Progress Software Releases Service Pack for MOVEit Transfer Vulnerabilities

Progress Software has released a Service Pack to address three newly disclosed vulnerabilities CVE-2023-36934, CVE-2023-36932, CVE-2023-36933 in MOVEit Transfer. A cyber threat actor could exploit some of these vulnerabilities to obtain sensitive information. CISA encourages users to review...

WordPress WordPress Mobile Pack Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress Mobile Pack Type Plugin Vulnerable versions = 3.4.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37391 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 786a1130ef08 Credits LEE SE HYOUNG...

WordPress Mobile Pack <= 3.4.1 - Cross-Site Request Forgery

The plugin does not properly validate requests use nonces, leading to a Cross-Site Request Forgery CSRF vulnerability...

Security Bulletin: Denial of Service Vulnerability in Apache Solr used by IBM Operations Analytics - Log Analysis

Summary There is a potential denial of service in Apache Solr that is used by IBM Operations Analytics - Log Analysis Vulnerability Details IBM X-Force ID: 216835 DESCRIPTION: Apache Lucene is vulnerable to a denial of service. By sending a specific regular expression query, a remote attacker cou...

SUSE CVE-2009-3571

Unspecified vulnerability in OpenOffice.org OOo has unknown impact and client-side attack vector, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco...

org.keycloak:keycloak-authz-policy-drools (3.2.0.final), org.keycloak:keycloak-dependencies-server-all (3.2.0.final) +6 more potentially affected by CVE-2023-2422 via org.keycloak:keycloak-services (3.2.0.final)

org.keycloak:keycloak-services MAVEN version 3.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.2.0.final -...

org.keycloak:keycloak-authz-policy-drools (3.3.0.cr2), org.keycloak:keycloak-dependencies-server-all (3.3.0.cr2) +6 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (3.3.0.cr2)

org.keycloak:keycloak-services MAVEN version 3.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.3.0.cr2 -...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

org.keycloak:keycloak-dependencies-server-all (10.0.0), org.keycloak:keycloak-dependencies-server-min (10.0.0) +5 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (10.0.0)

org.keycloak:keycloak-services MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.0 - org.keycloak:keycloak-dependencies-server-m...

org.keycloak:keycloak-authz-policy-drools (3.2.1.final), org.keycloak:keycloak-dependencies-server-all (3.2.1.final) +6 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (3.2.1.final)

org.keycloak:keycloak-services MAVEN version 3.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.2.1.final -...

org.keycloak:keycloak-authz-policy-drools (3.4.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.4.0.cr1) +6 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (3.4.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.0.cr1 -...

org.keycloak:keycloak-authz-policy-drools (3.4.1.final), org.keycloak:keycloak-dependencies-server-all (3.4.1.final) +6 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (3.4.1.final)

org.keycloak:keycloak-services MAVEN version 3.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.1.final -...

org.keycloak:keycloak-authz-policy-drools (3.2.0.final), org.keycloak:keycloak-dependencies-server-all (3.2.0.final) +6 more potentially affected by CVE-2022-4361 via org.keycloak:keycloak-services (3.2.0.final)

org.keycloak:keycloak-services MAVEN version 3.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.2.0.final -...

org.keycloak:keycloak-authz-policy-drools (3.4.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.4.0.cr1) +6 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (3.4.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.0.cr1 -...

org.keycloak:keycloak-authz-policy-drools (6.0.0), org.keycloak:keycloak-dependencies-server-all (6.0.0) +8 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (6.0.0)

org.keycloak:keycloak-services MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 6.0.0 - org.keycloak:keycloak-dependencies-server-all 6.0...

org.keycloak:keycloak-authz-policy-drools (3.4.0.final), org.keycloak:keycloak-dependencies-server-all (3.4.0.final) +6 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-services (3.4.0.final)

org.keycloak:keycloak-services MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.0.final -...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to the Angular JS (CVE-2023-26116, CVE-2023-26117, CVE-2023-26118)

Summary The Discovery Connectors in IBM App Connect Enterprise are vulnerable to a denial of service due to the Angular JS CVE-2023-26116, CVE-2023-26117, CVE-2023-26118. The fix removes Angular JS. Vulnerability Details CVEID:CVE-2023-26117 DESCRIPTION: AngularJS is vulnerable to a denial of...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js (CVE-2023-0842)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js CVE-2023-0842. The latest Fix Pack includes xml2js version 5.0 Vulnerability Details CVEID:CVE-2023-0842 DESCRIPTION: xml2js could allow a remote attacker to execute arbitrary...

Security Bulletin: There is a vulnerability in GraphQL used by IBM Maximo Asset Management (CVE-2023-28867)

Summary There is a vulnerability in GraphQL used by IBM Maximo Asset Management Vulnerability Details CVEID:CVE-2023-28867 DESCRIPTION: GraphQL Java is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially crafted GraphQL query, a remote attacker could...

Security Bulletin: A security vulnerability has been identified in OpenSSL, which is shipped with IBM Tivoli Network Manager IP Edition (CVE-2018-5407)

Summary OpenSSL is shipped with IBM Tivoli Network Manager IP Edition version 3.9. Information about a security vulnerability affecting Open SSL has been published here. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Multiple SMT/Hyper-Threading architectures and processors could allow a...