PT-2019-9679

Name of the Vulnerable Software and Affected Versions Ascensia Contour NEXT ONE app for iOS versions prior to 2019-01-15 Description An issue was discovered that allows an attacker to proxy communications between the app and Ascensia backend servers due to a weak certificate-pinning implementatio...

PT-2019-9681

Name of the Vulnerable Software and Affected Versions Ascensia Contour NEXT ONE application for Android versions prior to 2019-01-15 Description An issue in the Ascensia Contour NEXT ONE application allows an attacker to reverse engineer the codebase and extract sensitive data, potentially...

PT-2019-9682

Name of the Vulnerable Software and Affected Versions Ascensia Contour NEXT ONE application for Android versions prior to 2019-01-15 Description The issue concerns a statically coded encryption key in the application. This key can be extracted, allowing an attacker to decipher communications...

PT-2019-9680

Name of the Vulnerable Software and Affected Versions Ascensia Contour NEXT ONE application for iOS and Android versions prior to 2019-01-15 Description The issue allows an attacker to retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object...

OpenJPEG DoS

The vulnerability of the functions pinextpcrl, pinextcprl, and pinextrpcl in the lib/openjp3d/pi.c library, which is used for image encoding/decoding in OpenJPEG, is related to a bug that causes division by zero. Exploiting this vulnerability could allow an attacker to cause a service failure...

DEBIAN-CVE-2019-11389

An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with next at the beginning and nested repetition operators. NOTE: the...

Can You Handle the Cyber Threats Coming in 2019?

I never thought I’d long for the days when Pikachu and Anna Kournikova worms were thriving. But back then, cyber attacks caused chaos, but not significant damage. Fast forward to 2019 and the threat landscape has changed. Now attackers are out to do significant damage to your company. This damage...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability (CNVD-2019-09071)

IBM Rational DOORS Next Generation DNG/RRC is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM, USA. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers and project...

GNU C Library Heap Buffer Overflow DoS

The vulnerability in the proceednextnode function in posix/regexec.c in the GNU C library is related to the ability to read buffers outside the memory boundary, caused by comparing with a regular expression that does not depend on registers. Exploiting this vulnerability can allow an attacker to...

Cross site scripting

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1731

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Cross site scripting

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1731

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1913

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1913

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1731

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1913

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1731

CVE-2018-1731 affects IBM DOORS Next Generation (DNG/RRC) 5.0–5.0.3 and 6.0–6.0.6. The issue is a cross-site scripting flaw in the Web UI that can cause arbitrary JavaScript execution, potentially leading to credentials disclosure within a trusted session. Affected versions are explicitly listed ...

CVE-2018-1913

Summary: CVE-2018-1913 affects IBM DOORS Next Generation (DNG/RRC) 5.0–5.0.3 and 6.0–6.0.6, with a cross-site scripting vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially expose credentials within a trusted session. The root cause involves insufficient input...

CVE-2018-1913: Improper Neutralization of Input During Web Page Generation

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...