Information disclosure

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803...

CVE-2019-4377

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803...

CVE-2019-4377

IBM Sterling B2B Integrator vulnerability (CVE-2019-4377) affects Standard Edition 5.2.0.0 through 6.0.0.1. The issue is information disclosure via stack traces that could aid subsequent attacks. IBM’s bulletin confirms CVSS base score of 4.3 (network, low attack complexity, low privileges), and ...

PT-2019-17047 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.0.0.1 Description: The issue reveals sensitive information from a stack trace, which could be used in further attacks against the system. Recommendations: For versions 6.0.0.0 and 6.0.0.1...

CVE-2019-4377: Generation of Error Message Containing Sensitive Information

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2019-18838)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2019:1265-1)

This update for systemd fixes the following issues : Security issues fixed : CVE-2018-6954: Fixed a vulnerability in the symlink handling of systemd-tmpfiles which allowed a local user to obtain ownership of arbitrary files bsc1080919. CVE-2019-3842: Fixed a vulnerability in pamsystemd which...

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump source code...

Sensitive Information Leak

oslo.middleware is vulnerable to sensitive information leaks. This happens when catch errors are thrown, sensitive information such as the authentication token X-Auth-Token which is used to place the rest call to neutron is logged as part of the stack trace...

On error at /rest/ stack-trace is publicly visible

h3. Summary On Confluence server 6.12.2 requesting wrong REST URL /rest/cql/contenttypes?category=test we will see full stack-trace. The same we can see at https://confluence.atlassian.com/rest/cql/contenttypes?category=test On production, a regular user should not see the stack-trace when an err...

Information Disclosure

hawtio-system is vulnerable to an information disclosure. The library displays the entire stack trace when it runs into an exception in accessing a non-existent directory, allowing a malicious user to gather sensitive information from it...

Gitlab -- multiple vulnerabilities

Gitlab reports: RCE in Gitlab Wiki API SSRF in Hipchat integration Cleartext storage of personal access tokens Information exposure through stack trace error message Persistent XSS autocomplete Information exposure in stored browser history Information exposure when replying to issues through ema...

Time Travel Debugging: finding Windows GDI flaws

Introduction Microsoft Patches for October 2018 included a total of 49 security patches. There were many interesting ones including kernel privilege escalation as well as critical ones which could lead to remote code execution such as the MSXML one. In this post we will be analysing a case of a W...

Security Bulletin: IBM Tivoli Netcool Impact is affected by an Information disclosure of stack trace vulnerability (CVE-2018-1553)

Summary IBM Tivoli Netcool Impact has addressed the following vulnerability. IBM WebSphere Application Server Liberty which ships in IBM Tivoli Netcool Impact could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO feature...

Security Bulletin: Stack Trace Vulnerability Affects IBM B2B Advanced Communication (CVE-2016-0378)

Summary IBM B2B Advanced Communications has addressed the stack trace display issue when no default error page was set up. Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM B2B Advanced Communications could allow a remote attacker to obtain sensitive information caused by improper...

3CX Information Disclosure Vulnerability

3CX is an IP telephony device from 3CX USA. An information disclosure vulnerability exists in the web server in 3CX 15.5.8801.3. The vulnerability stems from a failure of the program to properly handle errors in the stack trace. An attacker could exploit this vulnerability to disclose information...

CVE-2018-14925

Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components...

CVE-2018-14907

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname...

PT-2018-12803

Name of the Vulnerable Software and Affected Versions Matera Banco version 1.0.0 Description The issue concerns the mishandling of Java errors in the backend of the software. A stack trace has revealed the use of net.sf.acegisecurity components, indicating a potential security issue...

CVE-2018-14925: Generation of Error Message Containing Sensitive Information

Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components...