6006 matches found
CVE-2018-1385
CVE-2018-1385 is referenced in IBM API Connect security bulletin: it describes use of weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Affected IBM API Connect versions are 5.0.0.0–5.0.6.5, 5.0.7.0–5.0.7.2, and 5.0.8.0–5.0.8.1. Re...
CVE-2016-6041
IBM Tealeaf Customer Experience (IBM Tealeaf CX) is affected by CVE-2016-6041: the product does not properly secure session cookies, potentially allowing an authenticated user to obtain sensitive information. Affected versions include IBM Tealeaf CX v8.7 through v9.0.2. Remediation paths are prov...
CVE-2017-1634
IBM Financial Transaction Manager (FTM) for ACH Services and FTM for Corporate Payment Services are affected by CVE-2017-1634, a cross-site scripting (XSS) vulnerability that allows an attacker to inject arbitrary JavaScript into the Web UI, potentially exposing credentials within a trusted sessi...
CVE-2018-1365
Summary: CVE-2018-1365 affects IBM Cloud Event Management and IBM Alert Notification when viewed in Internet Explorer. The vulnerability allows an attacker to hijack a victim’s click actions by loading the affected console in an iframe not belonging to the system, potentially enabling further att...
CVE-2017-1797
IBM Kenexa LCMS Premier on Cloud is affected by a SQL injection vulnerability tracked as CVE-2017-1797. A remote attacker could send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. Affected versions include 9.3 through 11.1; remediation is to upgrad...
The vulnerability of the loading function for the Organization/Practice module of the New Open Source Health (NOSH) ChartingSystem electronic medical record system allows a hacker to execute any code and gain full control over the system.
The vulnerability of the loading function for the Organization/Practice module of the New Open Source Health NOSH ChartingSystem electronic medical record system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrar...
apiaa.org.tw Cross Site Scripting vulnerability OBB-3198766
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ProxyShellMiner Exploits Windows Exchange Server Vulnerabilities for Cryptocurrency Mining
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ProxyShellMiner exploits Windows Exchange servers vulnerabilities, which are used to gain unauthorized access and compromise an organization, leading to the installation of cryptocurrency miners...
specialove.org Improper Access Control vulnerability OBB-3197957
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2017-16032
CVE-2017-16032 is a DoS vulnerability in the brace-expansion component used by IBM MobileFirst Platform Foundation 8.x.x. The IBM bulletin lists brace-expansion as vulnerable to regular expression denial of service (ReDoS) via crafted arguments, with affected versions tied to IBM MobileFirst Plat...
ProxyShellMiner Exploits Windows Exchange Server Vulnerabilities for Cryptocurrency Mining
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ProxyShellMiner exploits Windows Exchange servers vulnerabilities, which are used to gain unauthorized access and compromise an organization, leading to the installation of cryptocurrency miners...
SUSE CVE-2014-3654
Multiple cross-site scripting XSS vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network RHN Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 kickstart/cobbler/CustomSnippetList.do, 2...
SUSE CVE-2014-8183
It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...
SUSE CVE-2017-7538
A cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users...
SUSE CVE-2017-1000106
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...
SUSE CVE-2017-1000110
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...
SUSE CVE-2019-20397
A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...
SUSE CVE-2021-36157
An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that...