PT-2018-12082

Name of the Vulnerable Software and Affected Versions R Time Token v3 RS Description The issue concerns an integer overflow in the mintToken function of the RTokenMain smart contract implementation. This overflow allows the contract owner to set the balance of any user to any value. Recommendatio...

PT-2018-11705

Name of the Vulnerable Software and Affected Versions R Time Token v3 RS Description The issue concerns an integer overflow in the sell function of the RTokenMain smart contract implementation. Specifically, when amount sellPrice equals zero, it can lead to a reduction in a seller's assets...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty affects IBM MessageSight (CVE-2016-2923)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty is used by IBM MessageSight. IBM MessageSight has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-2923 DESCRIPTION: IBM WebSphere...

Security Bulletin: IBM Streams may be impacted by a vulnerability in WebSphere Liberty (CVE-2016-2923)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty for any users of the JAX-RS API which may impact IBM Streams. The IBM Streams team has addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-2923 DESCRIPTION: IBM WebSphere Applicati...

Security Bulletin: Denial of Service in Apache CXF used by WebSphere Application Server (CVE-2017-12624)

Summary There is a potential denial of service in Apache CXF that is used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could...

Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Applciation Server bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty for any users of the JAX-RS API. Apache Struts vulnerabilities affect WebSphere Application Server Administration Console. Vulnerability Details Please consult the security bulletins for...

Security Bulletin: Several vulnerabilities affect Liberty for Java for IBM Bluemix (CVE-2016-2923, CVE-2016-2945, CVE-2016-0359)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty for any users of the JAX-RS API. There is a potential for weaker than expected security when using the WebSphere Application Server Liberty profile API Discovery feature and Swagger documents. The...

Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server for Bluemix

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty for any users of the JAX-RS API. There is a potential for...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2016-2923)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty for any users of the JAX-RS API. Vulnerability Details CVEID: CVE-2016-2923 DESCRIPTION: IBM WebSphere Application Server Liberty using JAX-RS API could allow a remote attacker to obtain sensitive...

rs-brightcove remote code execution vulnerability

rs-brightcove is a set of wrapper tools for the brightcove web API. A security vulnerability exists in rs-brightcove, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the response an...

CVE-2016-10676

rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacke...

CVE-2016-10676

rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacke...

CVE-2016-10676

rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacke...

CVE-2016-10676

The CVE refers to rs-brightcove, a wrapper around Brightcove’s web API. The issue is that rs-brightcove downloads resources over HTTP and can be manipulated by an attacker with a privileged network position, potentially replacing a downloaded executable and causing remote code execution on the ho...

CVE-2016-10676: Missing Encryption of Sensitive Data

rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacke...

PT-2018-4854

Name of the Vulnerable Software and Affected Versions rs-brightcove affected versions not specified Description The issue allows for a man-in-the-middle MITM attack due to the insecure download of source file resources over HTTP. This could potentially lead to remote code execution RCE if an...

CVE-2015-9235

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

CVE-2015-9235: Improper Input Validation

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

receitadados.fazenda.rs.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-621212 Description| Value ---|--- Affected Website:| receitadados.fazenda.rs.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

receita.fazenda.rs.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-621183 Description| Value ---|--- Affected Website:| receita.fazenda.rs.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...