CVE-2020-4845

IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2020-4846

IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190290...

ALPINE-CVE-2020-29480

An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest...

Design/Logic Flaw

An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest...

PT-2020-6776

Name of the Vulnerable Software and Affected Versions Xen versions through 4.14.x Description An issue was discovered in Xen where neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will...

[SECURITY] Fedora 33 Update: containerd-1.4.3-1.fc33

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Lin ux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervisio...

The vulnerability of the vRealize Suite Lifecycle Manager software, a virtualization platform from VMware Cloud Foundation, and administration consoles like VMware Identity Manager and VMware Workspace One Access, arises due to insufficient validation of arguments passed to commands. This allows attackers to execute arbitrary commands.

The vulnerability of the vRealize Suite Lifecycle Manager software, a virtualization platform from VMware Cloud Foundation, as well as the VMware Identity Manager administration consoles and VMware Workspace One Access application management platform, is related to insufficient validation of...

Security Bulletin: Passwords stored in reversible manner in Security Key Lifecycle Manager (SKLM) (CVE-2020-4568)

Summary The ssl.client.props in WebSphere Application Server uses the weak WAS XOR protection mechanism for keystore and truststore passwords. Security Key Lifecycle Manager v4.0 adds code to encrypt these instead. There are some manual steps required to make use of the new capability in v4.0...

Critical Unpatched VMware Flaw Affects Multiple Corporates Products

VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system. "A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the...

SugarCRM 6.5.18 - Persistent Cross-Site Scripting

Exploit Title: SugarCRM 6.5.18 - Persistent Cross-Site Scripting Exploit Author: Vulnerability-Lab Date: 2020-11-16 Vendor Homepage: https://www.sugarcrm.com Version: 6.5.18 Document Title: =============== SugarCRM v6.5.18 - Contacts Persistent Cross Site Web Vulnerability References Source:...

IBM Tivoli Key Lifecycle Manager Information Disclosure Vulnerability

IBM Tivoli Key Lifecycle Manager enables you to locally create, distribute, back up, archive and manage the lifecycle of keys and certificates in your organization. An information disclosure vulnerability exists in IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0. The vulnerability stems from...

CVE-2020-4568

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157...

CVE-2020-4568

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157...

Sql injection

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157...

CVE-2020-4568

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157...

CVE-2020-4568

Summary of CVE-2020-4568 (IBM Tivoli Key Lifecycle Manager) : Affected products are IBM Security Key Lifecycle Manager (KLM) versions 3.0, 3.0.1, and 4.0. The root cause is storing user credentials in plain text that can be read by a local user. IBM’s bulletin confirms an information disclosure r...

PT-2020-18137

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.0 Description The issue allows a local user to read user credentials stored in plain text. Recommendations For IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.0, consider...

The vulnerability of the Shared Services component of the Hyperion Lifecycle Management system allows a attacker to access data for modification, addition, or deletion.

The vulnerability of the Shared Services component of the Hyperion Lifecycle Management system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data using the HTTP network protocol...

The vulnerability of the Shared Services component of the Hyperion Lifecycle Management system allows a attacker to access data for modification, addition, or deletion.

The vulnerability of the Shared Services component of the Hyperion Lifecycle Management system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or delete data using the HTTP network protocol...

CVE-2020-4568: Insufficiently Protected Credentials

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157...