CVE-2019-4584

CVE-2019-4584 is an IBM Db2 local-privilege-escalation vulnerability. IBM Db2 for Linux, UNIX and Windows (including Db2 Connect) is vulnerable to a buffer overflow that could allow an authenticated local attacker to execute arbitrary code on the system as root. The issue affects all fix pack lev...

CVE-2019-4622

CVE-2019-4622 is an IBM cross-site scripting vulnerability affecting multiple IBM Financial Transaction Manager modules (e.g., FTM CPS, FTM ACH, FTM CHK, FTM DP, and Digital Payments variants). The flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclos...

CVE-2019-4618

CVE-2019-4618 is confirmed in IBM InfoSphere Metadata Asset Manager (and Information Server on Cloud) with a Stored cross-site scripting vulnerability. Affected products/versions include IBM InfoSphere Metadata Asset Manager: 11.3, 11.5, 11.7 and IBM InfoSphere Information Server on Cloud: 11.5, ...

CVE-2019-4580

CVE-2019-4580 affects IBM Resilient OnPrem versions prior to 35.2. The IBM bulletin shows the vulnerability arises from weaker cryptographic algorithms used by Resilient, enabling potential decryption of highly sensitive information. Affected product versions: IBM Resilient v33.x and v34.x. Remed...

CVE-2019-4532

CVE-2019-4532 affects IBM Resilient OnPrem. The vulnerability exists in IBM Resilient versions 33.x and 34.0 where the platform does not properly limit the number or frequency of interactions with an actor (e.g., password reset requests). This could enable abuse of reset flows. Remediation: upgra...

CVE-2019-4097

CVE-2019-4097 is a spoofing vulnerability in Platform System Manager (PSM) shipped with IBM Cloud Pak System/PureApplication System. An authenticated user could steal or manipulate customer sessions and cookies. Affected product: IBM Cloud Pak System (V2.3.0). CVSS Base score 4.3. Remediation: up...

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...

CVE-2021-22476

IBM WebSphere Application Server Liberty (and Open Liberty) versions 17.0.0.3–22.0.0.9 are cited in the IBM bulletin as affected by CVE-2021-22476, with remediation through upgrading to IBM Watson Explorer 12.0.3.10 components (oneWEX, Analytical, Foundational) and applying the corresponding Fix ...

Ltd. cloud cold chain management system has SQL injection vulnerability

Ltd. is a high-tech company that focuses on people's health, safety and well-being, and is a high-tech enterprise that integrates industrial and personal product development, design, manufacturing and sales to maintain people's health and assist organizations in maintaining the health and safety ...

CVE-2022-3102

CVE-2022-3102 affects the jwcrypto library, where the JWT/JWE handling can allow token substitution that may lead to authentication or authorization bypass. The issue arises from jwcrypto’s ability to auto-detect token types (JWS vs JWE) and, under certain conditions, substitute a signed JWS with...

rayonet.org Cross Site Scripting vulnerability OBB-2938201

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-3227

CVE-2022-3227 corresponds to a Local File Inclusion flaw in the WordPress plugin SearchWP Live Ajax Search (versions

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-1972

Removed by vendor...

CVE-2019-4479

CVE-2019-4479 is linked to IBM Business Process Manager (BPM) and IBM Business Automation Workflow (BAW). The connected IBM bulletins describe two concrete exposure types: (1) SQL injection allowing a remote attacker to view/modify/delete data via crafted SQL, affecting BPM/BAW across multiple ve...

CVE-2018-1849

CVE-2018-1849 is a Cross-Site Scripting vulnerability in IBM Business Automation Workflow (BPM/BPM Advanced/BPM Explorer) that allows embedding arbitrary JavaScript in the web UI, potentially exposing credentials in a trusted session. Affected products and versions include: IBM Business Automatio...

InsightVM: Best Practices to Improve Your Console

Over the years, our recommendations and best practices for the InsightVM console have changed with the improvements and updates we’ve made to the system. Here are some of the most common improvements to help you get the most out of your InsightVM console in 2022. Ensure everything is up to date T...

CVE-2019-25074

CVE-2019-25074 is a FRRouting FRR defect where the IS-IS daemon has a memory leak that can exhaust server memory. The SUSE/SUSE-SU-2022:3246-1 advisory fixes this issue (and relates to a separate CVE-2022-37032 BGP out-of-bounds read). OpenVAS entries reference the same SUSE update for SLES/SUSE ...