Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise and IBM Integration Bus (CVE-2020-7754)

Summary IBM App Connect Enterprise and IBM Integration Bus ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details Third Party Entry: 189917 DESCRIPTION: Node.js npm-user-validate module denial of service CVS...

JetBrains TeamCity Improper Permission Check Vulnerability

TeamCity is a Java-based build management and continuous integration server from JetBrains. JetBrains TeamCity versions prior to 2020.2.1 are vulnerable to improper privilege checking during user deletion. No details of the vulnerability are provided at this time...

CVE-2021-25772

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration...

CVE-2021-25772

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration...

CVE-2021-25772

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration...

Information disclosure

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration...

CVE-2021-25772

CVE-2021-25772 concerns JetBrains TeamCity. The exposed issue allowed a DoS on the TeamCity server via server integration, affecting TeamCity server components prior to version 2020.2.2. The linked Red Hat advisory reiterates that the vulnerability exists in TeamCity before 2020.2.2 and enables s...

CVE-2021-25772

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration...

JetBrains TeamCity 安全漏洞

Jetbrains JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exist...

Wenzhou Qiaoyu Technology Co., Ltd. station-building system pr***_se***.asp page SQL injection vulnerability

Wenzhou Qiaoyu Technology Co., Ltd. is an enterprise focusing on network marketing integration services. Wenzhou Qiaoyu Technology Co., Ltd. station-building system prse.asp page there is a SQL injection vulnerability, the attacker can use the vulnerability to obtain sensitive information in the...

PT-2022-17695 · Grafana +2 · Grafana +2

Name of the Vulnerable Software and Affected Versions: Grafana versions through 7.3.4 Description: An issue was discovered in Grafana when integrated with Zabbix, allowing the Zabbix password to be found in the "api jsonrpc.php" HTML source code. When a user logs in and is allowed to register, on...

Home Assistant Community Store 1.10.0 Path Traversal

Exploit Title: Home Assistant Community Store HACS 1.10.0 - Path Traversal to Account Takeover Date: 2021-01-28 Exploit Author: Lyghtnox Vendor Homepage: https://www.home-assistant.io/ Software Link: https://github.com/hacs/integration Version: 1.10.0 Tested on: Raspbian + Home Assistant 2021.1.0...

@kumologica/pocdk (>=0.0.7-beta, <=0.0.8-beta), @kumologica/pocsdk (>=0.0.9-poc, <=0.0.33-poc) +6 more potentially affected by CVE-2020-26272 via electron (>=11.0.0, <=11.0.5)

electron NPM version =11.0.0, =0.0.7-beta, =0.0.9-poc, =3.0.0, =0.32.0-alpha.47, =2.0.9, =2.0.12 - simple-git-gui 3.5.4 Source cves: CVE-2020-26272 Source advisory: OSV:GHSA-HVF8-H2QH-37M9...

@dojo/cli-build-app (>=8.0.0-alpha.1, <=8.0.1), @finsemble/finsemble-electron-adapter (>=5.1.1, <=5.2.0) +13 more potentially affected by CVE-2020-26272 via electron (>=10.1.1, <=10.1.7)

electron NPM version =10.1.1, =8.0.0-alpha.1, =5.1.1, =0.17.1, =0.31.0-RC.1, =1.0.0, =0.3.243, =1.1.17, =0.0.21, =3.0.10, =0.9.23, =2.0.1, =1.0.0, =3.4.0, =0.12.0, =0.13.5 Source cves: CVE-2020-26272 Source advisory: OSV:GHSA-HVF8-H2QH-37M9...

Announcing the general availability of Azure Defender for IoT

As businesses increasingly rely on connected devices to optimize their operations, the number of IoT and Operational Technology OT endpoints is growing dramatically—industry analysts have estimated that CISOs will soon be responsible for an attack surface multiple times larger than just a few yea...

CloudBees Jenkins TOCTOU Competitive Conditions Vulnerability

Jenkins is an open source continuous integration tool written in Java , mainly used for continuous , automated build/test software projects , monitor the operation of external tasks . A TOCTOU competitive condition vulnerability exists in Jenkins 2.275, LTS 2.263.2. An attacker can exploit this...

openSUSE Security Update : virtualbox (openSUSE-2021-165)

This update for virtualbox fixes the following issues : Version update to 6.1.18 released January 19 2021 This is a maintenance release. The following items were fixed and/or added : - Nested VM: Fixed hangs when executing SMP nested-guests under certain conditions on Intel hosts bug 19315, 19561...

OPENSUSE-SU-2021:0165-1 Security update for virtualbox

This update for virtualbox fixes the following issues: Version update to 6.1.18 released January 19 2021 This is a maintenance release. The following items were fixed and/or added: - Nested VM: Fixed hangs when executing SMP nested-guests under certain conditions on Intel hosts bug 19315, 19561 -...

Shopify: [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only

Summary: PLUS User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only Description: User with Store management permission as shown in below screenshot F1168574 Should not have the ability to enforce SAML organization...

Security Bulletin: Multiple CVEs - Vulnerabilities in IBM Java Runtime affect IBM Integration Designer used in IBM Business Automation Workflow and IBM Business Process Manager

Summary Vulnerabilities in IBM® Runtime Environment Java™ Versions 7 and 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs. Vulnerability Details CVEID: CVE-2020-14579 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries compone...