Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to OpenSSL denial of service (Cryptography package)

Summary There is a potential OpenSSL denial of service vulnerability in IBM Decision Optimization in IBM Cloud Pak for Data. IBM Decision Optimization in IBM Cloud Pak for Data has addressed the vulnerability. Vulnerability Details CVEID:CVE-2023-0286 DESCRIPTION: OpenSSL is vulnerable to a denia...

Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to YAML denial of service (CVE-2023-2251)

Summary YAML is used in IBM Decision Optimization in IBM Cloud Pak for Data. IBM Decision Optimization in IBM Cloud Pak for Data has addressed the reported vulnerability. Vulnerability Details CVEID:CVE-2023-2251 DESCRIPTION: YAML is vulnerable to a denial of service, caused by an uncaught...

SpiceDB's LookupResources may return partial results

Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using...

CVE-2023-35930 LookupResources may return partial results in spicedb

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources...

Security Bulletin: IBM Operational Decision Manager June 2023 - Multiple CVEs

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2023-20883 DESCRIPTION: VMware Tanzu Spring Boot is...

M-01 Unmitigated

Lines of code Vulnerability details Mitigation of M-01: Issue not mitigated Link to Issue: code-423n4/2023-05-ambire-findings21 Comments Sponsor decided not to mitigate the issue. Assessed type Other --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2023-3050

Summary: CVE-2023-3050 affects TMT Lockcell prior to version 15, due to reliance on cookies without validation or integrity checking in security decisions, allowing privilege abuse and authentication bypass. Affected product: Lockcell (TMT Lockcell) prior to v15. Vulnerability details (from provi...

CVE-2023-3050 Authentication Bypass in TMT's Lockcell

Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass. This issue affects Lockcell: before 15...

Security Bulletin: IBM Operational Decision Manager May 2023 - Multiple CVEs

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2023-20862 DESCRIPTION: VMware Tanzu Spring Security...

Lender can auction the loan without any restriction to cause losses to the borrower

Lines of code Vulnerability details Lender can auction the loan without any restriction to cause losses to the borrower Impact The lender can unilaterally decide to auction a loan at any time, without any restriction. The process can be started by calling startLoanAuction and offers to repay the...

Rapid7 Data Engineers Inspire Future Tech Talent at Summer Search Career Fest

We are thrilled to share some exciting news from our data engineering team at Rapid7. Earlier this month, our very own data engineers had the honor of being panelists at the technology panel organized by Summer Search, a fantastic organization that our CEO, Corey Thomas, is on the Leadership...

Security Bulletin: IBM Operational Decision Manager April 2023 - Multiple CVEs

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote...

Azure vs. AWS Developer Tools Guide

Azure vs. AWS — which should you use for your DevOps environment? Discover the differences, similarities, and use cases to make an informed decision...

Security Bulletin: Vega Vulnerabilities affect IBM Decision Optimization in IBM Cloud Pak for Data (CVE-2023-26486, CVE-2023-26487)

Summary There are multiple vulnerabilities in Vega 5.22.1 used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-26486 DESCRIPTION: Vega is vulnerable to cross-site...

CVE-2023-30057

Multiple stored cross-site scripting XSS vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-30056

A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie...

CVE-2023-30057: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-30056: Session Fixation

A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie...

PT-2023-22521

Name of the Vulnerable Software and Affected Versions FICO Origination Manager Decision Module version 4.8.1 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, due to multiple stored cross-site scripting XSS vulnerabilities. This enables attacke...

PT-2023-22520

Name of the Vulnerable Software and Affected Versions FICO Origination Manager Decision Module version 4.8.1 Description A session takeover issue exists due to insufficient protection of the JSESSIONID cookie. Recommendations For FICO Origination Manager Decision Module version 4.8.1, consider...