ATTACKdatamap - A Datasource Assessment On An Event Level To Show Potential Coverage Or The MITRE ATT&CK Framework

A datasource assessment on an event level to show potential coverage of the "MITRE ATT&CK" framework. This tool is developed by me and has no affiliation with "MITRE" nor with its great "ATT&CK" team, it is developed with the intention to ease the mapping of data sources to assess one's potential...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

DEBIAN-CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540...

UBUNTU-CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540...

Security Bulletin: Information Disclosure in WebSphere Application Server (CVE-2018-1621)

Summary There is a potential Information disclosure vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1621 DESCRIPTION: IBM WebSphere Application Server could allow a local attacker to obtain clear text password in a trace file caused by improper handling of som...

org.grails:grails-dependencies (2.2.0), org.grails:grails-hibernate (2.2.0) +16 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.2.0)

org.grails:grails-core MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.2.0 - org.grails:grails-hibernate 2.2.0 - org.grails:grails-logging 2.2.0 -...

org.grails:grails-dependencies (2.2.3), org.grails:grails-hibernate (2.2.3) +16 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.2.3)

org.grails:grails-core MAVEN version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.2.3 - org.grails:grails-hibernate 2.2.3 - org.grails:grails-logging 2.2.3 -...

org.grails:grails-dependencies (2.2.5), org.grails:grails-hibernate (2.2.5) +16 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.2.5)

org.grails:grails-core MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.2.5 - org.grails:grails-hibernate 2.2.5 - org.grails:grails-logging 2.2.5 -...

org.grails:grails-hibernate (2.2.0.rc3), org.grails:grails-logging (2.2.0.rc3) +15 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.2.0.rc3)

org.grails:grails-core MAVEN version 2.2.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-hibernate 2.2.0.rc3 - org.grails:grails-logging 2.2.0.rc3 -...

CVE-2018-1621

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

CVE-2018-1621

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

Design/Logic Flaw

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

PT-2018-13437

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue is caused by improper handling of some datasource custom properties, which could allow a local attacker to obtain clear text passwords in a trace file...

CVE-2018-1621: Cleartext Storage of Sensitive Information

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

CVE-2013-3734: Undefined Security Weakness

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow 1 man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or 2 attackers to obtain sensitive information by...

PT-2017-13669

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for Arbitrary File Read. An attacker must first authenticate to the application. The "/xAdmin/html/cm datasource group xsd.jsp" API endpoint i...

CVE-2017-7694

Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor...

CVE-2017-7694: Improper Control of Generation of Code

Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor...

PT-2017-17892

Name of the Vulnerable Software and Affected Versions Symphony CMS versions prior to 2.6.12 Description A Remote Code Execution issue allows remote attackers to execute code and obtain a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or...

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)

The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors...