The vulnerability of the Weincloud industrial device management cloud platform lies in its insufficient authentication attempt limit, which allows attackers to execute a brute-force attack.

The vulnerability of the Weincloud industrial device management cloud platform lies in the insufficient limitation on authentication attempts. Exploiting this vulnerability allows a malicious actor to execute a brute-force attack...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for September 2023

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF025 and 23.0.1-IF003. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition 7.1.5.18...

The vulnerability of the CODESYS Development System, a programming platform for embedded systems, lies in its insufficient authentication attempts limitation. This allows attackers to make an unlimited number of password input attempts.

The vulnerability of the CODESYS Development System, a programming platform for embedded systems, is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows attackers to perform an unlimited number of password input attempts...

DRUPAL-CONTRIB-2023-048

This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks. A previous security advisory,...

CVE-2023-40684

IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

Authentication flaw

IBM UrbanCode Deploy UCD 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X-Force ID: 263581...

Cross site scripting

IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

Information disclosure

IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 240897...

CVE-2022-43906 IBM Security Guardium information disclosure

IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 240897...

CVE-2022-43906

IBM Security Guardium 11.5 is affected by CVE-2022-43906 due to a missing or insecure SameSite attribute on a sensitive cookie, which could disclose sensitive information. The issue has been addressed by IBM; remediation involves updating to a patched release and applying the provided fix guidanc...

CVE-2023-40376 IBM UrbanCode Deploy (UCD) improper authentication controls

IBM UrbanCode Deploy UCD 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X-Force ID: 263581...

CVE-2023-40376

CVE-2023-40376 affects IBM UrbanCode Deploy (UCD) versions 7.1‑7.3.2.x under certain configurations. The root cause is improper authentication controls that could allow an authenticated user to change environment variables. Impact described by sources: potential unauthorized modifications to envi...

CVE-2023-40376 IBM UrbanCode Deploy (UCD) improper authentication controls

IBM UrbanCode Deploy UCD 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X-Force ID: 263581...

CVE-2023-40684 IBM Content Navigator cross-site scripting

IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2023-40684

CVE-2023-40684 affects IBM Content Navigator on 3.0.11/3.0.13/3.0.14 when used with IBM Daeja ViewOne Virtual. The issue is a cross-site scripting vulnerability that lets a user embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Docum...

Security Bulletin: Multiple vulnerabilities has been identified in FasterXML jackson-databind affect IBM Engineering Lifecycle Optimization - Publishing

Summary A security vulnerability has been identified in FasterXML jackson-databind affect IBM Engineering Lifecycle Optimization - Publishing. Information about a security vulnerability affecting jackson-databind has been published in a security bulletin. Vulnerability Details CVEID:CVE-2021-4687...

CVE-2023-37404

IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack. IBM X-Force ID: 259789...

Code injection

IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack. IBM X-Force ID: 259789...

CVE-2023-37404 IBM Observability with Instana code execution

IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack. IBM X-Force ID: 259789...

CVE-2023-37404

Summary: CVE-2023-37404 affects IBM Observability with Instana OnPrem versions 1.0.243–1.0.254. A network attacker can exploit DNS poisoning to execute arbitrary code on the host. The NVD/IBM bulletin report a high-severity impact with a base CVSS v3.1 score up to 9.8 (CRITICAL). Remediation guid...