dnsdpg.org Cross Site Scripting vulnerability OBB-3201360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2018-1613

CVE-2018-1613 is a confirmed vulnerability in IBM Platform Symphony and IBM Spectrum Symphony involving a vertical authorization bypass in the Symping utility. A local attacker could obtain a privileged token and gain privileges or access highly sensitive data. Affected products/versions: IBM Pla...

CVE-2018-1707

CVE-2018-1707 is a stored cross-site scripting (XSS) vulnerability affecting IBM Platform Symphony and IBM Spectrum Symphony. Affected products/versions: Platform Symphony 7.1 Fix Pack 1 and 7.1.1; Spectrum Symphony 7.1.2 and 7.2.0.2. The vulnerability allows an attacker to embed arbitrary JavaSc...

CVE-2018-1681

CVE-2018-1681 affects IBM Data Science Experience Local. The IBM security bulletin confirms a vulnerability that could disclose highly sensitive information to a local unprivileged user. Affected versions are IBM Data Science Experience Local 1.1.0, 1.1.1, 1.1.2, 1.1.3, and 1.2.0. The remediation...

CVE-2018-1919

IBM Security Bulletin for CVE-2018-1919 details a local privilege-escalation in the SUID handling of the egosh binary in IBM Platform Symphony and IBM Spectrum Symphony. When starting a host with egosh ego start, the egosh binary is run with root SUID, creating a potential path for a non-root use...

CVE-2018-1769

CVE-2018-1769 affects IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center). The vulnerability occurs when tracing is enabled for OC_TASKS, causing the monitoring ID password to be written in plaintext to trace files. Affected versions are 8.1.0.000–8.1.6.100 ...

CVE-2018-1855

CVE-2018-1855 is an IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) cross-site scripting vulnerability. Versions affected: 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1.9.100. The flaw allows a remote attacker to inject arbitrary JavaScript into the Web UI, pote...

CVE-2018-1854

IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) is affected by CVE-2018-1854: a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Affected versions are 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1...

CVE-2018-1589

CVE-2018-1589 is documented in IBM’s Multi-Cloud Data Encryption (MDE) security bulletin as a denial-of-service vulnerability. The issue occurs because MDE does not properly restrict the size or amount of resources requested or influenced by an actor, allowing resource consumption beyond intended...

CVE-2017-1579

CVE-2017-1579 is addressed in IBM DOORS Next Generation (DNG/RRC). The IBM Security Bulletin reports a cross-site scripting vulnerability in the Web UI of Rational DOORS Next Generation, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted sessi...

CVE-2012-1359

CVE-2012-1359, as reserved, has a connected IBM advisory detailing multiple security vulnerabilities in IBM JRE 7.0 SR2 or earlier (and non-IBM Java 7.0 when used with Rational Functional Tester). The bulletin lists numerous CVEs (e.g., CVE-2012-3159 and related issues across JRE components such ...

CVE-2018-1385

CVE-2018-1385 is referenced in IBM API Connect security bulletin: it describes use of weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Affected IBM API Connect versions are 5.0.0.0–5.0.6.5, 5.0.7.0–5.0.7.2, and 5.0.8.0–5.0.8.1. Re...

CVE-2016-6041

IBM Tealeaf Customer Experience (IBM Tealeaf CX) is affected by CVE-2016-6041: the product does not properly secure session cookies, potentially allowing an authenticated user to obtain sensitive information. Affected versions include IBM Tealeaf CX v8.7 through v9.0.2. Remediation paths are prov...

CVE-2017-1634

IBM Financial Transaction Manager (FTM) for ACH Services and FTM for Corporate Payment Services are affected by CVE-2017-1634, a cross-site scripting (XSS) vulnerability that allows an attacker to inject arbitrary JavaScript into the Web UI, potentially exposing credentials within a trusted sessi...

CVE-2018-1365

Summary: CVE-2018-1365 affects IBM Cloud Event Management and IBM Alert Notification when viewed in Internet Explorer. The vulnerability allows an attacker to hijack a victim’s click actions by loading the affected console in an iframe not belonging to the system, potentially enabling further att...

CVE-2017-1797

IBM Kenexa LCMS Premier on Cloud is affected by a SQL injection vulnerability tracked as CVE-2017-1797. A remote attacker could send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. Affected versions include 9.3 through 11.1; remediation is to upgrad...

The vulnerability of the loading function for the Organization/Practice module of the New Open Source Health (NOSH) ChartingSystem electronic medical record system allows a hacker to execute any code and gain full control over the system.

The vulnerability of the loading function for the Organization/Practice module of the New Open Source Health NOSH ChartingSystem electronic medical record system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrar...

apiaa.org.tw Cross Site Scripting vulnerability OBB-3198766

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ProxyShellMiner Exploits Windows Exchange Server Vulnerabilities for Cryptocurrency Mining

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ProxyShellMiner exploits Windows Exchange servers vulnerabilities, which are used to gain unauthorized access and compromise an organization, leading to the installation of cryptocurrency miners...

specialove.org Improper Access Control vulnerability OBB-3197957

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...