Security Bulletin:Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server (October 2018 CPU) shipped with Tivoli Integrated Portal

Summary Embedded Websphere Application Server eWAS v7.0.x is shipped as a component of Tivoli Integrated Portal TIP v2.1 and v2.2. The version of eWAS has been affected by multiple security vulnerabilities, as described below. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified...

Security Bulletin: Cross-site scripting vulnerability in CacheMonitor for WebSphere Application Server (CVE-2018-1767) shipped with Tivoli Integrated Portal

Summary Embedded Websphere Application Server eWAS v7.0.x is shipped as a component of Tivoli Integrated Portal TIP v2.1 and v2.2. The version of eWAS has been affected by multiple security vulnerabilities, as described below. Vulnerability Details CVEID: CVE-2018-1767 DESCRIPTION: IBM WebSphere...

Dell EMC Avamar and Integrated Data Protection Appliance Information Disclosure Vulnerability

Dell EMC Avamar Server and EMC Integrated Data Protection Appliance are both products of Dell Inc. Dell EMC Avamar Server is a fully virtualized backup and recovery software for servers.EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution. EMC Integrated Data...

Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability

Dell EMC Avamar Server and EMC Integrated Data Protection Appliance are both products of Dell Inc. Dell EMC Avamar Server is a fully virtualized backup and recovery software for servers.EMC Integrated Data Protection Appliance is a disk-based backup and recovery solution. EMC Integrated Data...

Partner Perspectives: Collaborate and Consolidate with King & Union and Carbon Black

Peter Prizio Jr. is the Senior Product Manager for King & Union. One of the biggest challenges facing security organizations today is dealing with the overwhelming number of alerts received each and every day. A staggering 27 percent of IT professionals report receiving more than one million aler...

The evolution of Microsoft Threat Protection, November update

At Ignite 2018, we announced Microsoft Threat Protection, a comprehensive, integrated solution securing the modern workplace across identities, endpoints, user data, cloud apps, and, infrastructure Figure 1. The foundation of the solution is the Microsoft Intelligent Security Graph, which...

Cisco Integrated Management Controller Supervisor SQL Injection Vulnerability

Cisco Integrated Management Controller IMC Supervisor is a set of tools used by Cisco to manage UCS Unified Computing System, which supports HTTP, SSH access, etc., and allows operations such as powering up, shutting down, and restarting the server. A SQL injection vulnerability exists in the web...

HPE Integrated Lights-Out 5 Security Restriction Bypass Vulnerability

HPE Integrated Lights-Out 5 iLO 5 is a remote control solution. The solution enables remote monitoring and operation and maintenance of IT assets such as servers. A security restriction bypass vulnerability exists in HPE iLO 5 versions prior to 1.37. An attacker could exploit this vulnerability t...

Default credentials

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

CVE-2018-11062

Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, and 2.2 contain undocumented accounts named ‘support’ and ‘admin’ protected by default passwords. These accounts have limited privileges but can access certain system files, enabling a potential attacker with knowledge of the...

Security Bulletin: Potential traversal vulnerability in IBM WebSphere Application Server Admin Console shipped with Tivoli Integrated Portal (CVE-2018-1770)

Summary There is a potential directory traversal vulnerability in the Admin Console for WebSphere Application Server shipped with Tivoli Integrated Portal. Vulnerability Details CVEID: CVE-2018-1770 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to traverse directorie...

Dell EMC Integrated Data Protection Appliance Unlogged Account Vulnerability

The Dell EMC Integrated Data Protection Appliance IDPA is a pre-integrated turnkey solution that is easy to deploy and scale, providing comprehensive protection for a wide range of application ecosystems. An undocumented account vulnerability exists in the Dell EMC Integrated Data Protection...

HPESBHF03894 rev.1 - HPE Integrated Lights-Out 5 (iLO 5) Firmware Updates, Local Bypass of Security Restrictions

Potential Security Impact: Local: Bypass Security Restrictions SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to v1.37 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2018-7113 |...

GHSA-2J2X-HX4G-2GF4 In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider...

avnet-integrated.eu XSS vulnerability

Open Bug Bounty ID: OBB-687426 Description| Value ---|--- Affected Website:| avnet-integrated.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

CVE-2018-15405

A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly...

CVE-2018-15404

A vulnerability in the web interface of Cisco Integrated Management Controller IMC Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to insufficient restrictions on the size or...

CVE-2018-0485

A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers ISR G2 and the Cisco 4451-X Integrated Services Router ISR4451-X could allow an unauthenticated, remote attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resultin...

CVE-2018-0431

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of...

CVE-2018-0430

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of...