Security Bulletin: IBM Cloud Manager with OpenStack is affected by a OpenSSL vulnerabilities

Summary Multiple security vulnerabilities have been identified in OpenSSL that is used by IBM Cloud Manager with OpenStack. IBM Cloud Manager with OpenStack has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3735 DESCRIPTION: OpenSSL could allow a remote attacker to obtain...

Security Bulletin: Vulnerability in SSLv3 affects IBM Cloud Manager with OpenStack (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SmartCloud Entry. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple security vulnerabilities in dnsmasq affect IBM Cloud Manager with OpenStack

Summary Multiple security vulenrability have been identified in dnsmasq that is used by IBM Cloud Manager with OpenStack. IBM Cloud Manager with OpenStack has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-14495 DESCRIPTION: dnsmasq is vulnerable to a denial of service, caus...

Security Bulletin: Malformed ECParameters causes infinite loop (CVE-2015-1788)

Summary IBM Cloud Manager with Openstack is vulnerable to a denial of service which could allow a remote attacker to expoit this vulnerability to cause the application to enter into an infinite loop. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of...

Security Bulletin: Multiple security vulnerabilities in IBM Cloud Manager with OpenStack affect IBM Cloud Orchestrator and Cloud Orchestrator Enterprise

Summary IBM Cloud Manager with OpenStack is shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise. Multiple security vulnerabilities have been identified in dnsmasq that is used by IBM Cloud Manager with OpenStack. Information about a security vulnerability affecting IBM Cloud...

Security Bulletin: Vulnerability in OpenSSL affects IBM Cloud Orchestrator, HTTP Server and bundling products shipped with Cloud Orchestrator and Cloud Orchestrator Enterprise (CVE-2015-1788)

Summary Denial of Service vulnerability has been identified in OpenSSL. IBM Cloud Orchestrator® and IBM Cloud Orchestrator Enterprise Edition have addressed this issue. This issue was also addressed by IBM Cloud Manager with OpenStack, IBM HTTP Server, and IBM DB2® LUW which are shipped with IBM...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise, and products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Cloud Orchestrator, IBM Cloud Orchestrator Enterprise and supporting products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerability Details CVEID:...

Security Bulletin: Security vulnerability in IBM Business Process Manager shipped with IBM SmartCloud Orchestrator and IBM Cloud Orchestrator (CVE-2014-8730)

Summary IBM Business Process Manager and DB2 Enterprise Server Edition are shipped as components of IBM SmartCloud Orchestrator and IBM Cloud Orchestrator. Information about a security vulnerability CVE-2014-8730 affecting both IBM Business Process Manager and IBM DB2 has been published in a...

Unrestricted file upload

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file...

Oracle Java SE CVE-2015-2590 Remote Security Vulnerability

Description Oracle Java SE is prone to a remote security vulnerability. The vulnerability can be exploited over multiple protocols. This issue affects the 'Libraries' sub-component. This vulnerability affects the following supported versions: Java SE 6u95, Java SE 7u80, Java SE 8u45, Java SE...

CVE-2014-5641

The Cloud Manager aka com.ileaf.cloudmanager application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Cloud Manager aka com.ileaf.cloudmanager application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5641

The Cloud Manager aka com.ileaf.cloudmanager application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5641

CVE-2014-5641 affects the Cloud Manager (com.ileaf.cloud_manager) Android app v1.6. The vulnerability is due to failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive data via a crafted certificate. Documented impact is ex...

ZDI-11-278: Novell Cloud Manager Insufficient Framework User Validation Vulnerability

ZDI-11-278: Novell Cloud Manager Insufficient Framework User Validation Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-278 September 2, 2011 -- CVE ID: CVE-2011-2654 -- CVSS: 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell eDirectory --...

Cloud Manager unaurhozied access

Insufficient authentication in RPC-based service...

CVE-2011-2654

The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session...

Session fixation

The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session...

CVE-2011-2654

The CVE-2011-2654 issue affects Novell Cloud Manager 1.1.2 prior to Patch 3. The RPC server fails to properly initialize objects, enabling remote attackers to execute arbitrary code by issuing privileged RPC calls tied to a partially initialized session. Impact is high (remote code execution with...

CVE-2011-2654

The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session...