CVE-2022-35009

PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asanmalloclinux.cpp...

PT-2022-22486

Name of the Vulnerable Software and Affected Versions PNGDec affected versions not specified Description A memory allocation problem was discovered in PNGDec via asan malloc linux.cpp. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

Hotkey "CTRL+Break" does not work on Windows VDA through Citrix Workspace app for Linux Clients

The CTRL+Break hotkey does not work if we launch a Windows VDA session from a Citrix Workspace for Linux client. Steps to reproduce the issue 1. Open the Windows Command Prompt in the Windows VDA session from Citrix Workspace for Linux client. 2. Run the "ping -t google.com" command 3. Press the...

The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors

How Wiz Research uncovered multiple related vulnerabilities in PostgreSQL-as-a-Service offerings from GCP, Azure, and others...

Small-time cybercrime is about to explode — We aren't ready

By Nick Biasini. The cybersecurity industry tends to focus on extremely large-scale or sophisticated, state-sponsored attacks. Rightfully so, as it can be the most interesting, technically speaking. When most people think of cybercrime they think of large-scale breaches because that's what...

CVE-2019-4517

IBM has published multiple advisories for CVE-2019-4517 across its Financial Transaction Manager (FTM) family. The vulnerability is described as a remote open-redirect/phishing vector that can spoof URLs to redirect users to malicious sites. Affected products/versions include: FTM ACH v3.0.6.0–3....

CVE-2019-4599

IBM Sterling Connect:Express for UNIX FTP Server is affected by a heap-based buffer overflow in the FTP service (CVE-2019-4599). The issue arises from improper bounds checking in the ALLO handling of the FTP server, where the static buffer in BSS (rem_file) can overflow when processing input with...

CVE-2020-4637

IBM Resilient App Host (Beta) in Resilient OnPrem IBM Security SOAR was found to use weaker-than-expected cryptographic algorithms, which could allow decryption of highly sensitive information. This is documented under CVE-2020-4637 in IBM’s security bulletin, which identifies the affected produc...

CVE-2017-1796

CVE-2017-1796 affects IBM Rational Developer for System z and IBM Developer for z Systems where weaker cryptographic algorithms could allow decrypting sensitive information (CVSS 5.9, vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected products/versions include Rational Developer for S...

CVE-2012-5035

Technical details for CVE-2012-5035 are not publicly available in the provided documents. No affected products, impact, or fixes are stated here. Monitor for updates.

CVE-2020-5028

This CVE (CVE-2020-5028) is documented in IBM’s Security Bulletin for IBM Tivoli/Workload Scheduler. The vulnerability is an XSS issue in the Web UI of IBM Tivoli Workload Scheduler (IBM Workload Scheduler) affecting version 9.3.x and 9.4.x. The root cause is cross-site scripting that could allow...

CVE-2020-4847

IBM Verify Gateway (IVG) contains CVE-2020-4847: when IVG components make API calls, tenant secrets can be exposed (client API secrets, access tokens, cookies) and used to impersonate a tenant. Base score 7.1. Affected IVG versions: RADIUS 1.0.0; PAM 1.0.0, 1.0.1; WinLogin 1.0.0, 1.0.1. Remediati...

CVE-2017-1657

The connected IBM Security Bulletin confirms CVE-2017-1657 affects IBM Resilient, where weaker than expected cryptographic algorithms could allow decrypting highly sensitive information. Affected versions are IBM Resilient 27.0–27.2 and 28.0–28.3. IBM has addressed the issue by updating to versio...

CVE-2017-1627

The IBM bulletin for CVE-2017-1627 states that IBM Resilient is affected by a resource exhaustion issue due to insufficient limits on resources requested or influenced by an actor. Affected versions: IBM Resilient 27.0–27.2 and 28.0–28.3. Impact: potential consumption of more resources than inten...

CVE-2017-1529

CVE-2017-1529 is publicly documented via IBM for Rational DOORS Next Generation with potential for a cross-site scripting (XSS) attack in the Web UI. The IBM bulletin actually references CVE-2018-1529 and affects Rational Requirements Composer 5.0.x (5.0.0–5.0.2) and Rational DOORS Next Generatio...

CVE-2018-1689

CVE-2018-1689 is an IBM Jazz Foundation cross-site scripting (XSS) vulnerability affecting IBM CLM/Rational products that use Jazz technology. The IBM bulletin enumerates affected suites (e.g., CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, etc.) and lists CVE-2018-1689 as a vulnerability where ...

CVE-2019-4251

CVE-2019-4251 is an IBM Rational Quality Manager cross-site scripting vulnerability affecting RQM 6.0–6.0.6.1. An attacker could embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Remediation for 6.0.x is to upgrade to 6.0.6.1 iFix004...

CVE-2021-29876

Summary : CVE-2021-29876 is implicated in IBM Robotic Process Automation with Automation Anywhere 11.0 via a Lucky Thirteen timing attack on CBC-mode TLS, enabling a MITM to potentially obtain plaintext. Affected version : 11.0. Impact : confidentiality risk (C:H) with no server-side integrity im...

CVE-2011-2036

Technical details for CVE-2011-2036 are not publicly available in the provided documents. Monitor for updates.

CVE-2012-0422

CVE-2012-0422 is acknowledged within IBM advisories as part of the Oracle Java SDK-related fixes shipped with WebSphere-related products. The connected IBM pages describe remediation for other CVEs (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169) and list affected WebSphere SDK versions (8.5.x, 8.0....