VulnCheck KEV: CVE-2017-5521

Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Monitoring (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Tivoli Monitoring. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: API Connect is affected by an information leakage vulnerability (CVE-2018-1468)

Summary API Connect has addressed the following vulnerability. An API Connect user can get access to internal environment and sensitive API details to which they are not authorized. Vulnerability Details CVEID:CVE-2018-1468 DESCRIPTION: An API Connect user can get access to internal environment a...

Security Bulletin: API Connect is affected by a session management vulnerability (CVE-2018-1532)

Summary API Connect has addressed the following vulnerability. IBM API Connect does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. Vulnerability Details CVEID: CVE-2018-1532 DESCRIPTION: IBM API Connect does no...

Security Bulletin: API Connect is affected by a generated LoopBack APIs vulnerability (CVE-2018-1389)

Summary API Connect has addressed the following vulnerability. IBM API Connect is impacted by a generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. Vulnerability Details CVEID:CVE-2018-1389 DESCRIPTION: IBM API Connect is...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM API Connect (CVE-2017-1000381, CVE-2017-11499)

Summary IBM API Connect has addressed Node.js vulnerabilities involving access to sensitive information and potential denial of service. Vulnerability Details CVEID: CVE-2017-1000381 DESCRIPTION: c-ares could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read...

Vulnerabilities include the browser of the event log, settings of distributed switches, and the content library of the management server for virtual infrastructure VMware vCenter Server, which allows attackers to access confidential information.

The vulnerability of the event log browser, distributed switch configuration settings, and the content library of the VMware vCenter Server management server is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to...

How to Deploy SecureSphere WAF on Azure

If you host apps in the cloud, then you need security in the cloud. The Imperva SecureSphere Web Application Firewall WAF identifies and acts upon dangers maliciously woven into innocent-looking website traffic, both on-premises and in the cloud, such as: Blocking technical attacks such as SQL...

Data Warehouse Permission issues

Cause MP Version 8 uses dataset rules to collect host security profiles and snapshots. When a collector is installed on an agent, there is no issue. The data is forwarded to Management Server and written to DW under the DW account. When a collector runs on a Management Server which is our use cas...

Palo Alto PAN-OS Buffer Overflow in the Management Web Interface (PAN-SA-2016-0035)

Palo Alto Networks web management server improperly handles a buffer overflow. This can result in a possible remote code execution RCE. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holder...

BSNL Teracom Router Firmware Rewrite / Link Modification

Multiple Vulnerabilities in TERACOM ROUTER Author: Ajay Gowtham aka AJOXR Contact: gowtham.ajay5 at gmail.com Vulnerability Type: Insecure Upload File Permissions Affected Module: Upload Functionality Criticality: Medium Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+...

The vulnerability of the NameSurfer IP address management server allows a malicious actor to gain unauthorized access to confidential information of the target system.

The vulnerability of the Nixu NameSurfer software lies in errors that occur when working with SOAP interfaces. Exploiting this vulnerability allows a malicious individual to gain access to confidential information of the target system...

Directory traversal

Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection SES:CSP 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices SES:CSP 6.5.0 before MP1, Critical System Protection SCSP before 5.2.9 MP6,...

Sql injection

SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection SES:CSP 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices SES:CSP 6.5.0 before MP1, Critical System Protection SCSP before 5.2.9 MP6, Data...

Directory traversal

Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection SES:CSP 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices SES:CSP 6.5.0 before MP1, Critical System Protection SCSP before 5.2.9 MP6,...

CVE-2015-8798

Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection SES:CSP 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices SES:CSP 6.5.0 before MP1, Critical System Protection SCSP before 5.2.9 MP6,...

Symantec Embedded Security: Critical System Protection and Symantec Data Center Security: Server Advanced Elevation of Privilege Vulnerabilities

Symantec Embedded Security:Critical System Protection SES:CSP and Symantec Data Center Security: Server Advanced SDCS:SA are both security products from Symantec Corporation. SES:CSP is a lightweight intrusion detection and prevention system client product; SDCS:SA provides security for physical...

Symantec Embedded Security: Critical System Protection and Symantec Data Center Security: Server Advanced SQL Injection Vulnerabilities

Symantec Embedded Security:Critical System Protection SES:CSP and Symantec Data Center Security: Server Advanced SDCS:SA are both security products from Symantec Corporation. SES:CSP is a lightweight intrusion detection and prevention system client product; SDCS:SA provides security for physical...

Symantec Embedded Security: Critical System Protection and Symantec Data Center Security: Server Adv

SUMMARY Symantec Embedded Security: Critical System Protection SES:CSP and Data Center Security: Server Advanced SDCS:SA were susceptible to security issues in the management server and deployed agents which could enable unauthorized elevated access, bypassing security protection on agents,...

IBM Rational ClearCase Unauthorized Operation Vulnerability

IBM Rational ClearCase is a suite of software configuration management solutions from IBM in the United States. The solution provides version control, workspace management, parallel development support and build auditing. A security vulnerability exists in IBM Rational ClearCase that stems from t...