force ID: 158278...

CVE-2019-4133

IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side with access to client computer to run a custom script. IBM X-Force ID: 158278...

CVE-2019-4133

CVE-2019-4133 affects IBM Cloud Automation Manager 3.1.2. The concurrent documents confirm a client-side attacker with access to the user’s machine could execute a custom script due to an insecure Content-Security-Policy header. Exploitation details are not provided beyond this, but the IBM secur...

CVE-2019-4132

IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274...

PT-2019-16913 · Ibm · Ibm Cloud Automation Manager

Name of the Vulnerable Software and Affected Versions: IBM Cloud Automation Manager version 3.1.2 Description: The issue could allow a user to be improperly redirected and obtain sensitive information rather than receive a 404 error message. Recommendations: For IBM Cloud Automation Manager versi...

PT-2019-16914 · Ibm · Ibm Cloud Automation Manager

Name of the Vulnerable Software and Affected Versions: IBM Cloud Automation Manager version 3.1.2 Description: The issue allows a malicious user on the client side, with access to the client computer, to run a custom script. Recommendations: For IBM Cloud Automation Manager version 3.1.2, conside...

IBM Cloud Automation Manager Script Injection Vulnerability

IBM Cloud Automation Manager is a multi-cloud self-service management platform from IBM USA. The platform supports the deployment of cloud infrastructure in multiple clouds. A script injection vulnerability exists in IBM Cloud Automation Manager version 3.1.2, which can be exploited by an attacke...

IBM Cloud Automation Manager Redirection Vulnerability

IBM Cloud Automation Manager is a multi-cloud self-service management platform from IBM USA. The platform supports the deployment of cloud infrastructure in multiple clouds. A redirection vulnerability exists in IBM Cloud Automation Manager version 3.1.2. The vulnerability stems from a redirectio...

Security Bulletin: IBM Cloud Automation Manager is affected by a insecure Content-Security-Policy header vulnerability CVE-2019-4133

Summary IBM Cloud Automation Manager could allow a malicious user on the client side with access to client computer to run a custom script. Vulnerability Details CVEID: CVE-2019-4133 DESCRIPTION: IBM Cloud Automation Manager could allow a malicious user on the client side with access to client...

Security Bulletin: IBM Cloud Automation Manager is affected by a forbidden resouce redirect for bad API path CVE-2019-4132

Summary IBM Cloud Automation Manager will redirect when a bad API path is requested rather than issuing a 404. User may expect an error but be redirected to a home page instead. Vulnerability Details CVEID: CVE-2019-4132 DESCRIPTION: IBM Cloud Automation Manager could allow a user to be impropert...

Security Bulletin: IBM Cloud Automation Manager is affected by an issue with API endpoints behind the 'docker cp'

Summary IBM Cloud Automation Manager is affected by an issue with docker cp command that is vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges. Vulnerability Details CVEID: CVE-2018-15664...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Python

Summary IBM Cloud Private, Cloud Foundry for IBM Cloud Private and IBM Cloud Automation Manager are vulnerable to a security vulnerability in Python Vulnerability Details CVEID: CVE-2018-14647 DESCRIPTION: Python is vulnerable to a denial of service, caused by a flaw in the elementtree C...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private - Node.js

Summary IBM Cloud Private, Cloud Foundry for IBM Cloud Private and IBM Cloud Automation Manager are vulnerable to multiple security vulnerabilities in Node.js Vulnerability Details CVEID: CVE-2018-12122 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by improper validation of HT...

Security Bulletin: Multiple Security Vulnerabilities affect IBM Cloud Private (CVE-2018-1060, CVE-2018-1061)

Summary IBM Cloud Private and IBM Cloud Automation Manager component are vulnerable to multiple security vulnerabilities Vulnerability Details CVEID: CVE-2018-1060 DESCRIPTION: Python is vulnerable to a denial of service, caused by catastrophic backtracking in the pop3lib's apop method. A remote...

Security Bulletin: IBM Cloud Private has released a patch in response to the vulnerabilities known as Spectre and Meltdown(CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754)

Summary On Wednesday, January 3, 2018, researchers announced a security vulnerability known as Spectre and Meltdown. These security vulnerabilities are being tracked across three security advisories: CVE-2017-5753, CVE-2017-5715, CVE-2017-5754. Additional details can be found at this link. IBM ha...

Qualys: Cloud Security Must Move Towards ‘Transparent Orchestration’

What does the “My Little Pony” television series and cyber security have in common? Ask Qualys Chief Product Officer Sumedh Thakar. Whenever his 7-year old daughter wanted to see an episode of this show, the process involved multiple steps: Turning on the smart TV, scrolling through the app menu,...

Cisco Prime Network Services Controller Arbitrary Command Execution Vulnerability

Cisco Prime Network Services Controller is a set of cloud automation network management software from Cisco Cisco. An arbitrary command execution vulnerability exists in Cisco Prime Network Services Controller 3.0. It allows a local user to bypass predefined access restrictions and execute...