Security Bulletin: IBM Security Network Protection is affected by multiple vulnerabilities

Summary Multiple security vulnerabilities CVE-2018-1426, CVE-2018-1427, CVE-2018-1428, CVE-2017-3736, CVE-2017-3732, CVE-2016-0705, and CVE-2018-1447 have been discovered in GSKit used with IBM Security Network Protection. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is...

Security Bulletin: IBM Security Guardium is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability (CVE-2017-1255)

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1255 DESCRIPTION: IBM Security Guardium uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Score: 5.9 CVSS...

Security Bulletin: IBM Security Access Manager Appliance is affected by an encryption vulnerability (CVE-2017-1473)

Summary IBM Security Access Manager Appliance has addressed the following weak encryption vulnerability. Vulnerability Details CVEID: CVE-2017-1473 DESCRIPTION: IBM Security Access Manager Appliance uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly...

Security Bulletin: IBM Security Key Lifecycle Manager uses indeaquate encryption strength algorithms (CVE-2017-1665)

Summary IBM Security Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Vulnerability Details CVEID: CVE-2017-1665 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic...

Security Bulletin: IBM Security Key Lifecycle Manager uses broken or risky cryptographic algorithm (CVE-2017-1664)

Summary IBM Security Key Lifecycle Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Vulnerability Details CVEID: CVE-2017-1664 DESCRIPTION: IBM Tivoli Key Lifecycle Manager uses weaker than expected cryptographic...

Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Use of a Broken or Risky Cryptographic Algorithm vulenrability (CVE-2017-1598)

Summary IBM Security Guardium Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM Security Guardium Database Activity Monitor has fixed this vulenrability Vulnerability Details CVEID: CVE-2017-1598...

Security Bulletin: Multiple Security vulnerabilities fixed in IBM Security Privileged Identity Manager

Summary There are multiple Security vulnerabilities that are fixed in the IBM Security Privileged Identity Manager Vulnerability Details CVEID: CVE-2016-5957 DESCRIPTION: IBM Security Privileged Identity Manager uses weaker than expected cryptographic algorithms that could allow an attacker to...

Security Bulletin: IBM QRadar SIEM uses broken or risky cryptographic algorithms (CVE-2016-2879)

Summary The software uses an outdated insecure cipher or it is using a proprietary crypto standard which is likely to be vulnerable. Outdated/broken algorithms are MD4, MD5, SHA1, DES, ECB, RC4, Export ciphers, SSLv2, SSLv3, DH using keys less than 1024 Vulnerability Details CVEID: CVE-2016-2879...

Security Bulletin: IBM Security Access Manager appliances are affected by a potential information exposure vulnerability (CVE-2016-5919)

Summary IBM Security Access Manager appliances use weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. Vulnerability Details CVEID: CVE-2016-5919 DESCRIPTION: IBM Security Access Manager for Web uses weaker than expected cryptographic...

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Privileged Identity Manager

Summary Multiple Security Vulnerabilities were fixed in IBM Security Privileged Identity Manager ISPIM Vulnerability Details CVEID: CVE-2016-5963 DESCRIPTION: IBM Security Privileged Identity Manager Virtual Appliance processes patches, image backups and other updates without sufficiently verifyi...

Security Bulletin: Use of Hard-coded Cryptographic Key vulenrability affects IBM Security Guardium Database Activity Monitor (CVE-2016-0235)

Summary IBM Security Guardium Database Activity Monitor uses a hard-coded password for the which is available to the administrator or a user with root access. This password could be used across other GRUB systems. Vulnerability Details CVEID: CVE-2016-0235 DESCRIPTION: IBM Security Guardium...

[ASA-201806-10] libgcrypt: private key recovery

Arch Linux Security Advisory ASA-201806-10 ========================================== Severity: High Date : 2018-06-16 CVE-ID : CVE-2018-0495 Package : libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-719 Summary ======= The package libgcrypt before...

Security Bulletin: API Connect is affected by weaker than expected cryptographic algorithm usage vulnerability (CVE-2018-1385)

Summary API Connect has addressed the following vulnerability. IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Vulnerability Details CVEID: CVE-2018-1385 DESCRIPTION: IBM API Connect uses weaker than expected...

USN-3675-2: GnuPG 2 vulnerability

USN-3675-1 fixed a vulnerability in GnuPG 2 for Ubuntu 18.04 LTS and Ubuntu 17.10. This update provides the corresponding update for GnuPG 2 in Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. Original advisory details: Marcus Brinkmann discovered that during decryption or verification, GnuPG did not...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : GnuPG vulnerabilities (USN-3675-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3675-1 advisory. Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when...

Don’t Be a Coinmining Zombie – Part 1: Getting Cryptojacked

When your computer or mobile device and now, even your IoT device is hijacked to secretly mine cryptocurrencies, it’s been cryptojacked and becomes a coinmining zombie. Its CPU, memory, disk, and power are enlisted in varying degrees in the service of the mining botnet, which labors on behalf of...

Insecure Number Generator

libxslt.so is vulnerable to insecure number generation. The library does not use a random seed during random number generation which is not robust enough to withstand a cryptographic attack against it...

Unspecified Vulnerability in Bouncy Castle BC

Bouncy Castle BC is a cryptographic library for C and Java applications. A security vulnerability exists in Bouncy Castle BC versions 1.54 through 1.59, BC-FJA version 1.0.0, and BC-FJA 1.0.1 and earlier. No detailed vulnerability details are provided at this time...

PT-2018-15490 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: OpenSSL crate versions prior to 0.10.9 Description: A use-after-free issue occurs in CMS Signing, where structures are used after they have been freed. Recommendations: For versions prior to 0.10.9, update to version 0.10.9 or later to resolv...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...