PT-2020-13930

Name of the Vulnerable Software and Affected Versions WebFOCUS Business Intelligence version 8.0 SP6 Description The administration portal in the affected software allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to "/ibi...

PT-2020-13929

Name of the Vulnerable Software and Affected Versions WebFOCUS Business Intelligence version 8.0 SP6 Description The issue allows for a Cross-Site Request Forgery CSRF attack against administrative users. This can be exploited through the "/ibi apps/WFServlet.ibfs" endpoint, potentially leading t...

A Report Blames ‘CIA Failures’ for the Agency's Worst Hack

A series of WikiLeaks disclosures that exposed a trove of the intelligence organization's secrets could have been avoided, a task force found...

Theft of CIA's "Vault Seven" Hacking Tools Due to Its Own Lousy Security

The Washington Post is reporting on an internal CIA report about its "Vault 7" security breach: The breach -- allegedly committed by a CIA employee -- was discovered a year after it happened, when the information was published by WikiLeaks, in March 2017. The anti-secrecy group dubbed the release...

Theft of CIA's 'Vault 7' Secrets Tied to 'Woefully Lax" Security

A just-released report on the 2016 Central Intelligence Agency CIA data breach, which led to the Vault 7 document dump on WikiLeaks, blames “woefully lax” security by the nation’s top spy agency. The conclusions were part of an internal 2017 Department of Justice DoJ report on the CIA breach. On...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2019-4670)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2020-4276)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Zero Trust—Part 1: Networking

Enterprises used to be able to secure their corporate perimeters with traditional network controls and feel confident that they were keeping hackers out. However, in a mobile- and cloud-first world, in which the rate and the sophistication level of security attacks are increasing, they can no...

CVE-2020-6269

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

CVE-2020-6269

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

Information disclosure

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

PT-2020-19064

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an attacker to access restricted information under certain conditions, leading to information disclosure. Recommendations For SAP Business Objects...

CVE-2020-6269: Undefined Security Weakness

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure...

Can Governments Defeat Nation-State Attacks on Critical Infrastructures?

For physical conflicts, we expect our government to protect us from nation-state adversaries. It turns out, though, that industrial enterprises are much better positioned to defeat most nation-state attacks on power plants, pipelines, and other critical infrastructures than governments are. For...

Oracle Business Intelligence Enterprise Edition Analytics Web General Full Control

The vulnerability of the Analytics Web General component of the Oracle Business Intelligence Enterprise Edition software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full control over the application through the HTTP network...

CVE-2020-11844

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight...

Authorization

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight...

CVE-2020-11844 Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities.

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerabilities. Jackson-databind has known vulnerabilities in IBM Identity Governance and Intelligence. Vulnerability Details CVEID: CVE-2017-15095 DESCRIPTION: Jackson Library...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerabilities. Jackson-databind-2.8.11.2 library has known vulnerabilities in IBM Identity Governance and Intelligence. Vulnerability Details CVEID: CVE-2018-1000873 DESCRIPTION...