Security Bulletin: Security configurations for Rest servers in XSLD

Summary These security vulnerabilities were found during Dynamic scans performed on XSLD 8.6.1.6. Please follow the remediation given to resolve these issues. Vulnerability Details 1 Unnecessary Http Response Headers found in the Application. Description : The response contains unnecessary header...

PT-2023-25393 · Unknown · @Fastify/Oauth2

Name of the Vulnerable Software and Affected Versions: @fastify/oauth2 versions prior to 7.2.0 Description: The issue is related to cross-site request forgery CSRF due to the use of a statically generated state parameter across all requests for all users. This parameter should be unique per user...

CVE-2023-28472

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies...

CVE-2022-22493

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449...

PT-2022-15471 · Ibm · Ibm Websphere Automation For Ibm Cloud Pak For Watson Aiops

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation for Cloud Pak for Watson AIOps version 1.4.2 Description: The issue is related to cross-site request forgery, caused by improper cookie attribute setting. Recommendations: For IBM WebSphere Automation for Cloud Pak fo...

Cross-Site Request Forgery (CSRF) in admidio/admidio

✍️ Description Attacker able to delete any photo of a user with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...

IBM Security Guardium Data Encryption (GDE) Information Disclosure Vulnerability (CNVD-2020-49938)

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. An information disclosure vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which stems...

IBM WebSphere Commerce Information Disclosure Vulnerability (CNVD-2018-22087)

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. A security vulnerability exists in IBM WebSphere Commerce that stems from the program'...

The vulnerability of the Hawtio web console in the Apache ActiveMQ software platform allows a malicious actor to reuse the session identifier of an authenticated user.

The vulnerability of the Hawtio web console in the Apache ActiveMQ software platform stems from the lack of setting the HTTPOnly or Secure attributes for cookie files. Exploiting this vulnerability allows a malicious actor to repeatedly use the authenticated user’s session identifier remotely...

CVE-2017-1228

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable the secure cookie attribute. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

Red Hat JBoss A-MQ Hawtio console security bypass vulnerability

Red Hat JBoss A-MQ is an open source messaging platform from Red Hat, Inc. that integrates applications and devices and provides various messaging modes to support real-time messaging. The platform is used to integrate applications , endpoints and devices , and provides a variety of messaging...

PHP <= 5.2.3 EXT/Session HTTP Response Header Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24268/info PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to inject additional cookie attributes into session cookies...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3978)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3979)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

PHP 5.2.3 - EXT/Session HTTP Response Header Injection

source: https://www.securityfocus.com/bid/24268/info PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to inject additional cookie attributes into session cookies. This may lead to other attacks. Th...