CVE-2018-15759

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to...

CVE-2018-15759

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to...

CVE-2018-15759 On Demand Services SDK Timing Attack Vulnerability

Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious user may make many requests to the service broker with different credentials, allowing them to infer valid credentials and gain access to...

CVE-2018-15759

The CVE-2018-15759 entry applies to the Pivotal Cloud Foundry On Demand Services SDK. Affected software: On Demand Services SDK prior to 0.24. Root cause: an insecure method of verifying credentials that enables a remote, unauthenticated attacker to send numerous authentication requests with diff...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Host On-Demand

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by Host On-Demand. Host On-Demand has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-2964 DESCRIPTION: An unspecified vulnerability related to the Java SE Deployment component could...

Security Bulletin: A Security vulnerability has been identified in IBM WebSphere Application Server bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud (CVE-2017-1381)

Summary There is an information disclosure in the WebSphere Application Server Proxy Server or On-Demand-Router ODR. This only occurs when the system clock is changed. If the system clock is changed it could cause stale data to be cached and served. Vulnerability Details Consult the security...

Security Bulletin: Vulnerability in SSLv3 enabled in IBM Host On-Demand affects Rational Functional Tester (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational Host On-Demand terminal that is bundled with Rational Functional Tester for terminal emulation. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in SSLv3 enabled in IBM Host On-Demand affects Rational Functional Tester (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Rational Host On-Demand terminal that is bundled with Rational Functional Tester for terminal emulation. Vulnerability Details CVEID:...

SeaCMS cross-site scripting vulnerability (CNVD-2018-20093)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the admindatarelate.php file in SeaCMS version 6.64. A remote attacker can exploit this...

Security Bulletin: Aspera OnDemand is affected by an openSSL vulnerability (CVE-2017-3736)

Summary Aspera OnDemand has addressed the following openSSL vulnerability. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x8664 Montgomery squaring function bnsqrx8xinternal. ...

Security Bulletin: Aspera OnDemand is affected by openSSL vulnerabilities (CVE-2017-3738)

Summary Aspera OnDemand has addressed the following openSSL vulnerabilities. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery multiplication procedure used in...

AV-Comparatives: Trend Micro Mobile Security for Android Provides 100% Malware Protection for Mobile Users

With the introduction of Android v8.0 Android Oreo in August of 2017, among other OS improvements Google introduced its built-in malware protection for Android call Play Protect dependent on Google Play Services 11 or later. Play Protect checks apps and APK files downloaded from Google Play or...

Arbitrary File Deletion Vulnerability in seacms v6.61

seacms is a free and open source web content management system written in PHP. The system is mainly used to manage video-on-demand resources. seacms v6.61 version of the arbitrary file deletion vulnerability , an attacker can use the vulnerability to arbitrarily delete files...

Security Bulletin: Vulnerabilities in GSKit affect Host On-Demand (CVE-2015-0138)

Summary GSKit is an IBM component that is used by Host On-Demand.The GSKit that is shipped with Host On-Demand contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. Host On-Demand has addressed the applicable...

Security Bulletin: Rational Host On-Demand administrative interface is vulnerable to DOM XSS (CVE-2015-5002)

Summary IBM Rational Host On-Demand administrative interface is vulnerable to DOM XSS in multiple parameters, caused by improper validation of user supplied input Vulnerability Details CVEID: CVE-2015-5002 DESCRIPTION: IBM Host On-Demand is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Vulnerability in IBM® Runtime Environment affects Host On-Demand (CVE-2016-3511).

Summary There is vulnerability in IBM® Runtime Environment Java™ Version 7.0,7R1 and 8.0, that is used by Host On-Demand. This issue was disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3511 DESCRIPTION: An unspecified vulnerability in Oracle Java ...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.7SR6 that is used by IBM Rational Host On-Demand This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Host On-Demand

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.5 ,used by IBM Host On-Demand. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2016-0603)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.6 , 1.7 and 1.8 that is used by Rational Host On Demand .JRE installation executables on the Windows platform are affected by this vulnerability. Vulnerability Details CVE-ID: CVE-2016-0603 Descriptio...

Security Bulletin:: Multiple vulnerabilities in IBM Java Runtime affect IBM Host On-Demand.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.10, used by IBM Host On-Demand. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2677 DESCRIPTION: An unspecified vulnerability in Oracl...