CVE-2014-0946

The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation...

CVE-2014-0944

Cross-site request forgery CSRF vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert...

Cross site scripting

Cross-site scripting XSS vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Design/Logic Flaw

The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation...

CVE-2014-0944

Cross-site request forgery CSRF vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert...

CVE-2014-0946

The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation...

CVE-2014-0945

IBM Operational Decision Manager (UK ODM) RES Console vulnerability CVE-2014-0945 is a cross-site scripting issue in the Rule Execution Server. A remote authenticated user can exploit a crafted URL to execute script in the victim’s browser. Affected products/versions include ODM v7.5 before FP3 I...

CVE-2014-0944

IBM ODM is vulnerable to CSRF in the RES Console of Rule Execution Server. Affected: IBM WebSphere Operational Decision Manager v7.5 (before FP3 IF37), v8.0 (before MP1 FP2), and v8.5 (before MP1 IF26). Root cause described as improper validation of user-supplied input in the RES Console, enablin...

CVE-2014-0946

CVE-2014-0946 concerns IBM Operational Decision Manager (ODM) RES Console in Rule Execution Server. The vulnerability arises from missing Cache-Control HTTP headers, which could allow an attacker to obtain sensitive information from an unattended workstation. Affected products/versions include IB...

CVE-2014-0946: Exposure of Sensitive Information to an Unauthorized Actor

The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation...

CVE-2014-0944: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert...

CVE-2014-0945: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

PT-2014-3962

Name of the Vulnerable Software and Affected Versions IBM Operational Decision Manager versions 7.5 before FP3 IF37 IBM Operational Decision Manager versions 8.0 before MP1 FP2 IBM Operational Decision Manager versions 8.5 before MP1 IF26 Description A cross-site request forgery CSRF issue in the...

PT-2014-3964

Name of the Vulnerable Software and Affected Versions IBM Operational Decision Manager versions 7.5 before FP3 IF37 IBM Operational Decision Manager versions 8.0 before MP1 FP2 IBM Operational Decision Manager versions 8.5 before MP1 IF26 Description The issue concerns the RES Console in Rule...

PT-2014-3963

Name of the Vulnerable Software and Affected Versions IBM Operational Decision Manager versions 7.5 before FP3 IF37 IBM Operational Decision Manager versions 8.0 before MP1 FP2 IBM Operational Decision Manager versions 8.5 before MP1 IF26 Description A cross-site scripting XSS issue exists in the...

Optimizing Network Security with SolarWinds Firewall Security Manager (FSM)

Firewalls are the front-line soldiers, who sit strategically at the edge of your network and defend it from various security threats. Firewalls require constant maintenance and management to ensure that they are accurately configured for optimal security, continuous compliance, and high...

IBM Operational Decision Manager跨站脚本和跨站请求伪造漏洞

Bugtraq ID:66186 IBM Operational Decision Manager是一个运营决策管理平台。 IBM Operational Decision Manager存在跨站脚本和跨站请求伪造攻击，允许攻击者利用漏洞获取敏感信息，劫持用户会话或执行恶意操作。 0 IBM Operational Decision Manager 7.5.0.3 IBM Operational Decision Manager 7.5.0.4 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：...

Realistic Risk Assessment Key to Security Management

PUNTA CANA – Although it may not be the most thrilling part of a security team’s job, the idea of operational risk assessment and management is perhaps the most important aspect of organizational security. Steve Adegbite, senior vice president in charge of enterprise information security program...

Siemens WinCC 7.0 SP3 Multiple Vulnerabilities

Overview This advisory provides mitigation details for vulnerabilities that impact the Siemens SIMATIC WinCC. Positive Technologies and Siemens ProductCERT have identified multiple vulnerabilities in the Siemens SIMATIC WinCC, which is used to configure SIMATIC operator devices. Siemens has...