Security Bulletin: Financial Transaction Manager for Digital Payments is affected by a potential directory listing of internal product files vulnerability (CVE-2018-2026)

Summary Financial Transaction Manager for Digital Payments FTM DP for Multi-Platform has addressed the following vulnerability. A potential directory listing vulnerability could allow an authenticated user to obtain a directory listing of internal product files. Vulnerability Details CVEID:...

Security Bulletin: Financial Transaction Manager for Digital Payments is affected by a potential cross-site scripting (XSS) vulnerability (CVE-2018-1871)

Summary Financial Transaction Manager for Digital Payments FTM DP for Multi-Platform has addressed the following vulnerability. A potential cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...

Security Bulletin: Financial Transaction Manager for Digital Payments is affected by a potential cross-site request forgery vulnerability (CVE-2018-1790)

Summary Financial Transaction Manager for Digital Payments FTM DP for Multi-Platform has addressed the following vulnerability. A potential cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Security Bulletin: Financial Transaction Manager for Digital Payments: Information Leakage in configuration listing (CVE-2018-1670)

Summary IBM Financial Transaction Manager for Digital Payments FTM DP for Multi-Platform could allow an authenticated user to obtain sensitive product configuration information from log files. Vulnerability Details CVEID: CVE-2018-1670 DESCRIPTION: IBM Financial Transaction Manager for ACH Servic...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in budget name, allowing an attacker to inject malicious script in a transaction to get executed on the tags/show/$tagnumber$ tag summary page...

CVE-2019-13644

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the same acce...

Security Bulletin: Vulnerability in IBM Java Runtime affect Financial Transaction Manager for ACH Services for Multi-Platform

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7 or Version 8 by Financial Transaction Manager for ACH Services for Multi-Platform FTM ACH. Financial Transaction Manager for ACH Services for Multi-Platform has addressed the applicable CVE. Vulnerability Details CVEID:...

CVE-2018-17196

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to...

Security Bulletin: Path Traversal exposure in the Save/Export function of the FTM OAC

Summary The "Save/Export" function available on all search result displays tabulated results is potentially vulnerable to a Path Traversal type attack. Vulnerability Details CVEID: CVE-2018-1847 DESCRIPTION: IBM Financial Transaction Manager FTM for Multi-Platform MP could allow a remote attacker...

Security Bulletin: Financial Transaction Manager for ACH Services is affected by a potential cross-site request forgery vulnerability (CVE-2018-1790)

Summary IBM Financial Transaction Manager for ACH Services FTM ACH for Multi-Platform has addressed the following vulnerability. A potential cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for ACH Services for Multi-Platform

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 or Version 8 by Financial Transaction Manager for ACH Services for Multi-Platform FTM ACH. Financial Transaction Manager for ACH Services for Multi-Platform has addressed the applicable CVEs. Vulnerability...

Transaction Log Backup Job for Microsoft SQL Server with AlwaysOn Availability Groups fails after installing CU15 for SQL Server 2017

Challenge When utilizing Always On Availability Groups on a Windows Server Failover Cluster using Microsoft SQL Server 2017 and after installing Cumulative Update package 15 CU15 for SQL Server 2017, Veeam Transaction Log Backup Jobs may fail with the following error message in the the statistics...

Microsoft Windows - 'CmpAddRemoveContainerToCLFSLog' Arbitrary File/Directory Creation

Windows: CmpAddRemoveContainerToCLFSLog Arbitrary File/Directory Creation EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The kernel’s CmpAddRemoveContainerToCLFSLog function doesn’t...

Crypto tumbler BestMixer.io seized for large-scale money laundering

By Uzair Amir BestMixer.io was among the three largest cryptocurrency mixing services launched in May 2018. Europol in collaboration with the Dutch Fiscal Information and Investigative Service FIOD, Luxembourg has shut down a well-known and one of the world’s leading cryptocurrency tumblers...

CVE-2018-1790

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944...

Cross site request forgery (csrf)

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944...

CVE-2018-1790

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944...

CVE-2018-1790

CVE-2018-1790 affects IBM Financial Transaction Manager products across multiple platforms with a cross-site request forgery (CSRF) risk. Affected versions include: FT M Check (CHK) 3.0.0.0–3.0.0.15, 3.0.2.0–3.0.2.1, 3.0.5.0–3.0.5.2; FTM CPS 2.1.1.0–2.1.1.4; FTM CPS 3.0.2.0–3.0.2.1, 3.2.1.0; FTM ...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this...

CVE-2019-11636

Technical details about CVE-2019-11636 are not publicly provided in the supplied documents. Monitoring for updated advisories is advised; current sources describe a Sapling Wood-Chipper-like attack on Zcash 2.x but do not reveal affected versions, impact specifics, or fixes.