CVE-2018-11076 Dell EMC Avamar and Integrated Data Protection Appliance Information Exposure Vulnerability

Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance IDPA 2.0 are affected by an information exposure vulnerability. Avamar Java management console's SSL/TLS private key may be leaked in the Avamar Java management client...

CVE-2018-11077

CVE-2018-11077 is the information-exposure aspect of the Dell EMC Avamar/IDPA command-injection issue tracked in VDP advisories. The connected VMware VMSA-2018-0029 confirms a separate command-injection flaw in the getlogs utility that can lead to root-level command execution when an authenticate...

CVE-2018-11077 Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability

'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance IDPA versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially...

Security Bulletin: Information Disclosure in WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2018-1621)

Summary There is a potential Information disclosure vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1621 DESCRIPTION: IBM WebSphere Application Server could allow a local attacker to obtain clear text password in a trace file caused by improper handling of som...

Security Bulletin: Potential spoofing attack in WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2018-1695)

Summary There is a potential spoofing attack in WebSphere Application Server using Form Login when using Java SE 6. This does not occur when using other versions of the Java SE. Vulnerability Details CVEID: CVE-2018-1695 DESCRIPTION: IBM WebSphere Application Server installations using Form Login...

Security Bulletin: Code execution vulnerability in WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2018-1567)

Summary There is a potential remote code execution vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1567 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized objec...

Security Bulletin:Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server (October 2018 CPU) shipped with Tivoli Integrated Portal

Summary Embedded Websphere Application Server eWAS v7.0.x is shipped as a component of Tivoli Integrated Portal TIP v2.1 and v2.2. The version of eWAS has been affected by multiple security vulnerabilities, as described below. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified...

Security Bulletin: Cross-site scripting vulnerability in CacheMonitor for WebSphere Application Server (CVE-2018-1767) shipped with Tivoli Integrated Portal

Summary Embedded Websphere Application Server eWAS v7.0.x is shipped as a component of Tivoli Integrated Portal TIP v2.1 and v2.2. The version of eWAS has been affected by multiple security vulnerabilities, as described below. Vulnerability Details CVEID: CVE-2018-1767 DESCRIPTION: IBM WebSphere...

Dell EMC Avamar and Integrated Data Protection Appliance Information Disclosure Vulnerability

Dell EMC Avamar Server and EMC Integrated Data Protection Appliance are both products of Dell Inc. Dell EMC Avamar Server is a fully virtualized backup and recovery software for servers.EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution. EMC Integrated Data...

Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability

Dell EMC Avamar Server and EMC Integrated Data Protection Appliance are both products of Dell Inc. Dell EMC Avamar Server is a fully virtualized backup and recovery software for servers.EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution. EMC Integrated Data...

Partner Perspectives: Collaborate and Consolidate with King & Union and Carbon Black

Peter Prizio Jr. is the Senior Product Manager for King & Union. One of the biggest challenges facing security organizations today is dealing with the overwhelming number of alerts received each and every day. A staggering 27 percent of IT professionals report receiving more than one million aler...

The evolution of Microsoft Threat Protection, November update

At Ignite 2018, we announced Microsoft Threat Protection, a comprehensive, integrated solution securing the modern workplace across identities, endpoints, user data, cloud apps, and, infrastructure Figure 1. The foundation of the solution is the Microsoft Intelligent Security Graph, which...

Cisco Integrated Management Controller Supervisor SQL Injection Vulnerability

Cisco Integrated Management Controller IMC Supervisor is a set of tools used by Cisco to manage UCS Unified Computing System, which supports HTTP, SSH access, etc., and allows operations such as powering up, shutting down, and restarting the server. A SQL injection vulnerability exists in the web...

HPE Integrated Lights-Out 5 Security Restriction Bypass Vulnerability

HPE Integrated Lights-Out 5 iLO 5 is a remote control solution. The solution enables remote monitoring and operation and maintenance of IT assets such as servers. A security restriction bypass vulnerability exists in HPE iLO 5 versions prior to 1.37. An attacker could exploit this vulnerability t...

Default credentials

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

CVE-2018-11062

Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, and 2.2 contain undocumented accounts named ‘support’ and ‘admin’ protected by default passwords. These accounts have limited privileges but can access certain system files, enabling a potential attacker with knowledge of the...

Security Bulletin: Potential traversal vulnerability in IBM WebSphere Application Server Admin Console shipped with Tivoli Integrated Portal (CVE-2018-1770)

Summary There is a potential directory traversal vulnerability in the Admin Console for WebSphere Application Server shipped with Tivoli Integrated Portal. Vulnerability Details CVEID: CVE-2018-1770 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to traverse directorie...

Dell EMC Integrated Data Protection Appliance Unlogged Account Vulnerability

The Dell EMC Integrated Data Protection Appliance IDPA is a pre-integrated turnkey solution that is easy to deploy and scale, providing comprehensive protection for a wide range of application ecosystems. An undocumented account vulnerability exists in the Dell EMC Integrated Data Protection...

HPESBHF03894 rev.1 - HPE Integrated Lights-Out 5 (iLO 5) Firmware Updates, Local Bypass of Security Restrictions

Potential Security Impact: Local: Bypass Security Restrictions SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to v1.37 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2018-7113 |...

GHSA-2J2X-HX4G-2GF4 In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider...