Security Bulletin: IBM QRadar SIEM is vulnerable to Server-Side Request Forgery (SSRF) (CVE-2020-4294)

Summary IBM QRadar SIEM is vulnerable to Server-Side Request Forgery SSRF Vulnerability Details CVEID: CVE-2020-4294 DESCRIPTION: IBM QRadar SIEM is vulnerable to Server Side Request Forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially...

Security Bulletin: IBM QRadar SIEM is vulnerable to PHP object injection (CVE-2020-4271)

Summary IBM QRadar SIEM is vulnerable to PHP object injection Vulnerability Details CVEID: CVE-2020-4271 DESCRIPTION: IBM QRadar could allow an authenticated user to send a specially crafted command which would be executed as a lower privileged user. CVSS Base score: 6.3 CVSS Temporal Score: See:...

Security Bulletin: IBM QRadar SIEM is vulnerable to instantiation of arbitrary objects (CVE-2020-4272)

Summary IBM QRadar SIEM is vulnerable to vulnerable to instantiation of arbitrary objects based on user-supplied input. Vulnerability Details CVEID: CVE-2020-4272 DESCRIPTION: IBM QRadar could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted...

Security Bulletin: IBM QRadar SIEM is vulnerable to cross site scripting (XSS) (CVE-2020-4268)

Summary IBM QRadar SIEM is vulnerable to cross site scripting Vulnerability Details CVEID: CVE-2020-4268 DESCRIPTION: IBM QRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Security Bulletin: IBM QRadar SIEM is vulnerable to a publicly disclosed vulnerability in Spring Framework (CVE-2018-15756)

Summary Open source Spring Framework as used in IBM QRadar SIEM is vulnerable to a denial of service Vulnerability Details CVEID: CVE-2018-15756 Description: Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the...

Veeam Availability Console v3 Patch 2 (build 2725)

Challenge Veeam Availability Console v3 Patch 2 build 2725. This update supersedes Veeam Availability Console v3 Patch 1 build 2703. Cause Please confirm you are running version 3.0.0.2647 or later prior to installing this Patch 2. You can check this under Windows Programs and features. After...

SUSE-SU-2018:2938-1 Security update for the Linux Kernel (Live Patch 2 for SLE 15)

This update for the Linux Kernel 4.12.14-256 fixes one issue. The following security issue was fixed: - CVE-2018-10938: It was found that a crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipsov4optptr function in net/ipv4/cipsoipv4.c...

Security Bulletin: IBM QRadar SIEM contains vulnerable components and libraries. (CVE-2011-4314)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2011-4314 DESCRIPTION: OpenID4Java could allow a remote attacker to bypass security restrictions, caused by the improper...

Security Bulletin: IBM QRadar SIEM has weak password requirements. (CVE-2016-9738)

Summary The product does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-9738 DESCRIPTION: IBM QRadar does not require that users should have strong passwords by default, which...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM QRadar SIEM, and QRadar Incident Forensics (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM QRadar SIEM and QRadar Incident Forensics. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a...

CVE-2015-7610

Cross-site request forgery CSRF vulnerability in the login form in Zimbra Collaboration Suite aka ZCS before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF...

Command injection

OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in faxdispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

Cross site scripting

OpenEMR version 5.0.0 contains a Cross Site Scripting XSS vulnerability in open-flash-chart.swf and posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

CVE-2018-1000020

OpenEMR version 5.0.0 contains a Cross Site Scripting XSS vulnerability in open-flash-chart.swf and posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

CVE-2018-1000019

OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in faxdispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

CVE-2018-1000020

OpenEMR version 5.0.0 contains a Cross Site Scripting XSS vulnerability in open-flash-chart.swf and posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

CVE-2018-1000019

OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in faxdispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

CVE-2018-1000020

OpenEMR version 5.0.0 contains a Cross Site Scripting XSS vulnerability in open-flash-chart.swf and posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

CVE-2018-1000019

OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in faxdispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...

Novell GroupWise Cross-Site Scripting Vulnerability (CNVD-2017-05134)

Novell GroupWise is a collaborative communication system from Novell. The system provides collaborative communication services such as e-mail, scheduling, instant messaging, task management, document management, and contact management.Document Viewer Agent is one of the document viewers. A...