Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cognos Controller (CVE-2015-0209, CVE-2015-0286, CVE-2015-0289)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Cognos Controller. IBM Cognos Controller has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to execute...

Register for Carbon Black’s 2018 Customer Conference – Cb Connect in NYC – Oct. 10 & 11

Cb Connect, Carbon Black’s premier customer and partner event of the year, heads to New York City this fall for a two-day conference at Center 415, where you’ll join hundreds of security professionals to discuss: Moving your endpoint security to the cloud Best practices for threat hunting and...

SAP B2B / B2C CRM Local File Inclusion Vulnerability

SAP enterprise application software solution provider. A local file inclusion vulnerability exists in SAP B2B / B2C CRM. An attacker can exploit the vulnerability to cause malicious data submitted externally to be entered as a variable in the file inclusion process, which could lead to the...

User emails visible in page source

A customer reported that user emails are being included in the page source on issue pages. Even with email visibility set to "Hidden", the reporter and assignee emails are included in the page source. The email is in an attribute called data-user as part of a span tag. Example from this page:...

PageUp Malware Scare Sheds Light On Third Party Risks

UPDATE Human resource firm PageUp warned customers its backend infrastructure was infected with malware and as a result customers’ sensitive information such as names, contacts and passwords may have been breached. A week after the initial announcement of the malware, on June 12, PageUp said that...

CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

DEBIAN-CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

Code injection

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

UBUNTU-CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

CVE-2018-10198

Removed by vendor...

CVE-2018-10198

CVE-2018-10198 affects OTRS 6.0.x before 6.0.7. An attacker authenticated as a customer can use the ticket overview screen to disclose internal article information from their own customer tickets, constituting an information disclosure vulnerability. The issue is described as an information discl...

CVE-2018-10198

An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal article information of their customer tickets...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15621)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the customer portal register method in Quest DR Series disk backup software before 4.0.3.1. An attacker could exploit this vulnerability to execute system commands via specially crafted...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15620)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the customer portal changeManageBtn method in Quest DR Series disk backup software before 4.0.3.1. An attacker can exploit this vulnerability to execute commands via the 'action' paramet...

Ticketfly website hacked & offline after hacker leaks customer data

By Carolina Eventbrite-owned San Francisco, California based ticket distribution service Ticketfly's website This is a post from HackRead.com Read the original post: Ticketfly website hacked & offline after hacker leaks customer data...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

Unspecified Cross-Site Scripting Vulnerability in SAP Customer Relationship Management Mail Form Editor

SAP Customer Relationship Management is a customer relationship management solution from SAP, Germany. It supports all customer-centric business areas, from marketing to sales and service, as well as customer interaction channels such as interaction centers, the Internet and mobile customers. An...

Amazon Comes Under Fire for Facial Recognition Platform

Facial-recognition technology has long been touted as a useful tool for law enforcement, but the ability of systems like Amazon’s Rekognition platform to identify large numbers of people at once in a single video or still frame has raised the hackles of privacy advocates. The American Civil...