CVE-2018-1774

IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692...

CVE-2018-12411

The CVE-2018-12411 issue affects TIBCO ActiveSpaces Administrative Daemon (tibdgadmind) across Community, Developer, and Enterprise Editions. The root cause is a cross-site request forgery (CSRF) vulnerability that could enable an attacker to gain administrative access, including actions like del...

CVE-2018-12411 TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

CVE-2018-12414

The CVE-2018-12414 entry affects TIBCO Rendezvous components (rvrd, rvrsd, rvsd, rvcache, rvdm) and related editions. A CSRF flaw exists that could let an attacker reconfigure messaging and potentially access all data routed by RV. Affected versions are: RV 8.4.5 and earlier, RV Developer Edition...

CVE-2018-12412

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

CVE-2018-12411

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

Cross site request forgery (csrf)

The administrative daemon tibdgadmind of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks...

Cross site request forgery (csrf)

The realm server tibrealmserver component of TIBCO Software Inc. TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery CSRF attacks. Affected releases are TIBCO...

Visit Akamai at AWS re:Invent 2018!

On November 26-29, the Las Vegas Strip will be flooded with tens of thousands of developers, engineers, admins, architects and other technologists for trainings, certifications and sessions put on by AWS and its partner community at re:Invent. Akamai is excited to be a Gold sponsor this year, wit...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux - January 2018

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 that are used by Rational Developer for i and Rational Developer for AIX and Linux. These issues were disclosed as part of the IBM Java SDK updates in October 2017 CVE-2017-10295, CVE-2017-10355,...

Security Bulletin: IBM API Connect is vulnerable to CSV Injection (CVE-2018-1774)

Summary IBM API Connect has addressed the following vulnerability. IBM API Connect is vulnerable to CSV Injection via the Developer Portal and analytics that could contain malicious commands that would be executed once opened by an administrator. Vulnerability Details CVEID: CVE-2018-1774...

Security Bulletin: IBM API Connect Developer Portal is vulnerable to Server Side Request Forgery (CVE-2018-1712)

Summary IBM API Connect has addressed the following vulnerability. IBM API Connect Developer Portal is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network...

GHSA-37Q6-576Q-VGR7 Missing Origin Validation in parcel-bundler

Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

TIBCO Security Advisory: November 6, 2018 - TIBCOActiveSpaces

TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: CVE-2018-12411 Source: TIBCOSoftware Inc. TIBCO ActiveSpaces Administrative Daemon Vulnerable to CSRF Attacks Original release date: November 6, 2018 Last revised: Source: TIB...

Security Bulletin: IBM API Connect is affected by Foreshadow Spectre Variant vulnerability (CVE-2018-3646 CVE-2018-3615 CVE-2018-3620)

Summary API Connect has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-3646 DESCRIPTION: Multiple Intel CPU's could allow a local attacker to obtain sensitive information, caused by a flaw in the CPU speculative branch instruction execution feature. By conducting...

Apache Spark Information Disclosure Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computation from the Apache Software Foundation.Apache Spark Maven-based build is a version built on Maven. A security vulnerability exists in Apache Spark Maven-based build versions 1.3.x...

JVN#59394343: Multiple vulnerabilities in OpenDolphin

OpenDolphin provided by Life Sciences Computing Corporation contains multiple vulnerabilities listed below. Privilege escalation - CVE-2018-16161 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2| AV:N/AC:L/AU:S/C:P/I:P/A:P| Base...

[SECURITY] Fedora 28 Update: python26-2.6.9-17.fc28

Python 2.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 2.6, see other distributions that support it, such as CentOS or RHEL 6...

CVE-2018-11804

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A...

CVE-2018-11804

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A...