Security Bulletin: A Security vulnerability in Apache Tomcat used by Rational Build Forge (CVE-2017-15706)

Summary There is a potential security vulnerability in the Apache Tomcat used by Rational Build Forge. Vulnerability Details CVEID: CVE-2017-15706 DESCRIPTION: Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the...

Security Bulletin: Security vulnerabilities in OpenSSL used by Rational Build Forge (CVE-2017-3737 and CVE-2017-3738)

Summary OpenSSL, used by Rational Build Forge, has security vulnerabilities that allows a remote attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow...

Unspecified Vulnerability in Mozilla Firefox ESR (CNVD-2020-26233)

Mozilla Firefox ESR is an extended support release of Firefox web browser from the Mozilla Foundation in the United States. An unspecified vulnerability exists in Mozilla Firefox ESR. An attacker could exploit the vulnerability to forge URLs...

CVE-2020-11465

An issue was discovered in Deskpro before 2019.8.0. The /api/apps/ endpoints failed to properly validate a user's privilege, allowing an attacker to control/install helpdesk applications and leak current applications' configurations, including applications used as user sources used for...

Security Bulletin: Security vulnerability in IBM Java SDK affect Rational Build Forge (CVE-2020-2654)

Summary IBM® SDK Java™ Technology Edition that is used by IBM Rational Build Forge has a security vulnerability. IBM Rational Build Forge has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE...

Security Bulletin: Security vulnerability in IBM Java SDK affect Rational Build Forge (CVE-2019-4732)

Summary IBM® SDK Java™ Technology Edition that is used by IBM Rational Build Forge has a security vulnerability. IBM Rational Build Forge has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55,...

CVE-2020-1864

Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device to send specific packets to the affected device. Due to the improper implementation of the authentication function, attackers can exploit...

CVE-2017-12842

Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an...

CVE-2020-9454

A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploa...

Login Bypass Vulnerability in LaySNS

LaySNS is a lightweight integrated site building system. LaySNS suffers from a login bypass vulnerability, which can be exploited by an attacker to forge the identity of any frontend user to login...

InnoGames: Create any military unit in any age

Summary of the Issue It's possible to create a sniperbot unit in the bronze age by sending a crafted request to xs1.forgeofempires.com/game/json endpoint Steps to reproduce 1 Login to https://xs1.forgeofempires.com with Chrome browser while observing network tab. 2 Open the poc20200227.html F7304...

GHSA-MXHP-79QH-MCX6 TaffyDB can allow access to any data items in the DB

TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properti...

Design/Logic Flaw

taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found...

CVE-2019-10790

CVE-2019-10790 concerns the taffydb package (taffydb/taffydb.html) where versions up to 2.7.3 are affected. The issue, as described across multiple sources in the connected documents, is that an attacker can forge the internal index used per data item by injecting extra properties into user input. I...

Code injection

Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation on behalf of other user accounts via a modified email ID field...

UBUNTU-CVE-2020-7993

Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation on behalf of other user accounts via a modified email ID field...

Security Advisory - Information Leak Vulnerability in Some Huawei Product

Some Huawei mobile phones have an information leak vulnerability. Due to a module using weak encryption tool, an attacker with the root permission may exploit the vulnerability to obtain some information. Vulnerability ID: HWPSIRT-2019-07076 This vulnerability has been assigned a Common...

CVE-2019-5108

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different...

Security Bulletin: Multiple vulnerabilities identified in OpenSSL affect Rational Build Forge (CVE-2019-1547, CVE-2019-1549, CVE-2019-1552, and CVE-2019-1563)

Summary OpenSSL has security vulnerability that allows a remote attacker to exploit the application. Respective security vulnerability details are discussed in the subsequent section. Vulnerability Details This section includes the vulnerability details that affects the Rational Build Forge. CVEI...

Security Bulletin: Security vulnerability in IBM Java SDK affect Rational Build Forge (CVE-2019-2989)

Summary IBM® SDK Java™ Technology Edition that is used by IBM Rational Build Forge has security vulnerability. IBM Rational Build Forge has addressed the applicable CVE. Vulnerability Details Rational Build Forge has addressed the following vulnerability: If you run your own Java code using the I...