Design/Logic Flaw

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

Design/Logic Flaw

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution...

CVE-2020-7005

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-7005

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

Cross site request forgery (csrf)

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-6978

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries...

CVE-2020-6978

CVE-2020-6978 affects Honeywell WIN-PAK Web (and prior) versions, caused by using obsolete jQuery libraries. The Red Hat/NVD/CRON-derived records align on a Web front-end flaw enabling remote code execution under certain conditions, with CVSSv3 base score 7.2 (HIGH) and vector AV:N/AC:L/PR:N/UI:N...

CVE-2020-6982

CVE-2020-6982 is a header-injection vulnerability in Honeywell WIN-PAK 4.7.2 (Web and prior). The root cause is improper handling of HTTP headers enabling remote code execution with no authentication and no user interaction required (CVSS v3.1: 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected ...

CVE-2020-6982

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution...

CVE-2020-7005

In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code...

CVE-2020-7005

Honeywell WIN-PAK 4.7.2 (Web and prior versions) is affected by CVE-2020-7005: a cross-site request forgery vulnerability that may allow remote code execution. Affected product: WIN-PAK, a monitoring system; vulnerable component: web interface handling CSRF. Impact: remote code execution with hig...

Security Bulletin: Multiple vulnerabilities in HTTP/2 implementation used by Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary There are multiple vulnerabilities in the WebSphere Application Server Liberty HTTP/2 implementation that is used by Watson Knowledge Catalog for IBM Cloud Pak for Data. This affects various Watson Knowledge Catalog services. These vulnerabilities have been addressed. Vulnerability Detail...

Honeywell WIN-PAK Cross-Site Request Forgery Vulnerability

Honeywell WIN-PAK is a Honeywell Management System Center software package. Honeywell WIN-PAK suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to execute arbitrary code...

Honeywell WIN-PAK HTTP Header Code Execution Vulnerability

Honeywell WIN-PAK is a Honeywell Management System Center software package. Honeywell WIN-PAK has an HTTP header code execution vulnerability that can be exploited by an attacker to remotely execute code...

Unspecified Vulnerability in Honeywell WIN-PAK

Honeywell WIN-PAK is a Honeywell Management System Center software package. Honeywell WIN-PAK has a security vulnerability that can be exploited by remote attackers to compromise the system...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j

Summary IBM Watson Discovery for IBM Cloud Pak for Data ships with versions of Apache Log4j vulnerable to serialization gadgets. Vulnerability Details CVEID: CVE-2019-17571 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by improper...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by multiple vulnerabilities in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data ships with versions of Java containing multiple vulnerabilities. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to cause no confidentiality impact, high...

Security Bulletin: Multiple vulnerabilities in TLS in Cloud Pak for Automation

Summary There are multiple vulnerabilities in the TLS protocol implementation in Business Automation Insights BAI in Cloud Pak for Automation. These have been addressed. Vulnerability Details CVEID: CVE-2013-0169 DESCRIPTION: The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used...

Security Bulletin: Vulnerabilities in Samba affects IBM Watson Studio Local

Summary Vulnerabilities in Samba affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-10197 DESCRIPTION: A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration...

Security Bulletin: Vulnerabilities in Kubernetes affects IBM Watson Studio Local

Summary Vulnerabilities in Kubernetes affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-11249 DESCRIPTION: The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a...