Security Bulletin: Rational Build Forge Security Advisory (CVE-2014-0098)

Summary Apache HTTP Server has a security vulnerability that can lead to a denial of service DOS attack. To avoid this issue in IBM Rational Build Forge, you should use the latest version Apache HTTP Server which contains the fix for this problem. Vulnerability Details | Subscribe to My...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2013-4286)

Summary IBM Rational Build Forge is shipped with an Apache Tomcat. Apache Tomcat has released a patch that contains security vulnerability fixes and BuildForge is affected. These fixes have been added to the Rational Build Forge 7.1.3.5 iFix2 and 8.0.0.2 release. Vulnerability Details | Subscribe...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2013-0169)

Summary SSL, TLS and DTLS Plaintext Recovery Attack CVE-2013-0169 Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVEID: CVE-2013-0169 Description: A...

Security Bulletin: IBM Rational Build Forge Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Summary Java API Documentation contains a frame injection vulnerability. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVEID: CVE-2013-1571...

Security Bulletin: Multiple vulnerabilities in IBM Rational Build Forge (CVE-2012-3213, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0437, C

Summary IBM Rational Build Forge is shipped with an IBM Java that is based on Oracle Java. Oracle has released critical patch updates CPUs January 13, February 1 and February 19 that contain security vulnerability fixes and IBM Java is affected. These fixes have been added to the Rational Build...

Security Bulletin: IBM Rational Build Forge Java (CVE-2012-3216, CVE-2012-5077, CVE-2012-5073, CVE-2012-5074, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-5069, CVE-2012-5079, CVE-2012-5088)

Summary Rational Build Forge is shipped with an IBM Java that is based on Oracle Java. Oracle has released a critical patch update CPU that contains security vulnerability fixes and IBM Java is affected. These fixes have been added to the Rational Build Forge 8.0 release. Vulnerability Details |...

CVE-2016-10555

Since "algorithm" isn't enforced in jwt.decodein jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key...

A few words about Gartner’s “Magic Quadrant for Application Security Testing” 2018

February and March are the hot months for marketing reports. I already wrote about IDC and Forrester reports about Vulnerability Management-related markets. And this Monday, March 19, Gartner released new "Magic Quadrant for Application Security Testing". You can buy it on the official website fo...

SimpleSAMLphp Key Obfuscation Vulnerability

SimpleSAMLphp is a suite of PHP authentication applications that implement the SAML 2.0 service provider and identity provider functionality. the SAML2 library is one of the Security Assertion Markup Language SAML libraries. the XmlSecLibs library is one of the XML security libraries . A security...

Regular Expression Denial Of Service (ReDoS)

node-forge is vulnerable to regular expression denial of service ReDoS attacks. The vulnerability is caused by a weak choice of regular expression regex groups and allows a given string to cause a huge performance slow down...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

New Relic: User to Admin privilege escalation in Infrastructure Conditions - /v2/accounts/1835740/alerts/conditions

Details The endpoints POST /v2/accounts/:accountid/alerts/conditions create new and PUT /v2/accounts/:accountid/alerts/conditions/:conditionid update existing on infrastructure-alert.service.newrelic.com are vulnerable to privilege escalation. As per the screenshot below, an account with regular...

Design/Logic Flaw

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value 48bit derived from the MAC. The algorithm used to compute the "chk" was disclosed ...

CVE-2017-6094

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value 48bit derived from the MAC. The algorithm used to compute the "chk" was disclosed ...

Exposure of Sensitive Information to an Unauthorized Actor

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...

CVE-2017-1357

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684...

CVE-2017-1357

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684...

CVE-2017-1357: Improper Input Validation

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684...

WordPress FormCraft Form Builder Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress FormCraft Form Builder. An attacker can exploit this vulnerability t...

WordPress How-Interest plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress How-Interest plugin. An attacker can exploit this vulnerability ...