Code injection

IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759...

CVE-2021-20527

The CVE-2021-20527 entry applies to IBM Resilient SOAR (OnPrem). A privileged user could inject or create malicious scripts that are executed as another user, indicating a command-injection-like flaw in the platform. The IBM Security bulletin confirms affected versions (Resilient OnPrem) and prov...

CVE-2021-20527

IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759...

CVE-2021-20527: Improper Neutralization of Special Elements used in a Command

IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759...

CVE-2021-20527

IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759...

CVE-2020-4635

IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames...

Code injection

IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames...

CVE-2020-4635

CVE-2020-4635 affects IBM Resilient (SOAR) prior to v40.1, where a user could enumerate usernames and disclose partial confidential information. IBM’s security bulletin confirms the issue and its CVSS foundations, with a fix implemented in Resilient v40.1 that adds rate-limiting and fuzzing to de...

CVE-2020-4635

IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames...

CVE-2020-4635: Undefined Security Weakness

IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames...

Security Bulletin: IBM Resilient vulnerable to username enumeration (CVE-2020-4635)

Summary IBM Resilient could disclose sensitive information by allowing a user to enumerate usernames. An attacker may use this to determine if a user exists or not. Vulnerability Details CVEID: CVE-2020-4635 DESCRIPTION: IBM Resilient could disclose sensitive information by allowing a user to...

Security Bulletin: IBM Resilient SOAR is using opensaml-2.6.4.jar that could be vulnerable to bypass security restrictions (CVE-2015-1796)

Summary opensaml-2.6.4.jar vulnerable to CVE-2015-1796, Shibboleth Identity Provider could allow a remote attacker to bypass security restrictions, caused by an error in the PKIX trust component. An attacker could exploit this vulnerability using a certificate issued by the shibmd:KeyAuthority...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Java SE (CVE-2020-14779, CVE-2020-14792, CVE-2020-14796, CVE-2020-14797, CVE-2020-14798)

Summary IBM Resilient SOAR is Using Components with Known Vulnerabilities - Java SE CVE-2020-14779, CVE-2020-14792, CVE-2020-14796, CVE-2020-14797, CVE-2020-14798 Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization componen...

Soar Cloud System SQL Injection Vulnerability

Soar Cloud System is a HR system solution system developed by Soar. The Soar Cloud System HR portal suffers from a SQL injection vulnerability that stems from not filtering SQL injection statements, which allows a remote attacker to inject SQL syntax and obtain all data in the database without...

Soar Cloud System Access Control Error Vulnerability

Soar Cloud System is a HR system solution system developed by Soar. Soar Cloud System HR Portal has an access control error that allows remote attackers to access sensitive data through specific packets e.g., user's login information while obtaining a user ID, thus preventing the login function...

CVE-2021-22855

The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands...

CVE-2021-22854

The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege...

CVE-2021-22853

The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work...

CVE-2021-22854

The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege...

CVE-2021-22853

The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work...