Server side request forgery (ssrf)

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for...

Code injection

IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196074...

Authentication flaw

IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key exchange without entity authentication on inter-host communications using man in the middle techniques. IBM X-Force ID: 203033...

Cross site scripting

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205281...

CVE-2021-29863

CVE-2021-29863 affects IBM QRadar SIEM 7.3.x (7.3.0–7.3.3 Fix Pack 9) and 7.4.x (7.4.0–7.4.3 Fix Pack 2). It is a server-side request forgery (SSRF) vulnerability arising from an incomplete fix for CVE-2020-4786. An authenticated attacker could issue unauthorized requests from the QRadar system, ...

CVE-2021-29863

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for...

CVE-2021-29849

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205281...

CVE-2021-29849

CVE-2021-29849 affects IBM QRadar SIEM 7.3.x (7.3.0–7.3.3 Fix Pack 9) and 7.4.x (7.4.0–7.4.3 Fix Pack 2). The vulnerability is a cross-site scripting (XSS) in the Web UI caused by insufficient input validation, which could allow an attacker to embed arbitrary JavaScript and potentially disclose c...

CVE-2021-29779

IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key exchange without entity authentication on inter-host communications using man in the middle techniques. IBM X-Force ID: 203033...

CVE-2021-29779

IBM QRadar SIEM vulnerability CVE-2021-29779 affects QRadar 7.3.0–7.3.3 FP9 and 7.4.0–7.4.3 FP2. The issue: inter-host key exchange occurs without entity authentication, enabling information disclosure via MITM. Remediation is provided as fixes: 7.3.3 FP10 and 7.4.3 FP4 (with 7.4.3 FP3 note for C...

CVE-2021-20400

IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196074...

CVE-2021-20400

CVE-2021-20400 affects IBM QRadar SIEM 7.3.x and 7.4.x. The IBM bulletin and NVD entry state the issue stems from weaker-than-expected cryptographic algorithms, potentially allowing an attacker to decrypt highly sensitive information. Affected products/versions include QRadar SIEM 7.3.0–7.3.3 Fix...

IBM QRadar SIEM Encryption Issue Vulnerability

IBM QRadar SIEM is a U.S.-based solution from IBM that leverages security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture and generates detailed reports on data access and user activity. IBM QRadar ha...

IBM QRadar SIEM 授权问题漏洞

IBM QRadar SIEM is a suite of solutions from IBM USA that leverages security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, etc. IBM QRad...

DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to...

What Avengers Movies Can Teach Us About Cybersecurity

Marvel has been entertaining us for the last 20 years. We have seen gods, super-soldiers, magicians, and other irradiated heroes fight baddies at galactic scales. The eternal fight of good versus evil. A little bit like in cybersecurity, goods guys fighting cybercriminals. If we choose to go with...

Join us at InfoSec Jupyterthon 2021

We’re excited to invite our community of infosec analysts and engineers to the second annual InfoSec Jupyterthon taking place on December 2-3, 2021. This is an online event organized by our friends in the Open Threat Research Forge, together with folks from the Microsoft Threat Intelligence Cente...

What is a firewall ❓ Everything you need to know about

In the tech world, a firewall is a wellbeing network framework that screens and controls moving ever closer affiliation traffic dependent upon destined security rules. A firewall ordinarily draws up a line between a confided in affiliation and an untrusted affiliation, like the Internet.‍ What is...

DCOM abuse and lateral movement with Cobalt Strike

Introduction When researching lateral movement techniques I came across a post from Raphael Mudge of Cobalt Strike fame. He details scripting an Aggressor Script for Matt Nelson’s MMC20.Application Lateral Movement technique. Reading that post spurred me to make my own DCOM based lateral movement...

How Microsoft Defender for IoT can secure your IoT devices

Cybersecurity threats are always evolving, and today we’re seeing a new wave of advanced attacks specifically targeting IoT devices used in enterprise environments as well as operational technology OT devices used in industrial systems and critical infrastructure like ICS/SCADA. It’s not surprisi...