Security Bulletin: IBM InfoSphere Master Data Management Server vulnerability in OpenSSL

Summary The vulnerability in CVE-2020-1968, CVE-2020-1971, CVE-2021-23839, CVE-2021-23840, CVE-2021-23841 have been addressed in the latest interim Fix iFix available on Fix Central for all 3 affected versions. Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote...

Security Bulletin: InfoSphere Master Data Management 11.6 affected due to vulnerability in OpenSSL

Summary InfoSphere Master Data Management 11.6 affected due to vulnerability in OpenSSL 1.0.2s and prior. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group...

Security Bulletin: IBM InfoSphere Master Data Management Server is vulnerable to cross-site scripting (XSS) Attack (CVE-2017-1199)

Summary IBM InfoSphere Master Data Management is vulnerable to a cross-site scripting XSS Attack and could allow users to embed arbitrary JavaScript code in the Web UI and lead to disclosure of credentials. Vulnerability Details CVEID: CVE-2017-1199 DESCRIPTION: IBM InfoSphere Master Data...

Security Bulletin: Denial of service vulnerability in OpenSSL affects IBM InfoSphere Master Data Management (CVE-2016-8610)

Summary IBM Initiate Master Data Service and IBM InfoSphere Master Data Management are vulnerable to a OpenSSL denial of service attack and could cause the application to stop responding. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: SSL/TLS protocol is vulnerable to a denial of service...

Security Bulletin: IBM InfoSphere MDM Reference Data Management affected by Cross Site Scripting vulnerabilities(CVE-2015-1910)

Summary IBM InfoSphere MDM Reference Data Management is vulnerable to Cross Site Scripting attack caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-1910 DESCRIPTION: IBM InfoSphere Master Data Management Server is vulnerable to cross-site scripting, cause...

Security Bulletin: Cross-Site Request Forgery vulnerability in IBM InfoSphere Master Data Management Server (CVE-2014-0873)

Summary The IBM InfoSphere Master Data Management Server User Interfaces are vulnerable to Cross-Site Request Forgery attacks. Vulnerability Details CVE ID: CVE-2014-0873 DESCRIPTION: Due to insufficient safeguards against cross-site request forgery in the IBM InfoSphere Master Data Management...

Security Bulletin: The IBM® Runtime Environments Java™ version shipped with IBM MDM SE engine, Workbench, and Brokers may not address all security vulnerabilities

Summary IBM® Runtime Environment Java™ Technology Edition, Version 1.6 shipped with IBM MDM SE engine, Workbench, and Brokers contains multiple vulnerabilities. IBM MDM SE engine, Workbench, and Brokers has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A...

Security Bulletin: IBM InfoSphere Master Data Management Collaborative Edition affected by Cross-site Scripting security vulnerabilities (CVE-2015-7423)

Summary IBM InfoSphere Master Data Management - Collaborative Edition is vulnerable to Cross-Site Scripting. Vulnerability Details CVEID:CVE-2015-7423 DESCRIPTION: IBM InfoSphere Master Data Management Collaborative Edition is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: IBM InfoSphere MDM Reference Data Management affected by XML External Entity vulnerability(CVE-2015-1909)

Summary IBM MDM InfoSphere Reference Data Management is vulnerable to XML External Entity attack caused by weakly configured XML parser. Vulnerability Details CVEID: CVE-2015-1909 DESCRIPTION: IBM InfoSphere Master Data Management Server could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM Maximo Anywhere applications have no binary obfuscation

Summary IBM Maximo Anywhere applications have no binary obfuscation of source code allowing the applications to be de-compiled. Vulnerability Details CVEID: CVE-2019-4291 DESCRIPTION: IBM Maximo Anywhere could allow an attacker to reverse engineer the application due to the lack of binary...

Security Bulletin: IBM Maximo Anywhere applications have no binary obfuscation

Summary IBM Maximo Anywhere applications have no binary obfuscation of source code allowing the applications to be de-compiled. Vulnerability Details CVEID: CVE-2019-4352 DESCRIPTION: IBM Maximo Anywhere applications could allow obfuscation of the application source code. CVSS Base score: 2.4 CVS...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of Abbreviation, Longname, Converter Service at "Settings" = "Data Objects" = "Quantity Value" in the...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Vuln : Stored XSS Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of name at "Setinngs" = "Website Settings" in the pimcore service. Proof of Concept...

Securing mobile devices. A timely reminder

While home working might now be the norm for some, more and more people are going back to their place of work on a more regular basis. If you’re commuting again or if you’re responsible for securing your people’s devices it’s a good idea to revisit and review your security admin for mobile device...

MDM Profile on iOS 15/iPadOS 15 and macOS 12 devices shows as “Not Verified” or “Unverified” – On-Prem

Currentenrolleddevices that were upgraded from iOS 14/iPadOS14 orearlierto iOS/iPadOS15ornewly enrolled devices on iOS/iPadOS15may show “Not Verified” under the device“Settings General VPN & deviceManagementCitrix Workspace MDM Profile” Currentenrolled devices that were upgraded from macOS 11or...

MDM Profile on iOS 15/iPadOS 15 and macOS 12 devices shows as “Not Verified” or “Unverified”

Currentenrolleddevices that were upgraded from iOS 14/iPadOS14 or earlierto iOS/iPadOS15ornewly enrolled devices on iOS/iPadOS15may show “Not Verified” under the device“Settings General VPN & deviceManagementCitrix Workspace MDM Profile” Currentenrolled devices that were upgraded from macOS 11or...

CVE-2020-4675

IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186324...

CVE-2020-4675

CVE-2020-4675 affects IBM InfoSphere Master Data Management Server (11.6). The root issue is a CSRF vulnerability in the web application where referer-header validation relies on an allowlist and can be bypassed by attacker-controlled subdomains, enabling CSRF to trigger malicious actions without...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

✍️ Description pimcore is a Open Source Data & Experience Management Platform PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce this package is vulnerable for Stored XSS thru gender tag 🕵️‍♂️ Proof of Concept 💥 Impact This vulnerability is capable of stored xss 📍 Location Gender.phpL21...

Samsung KCS License Issue Vulnerability

Samsung KCS is a Knox cloud service from Samsung in South Korea. A security vulnerability exists in KCS versions prior to 1.39, which stems from an improper MDM policy management vulnerability in the KME module that can be exploited by an attacker to bypass Knox Manage authentication...