CVE-2018-1498

IBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 141223...

Code injection

IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. The software might connect to a malicious host while believing it is a trusted host, or the...

CVE-2018-1509

The CVE-2018-1509 entry affects IBM Security Guardium EcoSystem 10.5. The issue is improper certificate validation, allowing an attacker to perform a MITM attack to spoof a trusted entity or feed spoofed data from a trusted host. IBM’s bulletin confirms the affected product/version and provides r...

CVE-2018-1498

IBM Security Guardium EcoSystem 10.5 stores user credentials in plaintext, readable by a local user. Root cause: credentials stored in clear text. Impact per sources: local access could disclose credentials; no remote exploit detailed. Remediation: IBM lists a fix for Guardium 10.5 (remediation/f...

CVE-2018-1509

IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. The software might connect to a malicious host while believing it is a trusted host, or the...

Security Bulletin: IBM Security Guardium is affected by a Password in Clear Text vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1498 DESCRIPTION: IBM Security Guardium EcoSystem stores user credentials in plain in clear text which can be read by a local user. CVSS Base Score: 6.2 CVSS Temporal Score: See for the...

[SECURITY] Fedora 29 Update: matrix-synapse-0.33.3.1-1.fc29

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

[SECURITY] Fedora 28 Update: matrix-synapse-0.33.3.1-1.fc28

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

Wisetail Learning Ecosystem 4.11.6 Insecure Direct Object Reference

Title: MULTIPLE IDOR VUNLERABILITies ON WISETAIL LEARNING ECOSYSTEM LE UPTO V4.11.6 Date: 12/09/2019 Author: S. M. Zia Ur Rashid Vendor Homepage: wisetail.com Author Contact: https://www.linkedin.com/in/ziaurrashid/ Affected Version: = 4.11.6 Assaigned CVE: CVE-2018-16970, CVE-2018-16971...

Design/Logic Flaw

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...

CVE-2018-16970

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...

CVE-2018-16971

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...

CVE-2018-16970

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...

Design/Logic Flaw

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...

CVE-2018-16971

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...

CVE-2018-16970

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...

CVE-2018-16971

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...

CVE-2018-16971

Wisetail Learning Ecosystem (LE) up to version 4.11.6 suffers from an insecure direct object reference (IDOR) vulnerability that allows an attacker to access non-purchased course contents (quiz/test) by altering the id parameter. The root cause is improper access control for object references, en...

CVE-2018-16970

CVE-2018-16970 affects Wisetail Learning Ecosystem (LE) up to version 4.11.6, where an insecure direct object reference (IDOR) enables downloading non-purchased course files by modifying the id parameter. The connected PacketStorm entry corroborates multiple IDOR vulnerabilities affecting LE ≤ 4....

Security Bulletin: Official Statement On Spectre and Meltdown

Summary IBM Security statement on the Spectre and Meltdown vulnerabilities Vulnerability Details As many clients are likely aware of by now, 2 major security flaws impacting chipsets across the PC and mobile spectrums have unfolded over the last day or so. Meltdown Intel only and Spectre...