CVE-2018-1932

IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

CVE-2018-1932: Exposure of Sensitive Information to an Unauthorized Actor

IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175...

IBM API Connect Information Disclosure Vulnerability (CNVD-2019-00559)

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. An information disclosure vulnerability exists in the role-based access control feature of the...

Nuuo Central Management Server Authenticated SQL Server SQLi

Nuuo Central Management Server v3.3 and prior are vulnerable to an authenticated SQL injection vulnerability. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details Details from module documentation in Metasploit. The GETOPENALARM verb is used to obtain information about alar...

Nuuo Central Management Server Authenticated Arbitrary File Download

Nuuo Central Management Server allows authenticated users to download files. A directory traversal flaw in the FileType header allows the user to specify a file outside of the intended directories to download. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details Details fro...

Bosch Video Management System 8.0 - Configuration Client Denial of Service (PoC)

Bosch Video Management System 8.0 - Configuration Client Denial of Service PoC Exploit Title: Bosch Video Management System 8.0-Configuration Client-Denial of Service Poc Discovery by: Daniel Discovery Date: 2018-11-12 Software Name: Bosch Video Management System Software Version: 8.0 Vendor...

Nuuo Central Management Server Authenticated Arbitrary File Upload

The COMMITCONFIG verb is used by a CMS client to upload and modify the configuration of the CMS Server. The vulnerability is in the "FileName" parameter, which accepts directory traversal ....\ characters. Therefore, this function can be abused to overwrite any files in the installation drive of...

Nuuo Central Management Server Authenticated Arbitrary File Download

The Nuuo Central Management Server allows an authenticated user to download files from the installation folder. This functionality can be abused to obtain administrative credentials, the SQL Server database password and arbitrary files off the system with directory traversal. The module will...

Security Bulletin: IBM API Connect is vulnerable to Server Side Request Forgery (CVE-2018-1789)

Summary IBM API Connect has addressed the following vulnerability: IBM API Connect is vulnerable to Server Side Request Forgery via a proxy service. Vulnerability Details CVEID: CVE-2018-1789 DESCRIPTION: IBM API Connect v2018.x could allow an attacker to send a specially crafted request to condu...

Symantec Encryption Management Server Denial of Service Vulnerability

Symantec Encryption Management Server formerly known as Symantec PGP Universal Server, SEMS is a suite of encryption management servers from the U.S.-based Symantec Symantec. The server provides key management, monitoring data status, single sign-on and other functions. A denial of service...

Design/Logic Flaw

The Symantec Encryption Management Server SEMS product, prior to version 3.4.2 MP1, may be susceptible to a denial of service DoS exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by...

CVE-2018-5243

The Symantec Encryption Management Server SEMS product, prior to version 3.4.2 MP1, may be susceptible to a denial of service DoS exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by...

CVE-2018-5243

CVE-2018-5243 affects the Symantec Encryption Management Server (SEMS) prior to version 3.4.2 MP1 . The issue is described as a denial-of-service vulnerability; the exact root cause is not detailed in the provided documents. Impact is listed as DoS with partial to high availability impact dependi...

CVE-2018-5243: Uncontrolled Resource Consumption

The Symantec Encryption Management Server SEMS product, prior to version 3.4.2 MP1, may be susceptible to a denial of service DoS exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular machine or network resource unavailable to its intended users by...

Symantec Encryption Management Server - Denial of Service

SUMMARY Symantec has released an update to address an issue in the Symantec Encryption Management Server product. AFFECTED PRODUCTS Symantec Encryption Management Server SEMS --- CVE | Affected Versions | Remediation CVE-2018-5243 | Prior to 3.4.2 MP1 | Upgrade to 3.4.2 MP1 ISSUES CVE-2018-5243 -...

VulnCheck KEV: CVE-2017-5521

Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Monitoring (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Tivoli Monitoring. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: API Connect is affected by an information leakage vulnerability (CVE-2018-1468)

Summary API Connect has addressed the following vulnerability. An API Connect user can get access to internal environment and sensitive API details to which they are not authorized. Vulnerability Details CVEID:CVE-2018-1468 DESCRIPTION: An API Connect user can get access to internal environment a...

Security Bulletin: API Connect is affected by a session management vulnerability (CVE-2018-1532)

Summary API Connect has addressed the following vulnerability. IBM API Connect does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. Vulnerability Details CVEID: CVE-2018-1532 DESCRIPTION: IBM API Connect does no...

Security Bulletin: API Connect is affected by a generated LoopBack APIs vulnerability (CVE-2018-1389)

Summary API Connect has addressed the following vulnerability. IBM API Connect is impacted by a generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing unauthorized modification of information. Vulnerability Details CVEID:CVE-2018-1389 DESCRIPTION: IBM API Connect is...