Information disclosure

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2020-4854

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

CVE-2020-4854

IBM Spectrum Protect Plus versions 10.1.0–10.1.6 contain hard-coded credentials used for inbound authentication, outbound communication, or data encryption, representing a high-severity vulnerability (CVSS v3.1 score up to 9.8) with network exposure. The root cause is embedded credentials in the ...

CVE-2020-4783

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2020-4783

CVE-2020-4783 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.6. Root cause: failure to properly enable HTTP Strict Transport Security, enabling information disclosure via man-in-the-middle. Impact: remote attacker could obtain sensitive information over network (TLS/HTTPS). Affected produ...

Security Bulletin: Vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-5408 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to obtain...

Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft Windows File Systems agent (CVE-2020-15801)

Summary There is a vulnerability in Python that could allow a local attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent. Vulnerability Details CVEID: CVE-2020-15801 DESCRIPTION: Python could allow a...

Security Bulletin: IBM Spectrum Protect Plus allows use of TLS Version 1.1 protocols (CVE-2020-4783)

Summary IBM Spectrum Protect Plus should disable the use of TLS Version 1.1 protocols as this could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4783 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to obtain sensitive...

Vulnerabilities fixed in Trend Micro products

Vulnerabilities have been fixed in Trend Micro Internet Security and Anti-Virus+ Security. The vulnerabilities allow a local malicious party potentially able to obtain elevated privileges by inserting rogue DLL files. Trend Micro has released updates to address the vulnerabilities. fixes. More...

IBM Spectrum Protect Plus 信息泄露漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0 through 10.1.6. The...

IBM Spectrum Protect Plus 信任管理问题漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A hard-coded credentials vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can...

Security feature bypass

A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect...

CVE-2020-8267

A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect...

Apple Security Update: iOS 12.4.9

Apple recommends to install security update iOS 12.4.9 on devices iPhone 5s, iPhone 6 and 6 Plus, iPad Air, iPad mini 2 and 3, iPod touch 6th generation...

PT-2020-15542 · Jenkins · Jenkins Sqlplus Script Runner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SQLPlus Script Runner Plugin versions 2.0.12 and earlier Description: The issue concerns the Jenkins SQLPlus Script Runner Plugin, where a password provided as a command line argument is not masked in build logs. This allows users wit...

plus-it.ch Cross Site Scripting vulnerability OBB-1461849

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

help.imperium.plus Cross Site Scripting vulnerability OBB-1442418

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-14767

Vulnerability in the Hyperion BI+ product of Oracle Hyperion component: IQR-Foundation service. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise Hyperion BI+. Successful...

CVE-2020-14770

Vulnerability in the Hyperion BI+ product of Oracle Hyperion component: IQR-Foundation service. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise Hyperion BI+. Successful...

The vulnerability of the GDI+ component in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Windows Graphics Device Interface Plus GDI+ component in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...