207 matches found
CVE-2021-29737
The CVE-2021-29737 entry relates to IBM InfoSphere Data Flow Designer Engine within IBM InfoSphere Information Server 11.7, which is affected by improper validation of the REST API server certificate. The IBM Security Bulletin and NVD entry confirm the affected component and describe a REST certi...
CVE-2021-29737: Improper Certificate Validation
IBM InfoSphere Data Flow Designer Engine IBM InfoSphere Information Server 11.7 component has improper validation of the REST API server certificate. IBM X-Force ID: 201301...
PT-2021-18440
Name of the Vulnerable Software and Affected Versions IBM InfoSphere Data Flow Designer IBM InfoSphere Information Server 11.7 Description The issue is related to server-side request forgery SSRF, which may allow an authenticated attacker to send unauthorized requests from the system. This could...
PT-2021-18439
Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description The issue is related to improper validation of the REST API server certificate in the IBM InfoSphere Data Flow Designer Engine component. This could potentially allow for...
CVE-2021-29738: Server-Side Request Forgery (SSRF)
IBM InfoSphere Data Flow Designer IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...
CVE-2021-29737
IBM InfoSphere Data Flow Designer Engine IBM InfoSphere Information Server 11.7 component has improper validation of the REST API server certificate. IBM X-Force ID: 201301...
CVE-2021-29738
IBM InfoSphere Data Flow Designer IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...
Data Flow Sanitation Issue Fix
Impact Due to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server...
GHSA-XM9F-VXMX-4M58 Data Flow Sanitation Issue Fix
Impact Due to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server...
Remote Code Execution (RCE)
openmage/magento-lts is vulnerable to remote code execution. Lack of data flow sanitization allows admin users to upload malicious executable files to the server...
Design/Logic Flaw
OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for...
CVE-2021-32759 Data Flow Sanitation Issue Fix
OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for...
White Box Testing What Is, Types, Techniques, Example
White Box Testing is programming trying, or rather inner center and foundation. Get familiar with about this strategy in this article. What is White Box Testing? White Box Testing can be depicted as a program-testing methodology in which a product’s interior construction, plan and coding are trie...
CVE-2021-32754 Improper Restriction of XML External Entity Reference in de.tud.sse
FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity XXE vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based...
CVE-2021-32754
FlowDroid is a data flow analysis tool. CVE-2021-32754 describes an XML External Entity (XXE) vulnerability in FlowDroid versions prior to 2.9.0, where an attacker who can control the XML-based source/sink definition file could read files from external locations. The vulnerability requires use of...
CVE-2021-32754: Improper Restriction of XML External Entity Reference
FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity XXE vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based...
The Vulnerabilities of the Past Are the Vulnerabilities of the Future
Major software vulnerabilities are a fact of life, as illustrated by the fact that Microsoft has patched between 55 and 110 vulnerabilities each month this year – with 7% to 17% of those vulnerabilities being critical. May had the fewest vulnerabilities, with a total of 55 and only four considere...
Nagios Network Analyzer Self-XSS Vulnerability
Nagios Network Analyzer is a network data flow analyzer that provides a view of all network traffic and bandwidth utilization. A Self-XSS vulnerability exists in Nagios Network Analyzer versions prior to 2.4.2. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via...
