CVE-2023-49950

The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting XSS payload and send it to any system or device that sends logs to th...

IBM SOAR QRadar Plugin App Access Control Error Vulnerability

The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. An access control error vulnerability exists in the IBM SOAR QRadar Plugin App, which could be exploited by an attacker to perfo...

PT-2024-13839 · Logpoint · Logpoint Siem

Name of the Vulnerable Software and Affected Versions: Logpoint SIEM versions 6.10.0 through 7.x before 7.3.0 Description: The Jinja templating in Logpoint SIEM does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a...

Perfecting the Defense-in-Depth Strategy with Automation

Medieval castles stood as impregnable fortresses for centuries, thanks to their meticulous design. Fast forward to the digital age, and this medieval wisdom still echoes in cybersecurity. Like castles with strategic layouts to withstand attacks, the Defense-in-Depth strategy is the modern...

Security Bulletin: Protobuf as used by IBM QRadar SIEM is vulnerable to denial of service (CVE-2022-3171, CVE-2022-3509)

Summary Protobuf as used by IBM QRadar SIEM is vulnerable to denial of service. IBM QRadar SIEM has addressed the applicable vulnerability. Vulnerability Details CVEID:CVE-2022-3171 DESCRIPTION: protobuf-java core and lite are vulnerable to a denial of service, caused by a flaw in the parsing...

FalconHound - A Blue Team Multi-Tool. It Allows You To Utilize And Enhance The Power Of Blo odHound In A More Automated Fashion

FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool. One of the challenging aspects of BloodHound is that it is a snapshot in time...

CVE-2023-50950

IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709...

CVE-2023-50950 IBM QRadar information disclosure

IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709...

CVE-2023-50950

CVE-2023-50950 affects IBM QRadar SIEM 7.5, where offense-rule response handling can disclose sensitive email information. The Red Hat and CVE records corroborate the same information-disclosure issue. The IBM security bulletin lists a remediation: upgrade to IBM QRadar SIEM 7.5.0 with UP7 IF04. ...

CVE-2023-50950 IBM QRadar information disclosure

IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. These have been addressed in the update. Vulnerability Details CVEID:CVE-2023-34058 DESCRIPTION: VMware Tools could allow a remote attacker to gain elevate...

PT-2024-14025 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM version 7.5 Description: The issue could disclose sensitive email information in responses from offense rules. Recommendations: For IBM QRadar SIEM version 7.5, consider restricting access to offense rules to minimize the risk...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-29827 DESCRIPTION: Node.js ejs module could allow a remote authenticated attacker t...

CVE-2023-47146

IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified. IBM X-Force ID: 270372...

Code injection

IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified. IBM X-Force ID: 270372...

CVE-2023-47146 IBM QRadar SIEM information disclosure

IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified. IBM X-Force ID: 270372...

CVE-2023-47146

CVE-2023-47146 affects IBM QRadar SIEM 7.5. The data misidentification flaw could allow a privileged user to obtain sensitive domain information, i.e., an information-disclosure risk. The IBM source notes the issue in QRadar 7.5 and provides a remediation path: upgrade to QRadar SIEM 7.5.0 UP7 IF...

IBM QRadar SIEM Information Disclosure Vulnerability

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

PT-2023-7921 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM Qradar SIEM version 7.5 Description: The issue is related to the misidentification of data, which could allow a privileged user to obtain sensitive domain information. This is due to insufficient protection of service data. A remote...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Additionally, a cross site scripting issue was found. These have been addressed in the update. Vulnerability Details CVEID:CVE-2020-22218 DESCRIPTION: libssh...