Security Bulletin: IBM Cloud Private is Vulnerable to Reflected Cross-Site Scripting attacks (CVE-2019-4120)

Summary IBM Cloud Private is vulnerable to reflected cross-site scripting attacks. Vulnerability Details CVEID: CVE-2019-4120 DESCRIPTION: IBM Cloud Private is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM MQ Appliance potential execution of arbitrary commands (CVE-2017-1318)

Summary There is potential for an authenticated messaging administrator to execute arbitrary commands on the IBM MQ Appliance. Vulnerability Details CVEID: CVE-2017-1318 DESCRIPTION: IBM MQ Appliance could allow an authenticated messaging administrator to execute arbitrary commands on the system,...

Security Bulletin: IBM MQ Appliance is affected by a GNU C library (glibc) vulnerability (CVE-2017-8804)

Summary IBM MQ Appliance has addressed a vulnerability in GNU C library glibc. Vulnerability Details CVEID: CVE-2017-8804 DESCRIPTION: glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdrbytes and xdrstring functions. By sending a...

Security Bulletin: Vulnerability in system log on IBM MQ Appliance WebGUI (CVE-2017-1591)

Summary A potential cross-site scripting vulnerability exists in the IBM MQ Appliance system log. IBM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1591 DESCRIPTION: IBM WebSphere DataPower Appliances 7.0.0 through 7.6 and IBM MQ Appliances are vulnerable to cross-site...

Security Bulletin: IBM MQ Appliance is affected by a Network Security Services (NSS) vulnerability (CVE-2017-7805)

Summary IBM MQ Appliance has addressed a vulnerability in Network Security Services NSS. Vulnerability Details CVEID: CVE-2017-7805 DESCRIPTION: Network Security Services could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in TLS 1.2 generating...

Security Bulletin: IBM MQ Appliance is affected by OpenSSH vulnerabilities

Summary IBM MQ Appliance has addressed vulnerabilities in OpenSSH. Vulnerability Details CVEID: CVE-2016-10009 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the loading of a specially crafted PKCS11 module across a forwarded...

Security Bulletin: Vulnerability in OpenSSL affects IBM MQ Appliance (CVE-016-8610)

Summary There is a vulnerability in OpenSSL used by IBM MQ Appliance. IBM MQ Appliance has addressed the vulnerability. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: The SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets during a SSL...

Security Bulletin: IBM MQ Appliance is affected by a cross-site scripting vulnerability (CVE-2018-1429).

Summary IBM MQ Appliance has addressed a Web UI cross-site scripting vulnerability. Vulnerability Details CVEID: CVE-2018-1429 DESCRIPTION: IBM MQ Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Osmedeus v1.5 - Fully Automated Offensive Security Framework For Reconnaissance And Vulnerability Scanning

Osmedeus allows you automated run the collection of awesome tools to reconnaissance and vulnerability scanning against the target. Installation git clone https://github.com/j3ssie/Osmedeus cd Osmedeus ./install.sh This install only focus on Kali linux, check more install on Wiki page How to use I...

nss and nspr security, bug fix, and enhancement update

nspr 4.21.0-2 - Rebuild 4.21.0-1 - Update to NSPR 4.21 nss 3.44.0-7 - Backport fixes from 3.44.1 3.44.0-6 - Add continuous RNG test required by FIPS - fipstest: use CKMTLS12MASTERKEYDERIVE instead of vendor specific mechanism 3.44.0-5 - Rebuild with the correct build target 3.44.0-4.1 - rebuild t...

Security Bulletin: IBM MQ Appliance affected by an OpenSSH vulnerability (CVE-2019-6110)

Summary IBM MQ Appliance has addressed the following OpenSSH vulnerability. Vulnerability Details CVEID: CVE-2019-6110 DESCRIPTION: OpenSSH could allow a remote attacker to conduct spoofing attacks, caused by accepting and displaying arbitrary stderr output from the scp server. A man-in-the-middl...

Security Bulletin: IBM MQ Appliance is affected by an OpenSSL vulnerability (CVE-2019-1559)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a...

Security Bulletin: IBM Cloud Private ingress log files contain sensitive information (CVE-2019-4284)

Summary IBM Cloud Private ingress log files contain sensitive information Vulnerability Details CVEID: CVE-2019-4284 DESCRIPTION: IBM Cloud Private could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as anoth...

Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

An update for nss and nspr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Security Bulletin: IBM Cloud Private - Session not invalidated on logout (CVE-2019-4439)

Summary IBM Cloud Private - Session not invalidated on logout CVE-2019-4439 Vulnerability Details CVEID: CVE-2019-4439 DESCRIPTION: IBM Cloud private does not invalidate session after logout which could allow a local user to impersonate another user on the system. CVSS Base Score: 5.9 CVSS Tempor...

Crestron DGE-100 Continuous Name Change Denial of Service

Binary data 720268.prm...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Kubernetes (CVE-2019-11246)

Summary A Security Vulnerability affects IBM Cloud Private - Kubernetes CVE-2019-11246 Vulnerability Details CVEID: CVE-2019-11246 DESCRIPTION: Kubernetes could allow a remote attacker to traverse directories on the system. By persuading a victim to use the kubectl cp command with a malicious...

caliper-ci stores credentials in plain text

caliper-ci stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

JetBrains TeamCity suffers from an input validation error vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An input validation error vulnerability exists in...

Denial of Service Vulnerability in Omron CJ2M-CPU31

CJ2M-CPU31 is a programmable logic controller PLC A denial of service vulnerability exists in the Omron CJ2M-CPU31, which can be exploited by an attacker to cause CPU resource exhaustion by sending specific packets to the target PLC on a continuous basis...