Security Bulletin: Rational Host On-Demand administrative interface is vulnerable to DOM XSS (CVE-2015-5002)

Summary IBM Rational Host On-Demand administrative interface is vulnerable to DOM XSS in multiple parameters, caused by improper validation of user supplied input Vulnerability Details CVEID: CVE-2015-5002 DESCRIPTION: IBM Host On-Demand is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Vulnerabilities in GSKit affect Host On-Demand (CVE-2015-0138)

Summary GSKit is an IBM component that is used by Host On-Demand.The GSKit that is shipped with Host On-Demand contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. Host On-Demand has addressed the applicable...

Security Bulletin: Vulnerability in IBM® Runtime Environment affects Host On-Demand (CVE-2016-3511).

Summary There is vulnerability in IBM® Runtime Environment Java™ Version 7.0,7R1 and 8.0, that is used by Host On-Demand. This issue was disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3511 DESCRIPTION: An unspecified vulnerability in Oracle Java ...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Host On-Demand

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.5 ,used by IBM Host On-Demand. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.7SR6 that is used by IBM Rational Host On-Demand This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID:...

Security Bulletin: Rational Host On-Demand clients affected by vulnerabilities in IBM JRE

Summary IBM Rational Host On-Demand provides a Java JRE as part of its server package for clients to download and install on client machines. The vulnerabilities are only applicable to client-side Java deployments where untrusted code may be executed such as Java applets running in a web browser...

Security Bulletin:Vulnerability in IBM Java Runtime affect IBM Host On-Demand (CVE-2016-0363)

Summary There is vulnerability in IBM® Runtime Environment Java™ Version 1.6, 1.7, 7.1 and 8.0 that is used by IBM Host On -Demand This issue was disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-0363 DESCRIPTION: IBM SDK, Java Technology Edition...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2016-0603)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.6 , 1.7 and 1.8 that is used by Rational Host On Demand .JRE installation executables on the Windows platform are affected by this vulnerability. Vulnerability Details CVE-ID: CVE-2016-0603 Descriptio...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Host On-Demand (CVE-2016-0264 ,CVE-2016-3449)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6.0, 7.0,7R1 and 8.0 , that is used by IBM Host On -Demand This issue was disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-3449 DESCRIPTION: An unspecified...

Security Bulletin:: Multiple vulnerabilities in IBM Java Runtime affect IBM Host On-Demand.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.10, used by IBM Host On-Demand. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2677 DESCRIPTION: An unspecified vulnerability in Oracl...

Security Bulletin: Vulnerability in SSLv3 affects Host On-Demand (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational Host On-Demand. Vulnerability Details CVE-ID: CVE-2014-3566 Description: Product could allow a remote attacker to obtain sensitive...

Security Bulletin : Multiple vulnerabilities in IBM GSKit affect IBM Host On-Demand.

Summary GSKit is an IBM component that is used by Host On-Demand. GSKit that is shipped with Host On-Demand contains multiple security vulnerabilities .Host On-Demand has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2018-1426 DESCRIPTION:IBM GSKit duplicates the PRNG state acros...

Security Bulletin: Vulnerability IBM GSKit affect IBM Host On-Demand

Summary GSKit is an IBM component that is used by Host On-Demand. GSKit that is shipped with Host On-Demand contains security vulnerability. Host On-Demand has addressed it. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive informatio...

Security Bulletin: Vulnerability IBM GSKit affect IBM Host On-Demand

Summary GSKit is an IBM component that is used by Host On-Demand. GSKit that is shipped with Host On-Demand contains security vulnerability. Host On-Demand has addressed it. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting i...

Vimeo: Domain pointing to vimeo portfolio are prone to takeover using on-demand.

We thank @bugdiscloseguys for finding this issue. We were only checking \ on-demand to on-demand, but not on-demand to portfolio. Vimeo offers service for pro users to add custom domain under portfolios so that portfolios can be hosted on your subDomain, However Vimeo offers same feature for...

Code Execution Vulnerability in the background of seacms website builder system

seacms is a video-on-demand system based on PHP+MySql technology. There is a code execution vulnerability in the backend of seacms website builder system, which can be exploited by attackers to execute remote code...

Msvod Cms SQL Injection Vulnerability

Msvod Cms is a content management system CMS for video-on-demand websites. The system mainly provides services such as video-on-demand and video aggregation website building. A SQL injection vulnerability exists in Msvod Cms version 10. A remote attacker can exploit this vulnerability to execute...

SeaCMS Remote Code Execution Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit the vulnerability to execute code...

LFCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-14218)

LFCMS is a video-on-demand system based on ThinkPHP and MySQL. A cross-site request forgery vulnerability exists in LFCMS version 3.7.0. A remote attacker can exploit this vulnerability to arbitrarily add users...

Security Bulletin: Information disclosure in WebSphere Application Server shipped with Jazz for Service Management (CVE-2017-1381)

Summary There is an information disclosure in the WebSphere Application Server Proxy Server or On-Demand-Router ODR. This only occurs when the system clock is changed. If the system clock is changed it could cause stale data to be cached and served. Vulnerability Details CVEID: CVE-2017-1381...