CVE-2018-1801

IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2018-1801

CVE-2018-1801 affects IBM App Connect 11.0.0.0–11.0.0.1, IBM Integration Bus 10.0.0.0–10.0.0.13, IBM Integration Bus 9.0.0.0–9.0.0.10, and WebSphere Message Broker 8.0.0.0–8.0.0.9. It enables XML External Entity (XXE) processing vulnerabilities that could allow a remote attacker to exhaust memory...

IBM App Connect, Integration Bus and WebSphere Message Broker XLXP-C Component Denial of Service Vulnerability

IBM App Connect, Integration Bus, and WebSphere Message Broker are all products of IBM Corporation.IBM App Connect is a set of integration tools for connecting applications and data.Integration Bus formerly known as IBM WebSphere Integration Bus formerly known as IBM WebSphere Message Broker is a...

Prepare to Defend Your Network Against Swarm-as-a-Service

The digital world we now inhabit creates unprecedented opportunities – both for good and for ill. One of these possibilities is swarm-based tools that can be used to either attack or defend the network. This possibility, or set of possibilities, has arisen due to dramatic advances in swarm-based...

Security Bulletin: Vulnerabilities in OpenSSL affect Upward Integration Modules (UIM) (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Upward Integration Modules UIM. Upward Integration Modules UIM has addressed the applicableCVEs and included the SSL 3.0 Fallback...

Security Bulletin: Upward Integration Module for HP Openview Operations for Windows is affected by multiple vulnerabilities in IBM Java SDK

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is shipped with Upward Integration Module for HP Openview Operations for Windows. These issues were disclosed as part of the Java Technology Edition Quarterly CPU - January 2015. Vulnerability Details Abstract Ther...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Remote Command Execution via GitLab Pages Covert Redirect to Steal GitHub/Bitbucket Tokens Remote Mirror Branches Leaked by Git Transfer Refs Denial of Service with Markdown Guests Can View List of Group Merge Requests Guest Can View Merge Request Titles via System Notes Persisten...

Partner Perspectives: Beyond SIEM: Carbon Black + JASK Connected

Oren Arar is the Head of Alliances for JASK. The real-time integration of JASK & Carbon Black provides high-value alerts and extended contextual investigation insights to our joint customers, all within a cloud-native environment. Background The JASK Autonomous Security Operations Center ASOC...

The vulnerability of the SAP Business Warehouse universal data integration platform, related to incorrect processing of data provided by users, allows a perpetrator to implant arbitrary codes.

The vulnerability of the SAP Business Warehouse Universal Data Integration platform is related to the improper processing of data provided by users. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

LabKey Vulnerabilities Threaten Medical Research Data

A trio of vulnerabilities in a popular open source medical data collaboration tool leaves important healthcare research data and potentially subject information open to multiple cross site scripting XSS attacks. The flaws are serious as they allow an attacker to retrieve user credentials once a...

GHSA-WR5R-M8PC-85J9 Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Data Privacy Day

January 28 is Data Privacy Day DPD, an annual effort to promote data privacy awareness and education. This year’s DPD events, sponsored by the National Cyber Security Alliance NCSA, focus around the theme, A New Era in Privacy. The NCSA Stay Safe Online website will feature a live stream of the...

Apple Releases Multiple Security Updates

Apple has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The National Cybersecurity and Communications Integration Center NCCIC, part of the Cybersecurity and...

[SECURITY] Fedora 29 Update: php-7.2.14-1.fc29

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 28 Update: php-7.2.14-1.fc28

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Xxe

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

CVE-2019-3772

The CVE-2019-3772 entry concerns Spring Integration’s XML handling in the spring-integration-xml and spring-integration-ws modules. Affected versions are 4.3.18, 5.0.10, 5.1.1, and older unsupported releases. The root cause is an XML External Entity (XXE) vulnerability when processing XML data fr...