Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities (CVE-2017-3164)

Summary IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities Vulnerability Details CVEID: CVE-2017-3164 DESCRIPTION: Apache Solr is vulnerable to server-side request forgery, caused by not having corresponding allowlist mechanism in the shards parameter. By using a...

Security Bulletin: IBM QRadar SIEM is vulnerable to information exposure (CVE-2019-4593)

Summary IBM QRadar SIEM is vulnerable to information exposure Vulnerability Details CVEID: CVE-2019-4593 DESCRIPTION: IBM QRadar generates an error message that includes sensitive information that could be used in further attacks against the system. CVSS Base score: 4.3 CVSS Temporal Score: See:...

Security Bulletin: IBM QRadar SIEM is vulnerable to invalid certificate validation (CVE-2019-4654)

Summary IBM QRadar SIEM does not validate, or incorrectly validates, a certificate. Vulnerability Details CVEID: CVE-2019-4654 DESCRIPTION: IBM QRadar does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MI...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM QRadar SIEM

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 used by IBM QRadar SIEM. IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability ...

Security Bulletin: IBM QRadar SIEM is vulnerable to Server-Side Request Forgery (SSRF) (CVE-2020-4294)

Summary IBM QRadar SIEM is vulnerable to Server-Side Request Forgery SSRF Vulnerability Details CVEID: CVE-2020-4294 DESCRIPTION: IBM QRadar SIEM is vulnerable to Server Side Request Forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially...

Security Bulletin: IBM QRadar SIEM is vulnerable to instantiation of arbitrary objects (CVE-2020-4272)

Summary IBM QRadar SIEM is vulnerable to vulnerable to instantiation of arbitrary objects based on user-supplied input. Vulnerability Details CVEID: CVE-2020-4272 DESCRIPTION: IBM QRadar could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted...

Qualys Cloud Platform 3.0 New Features

This release of the Qualys Cloud Platform version 3.0 includes updates and new features for Vulnerability Management, highlights as follows. Vulnerability Management The following features apply to all subscriptions that are currently using the Vulnerability Management Dashboard beta. With this...

Release Notes for Veeam Backup & Replication 10 Day 0 Update

Challenge This "Day 0" update is intended only for environments where Veeam Backup & Replication 10 RTM 10.0.0.4442 is installed. If you are running Veeam Backup & Replication 10 GA build 10.0.0.4461 or later, this update is not applicable to you, and should be ignored. This update is provided to...

Huawei EulerOS: Security Advisory for qemu-kvm (EulerOS-SA-2019-1988)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

java-1.8.0-openjdk security update

1:1.8.0.242.b08-0 - Update to aarch64-shenandoah-jdk8u242-b08. - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions. - Resolves: rhbz1785753 1:1.8.0.242.b07-1 - Add backports of JDK-8031111 & JDK-8132111 to fix TCK issue. - Resolves: rhbz1785753 1:1.8.0.242.b07-0 -...

15 Years Later, Metasploit Still Manages to be a Menace

The popular penetration testing and hacking framework Metasploit may be getting long in the tooth, but it hasn’t lost its bite in the hands of bad actors. According to researchers, hackers are still using the tool and a highly effective technique called Shikata Ga Nai Japanese for “nothing can be...

Sangoma SBC 2.3.23-119-GA Authentication Bypass Vulnerability

A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to bypass authentication and login as a non-existent user but with complete access to the dashboard including additional privileged user creation capabilities...

Shikata Ga Nai Encoder Still Going Strong

One of the most popular exploit frameworks in the world is Metasploit. Its vast library of pocket exploits, pluggable payload environment, and simplicity of execution makes it the de facto base platform. Metasploit is used by pentesters, security enthusiasts, script kiddies, and even malicious...

java-1.8.0-openjdk security update

1:1.8.0.232.b09-0 - Update to aarch64-shenandoah-jdk8u232-b09. - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:1.8.0.232.b08-0.0.ea - Update to aarch64-shenandoah-jdk8u232-b08. - Resolves: rhbz1753423...

java-11-openjdk security update

1:11.0.5.10-0.0.1 - link atomic for ix86 build 1:11.0.5.10-0 - Update to shenandoah-jdk-11.0.5+10 GA - Switch to GA mode for final release. - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream. - Resolves: rhbz1753423 1:11.0.5.9-0.0.ea - Update to shenandoah-jdk-11.0.5+9 EA -...

CVE-2019-15487

DfE School Experience before v16333-GA has XSS via a teacher training URL...

CVE-2019-15487

DfE School Experience before v16333-GA has XSS via a teacher training URL...

java-11-openjdk security update

1:11.0.4.11-0 - Update to shenandoah-jdk-11.0.4+11 GA - Switch to GA mode for final release. - Resolves: rhbz1724452 1:11.0.4.10-0.0.ea - Update to shenandoah-jdk-11.0.4+10 EA - Resolves: rhbz1724452 1:11.0.4.9-0.0.ea - Update to shenandoah-jdk-11.0.4+9 EA - Resolves: rhbz1724452 1:11.0.4.8-0.0.e...

WordPress GA Backend Tracking plugin <= 1.2 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress GA Backend Tracking plugin versions = 1.2. Solution Update the WordPress GA Backend Tracking plugin to the latest available version at least 1.2.1...

Fedora 29 : glusterfs (2018-a54270a213)

4.1.5 GA ---- 4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for...