PT-2020-18285

Name of the Vulnerable Software and Affected Versions Comtech Stampede FX-1010 version 7.4.3 Description The issue allows remote authenticated administrators to execute arbitrary OS commands. This can be achieved by navigating to the Diagnostics Ping page and entering shell metacharacters in the...

Security Bulletin: IBM Netezza Firmware Diagnostics Support Tool is affected by the vulnerabilities known as Microarchitectural Data Sampling (MDS) Side Channel Vulnerabilities

Summary CVE-2018-12126 - Microarchitectural Store Buffer Data Sampling MSBDS CVSS Base Score: 6.5 Medium CVE-2018-12127 - Microarchitectural Load Port Data Sampling MLPDS CVSS Base Score: 6.5 Medium CVE-2018-12130 - Microarchitectural Fill Buffer Data Sampling MFBDS CVSS Base Score: 6.5 Medium...

Security Bulletin: A vulnerability in IBM Jazz for Service Management affects IBM Performance Management products (CVE-2016-9975)

Summary IBM Jazz for Service Management is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Vulnerability Details CVEID: CVE-2016-9975 DESCRIPTION: IBM Jazz for Service Management ...

JDK: Unrestricted access to diagnostic operations

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks...

SAP Diagnostics Agent Information Disclosure Vulnerability

SAP Diagnostics Agent is a system diagnostic agent program from SAP. An information disclosure vulnerability exists in SAP Diagnostics Agent. The vulnerability arises from a configuration or other error in the operation of a networked system or product. An attacker could exploit this vulnerabilit...

CVE-2019-15801

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware,...

CVE-2019-15803

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

Improper access control

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

CVE-2019-15803

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50AAHH.0C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fdssyspassDebugPasswdret. The...

CVE-2019-15803

The CVE-2019-15803 issue affects Zyxel GS1900 devices running firmware prior to 2.50(AAHH.0)C0. It stems from an undocumented keypress sequence that triggers a diagnostics shell via CTRL-ALT-t. The slider of access checks (fds_sys_remoteDebugEnable_ret in libfds.so) always returns TRUE, bypassing...

SAP Diagnostics Agent CVE-2019-0390 Information Disclosure Vulnerability

Description SAP Diagnostics Agent is prone to an unspecified information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. SAP Diagnostic Agent LM-Service version 7.20 is vulnerable; other versions may also be...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM Monitoring. IBM Monitoring has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2422 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE Libraries compone...

Security Bulletin: A vulnerability in IBM Websphere Application Server affects the IBM Performance Management product (CVE-2018-1901)

Summary IBM WebSphere Application Server could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. Vulnerability Details CVEID: CVE-2018-1901 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to...

Security Bulletin: A vulnerability in IBM Websphere Application Server affects the IBM Performance Management product (CVE-2019-4046)

Summary IBM WebSphere Application Server is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. IBM Performance Management has addressed the applicable CVE. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM Monitoring. IBM Monitoring has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2684 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded...

Security Bulletin: IBM Application Performance Management could allow a remote attacker to hijack the clicking action of the victim (CVE-2019-4086)

Summary IBM Application Performance Management could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attac...

Unspecified Vulnerability in Eclipse OpenJ9

Eclipse OpenJ9 is a Java application engine of the Eclipse Foundation . A security vulnerability exists in the Eclipse OpenJ9 Access Diagnostics feature, which can be exploited by an attacker to submit a request to bypass security checks to create a file, among other actions...

Security Bulletin: Vulnerabilities in NTP, OpenSSL and Intel CPU's affect IBM Netezza Firmware Diagnostics.

Summary Public disclosed vulnerability from Network Time Protocol NTP, Public disclosed vulnerability from OpenSSL and Intel CPU's are used by IBM Netezza Firmware Diagnostics. IBM Netezza Firmware Diagnostics Support Tools has addressed the applicable CVEs. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in NTP and OpenSSL affect IBM Netezza Firmware Diagnostics

Summary Open Source NTP and OpenSSL are used by IBM Netezza Firmware Diagnostics. IBM Netezza Firmware Diagnostics Support Tools has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused...

Security Bulletin: Multiple Vulnerabilities in Glibc, GNU C and OpenSSL affect IBM Netezza Firmware Diagnostics

Summary Glibc, GNU C and OpenSSL are used by IBM Netezza Firmware Diagnostics. IBM Netezza Firmware Diagnostics Support Tools has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-1234 DESCRIPTION: glibc is vulnerable to a denial of service, caused by a stack-based buffer...