Security Bulletin: IBM Security Key Lifecycle Manager stores unencrypted password (CVE-2016-6092)

Summary IBM Security Key Lifecycle Manager has identified a vulnerability where a password is stored in clear text. This vulnerability can enable attackers to obtain unauthorized access to other integrated systems. IBM Security Key Lifecycle Manager has addressed this vulnerability with the...

Security Bulletin: Multiple Vulnerabilities fixed in IBM Security Identity Manager Virtual Appliance ( CVE-2014-6106, CVE-2014-6108, CVE-2014-6109, CVE-2014-6111, CVE-2014-6112 )

Summary Multiple Vulnerabilities fixed in IBM Security Identity Manager versions 5.1, 6.0, and 7.0 Vulnerability Details CVE-ID: CVE-2014-6106 Description: IBM Security Identity Manager is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuadin...

Security Bulletin: IBM Tealeaf Customer Experience allows user authentication via unencrypted GET request (CVE-2015-4990)

Summary The IBM Tealeaf Customer Experience portal allows a user to authenticate via means that could result in exposure of credentials. Vulnerability Details CVEID: CVE-2015-4990 DESCRIPTION: The IBM Tealeaf Customer Experience could allow a local privileged user to obtain the authentication...

Security Bulletin: IBM Tealeaf Customer Experience internal connections not encrypted (CVE-2015-4961)

Summary Internal connections between IBM Tealeaf Customer Experience servers use unencrypted HTTP. Vulnerability Details CVEID: CVE-2015-4961 DESCRIPTION: In an IBM Tealeaf environment with multiple servers, connections to the Tealeaf Data Service, Search Service, Replay Service, and Tracking...

Security Bulletin: IBM Cognos TM1 is affected by the following vulnerability: CVE-2014-0863

Summary A security vulnerability has been discovered in IBM Cognos TM1 resulting in unencrypted passwords found in memory on client. Vulnerability Details CVE-ID: CVE-2014-0863 CVSS Base Score: 4.0 CVSS Temporal Score: See for the current score CVSS Environmental Score: Undefined CVSS Vector:...

pm2-kafka code execution vulnerability

pm2-kafka is a PM2 module for installing and running a kafka server. A security vulnerability exists in pm2-kafka that originates when a program downloads a binary file over an unencrypted HTTP connection. A remote attacker can exploit the vulnerability by intercepting the response and replacing...

wixtoolset Remote Code Execution Vulnerability

wixtoolset is a set of tools for building installers for Windows applications. A security vulnerability exists in wixtoolset that originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the...

npm-test-sqlite3-trunk code execution vulnerability

npm-test-sqlite3-trunk is a module for providing asynchronous non-blocking SQLite3 bindings. A security vulnerability exists in npm-test-sqlite3-trunk, which originates when a program downloads a binary file over an unencrypted HTTP connection. A remote attacker can exploit this vulnerability by...

gfe-sass Remote Code Execution Vulnerability

gfe-sass is a sass library. A security vulnerability exists in gfe-sass that originates when a program downloads a binary file over an unencrypted HTTP link. An attacker could exploit this vulnerability by intercepting the response and replacing the requested binary with a malicious executable fi...

Windows-iedriver Module Command Execution Vulnerability

The windows-iedriver module is a module for installing the latest version of iedriver. A security vulnerability exists in the windows-iedriver module, which is caused by a program downloading a binary file over an unencrypted HTTP connection. An attacker can exploit the vulnerability by...

windows-selenium-chromedriver remote code execution vulnerability

windows-selenium-chromedriver is a package for downloading and installing the chromedriver server. A security vulnerability exists in windows-selenium-chromedriver, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit...

windows-latestchromedriver code execution vulnerability

windows-latestchromedriver is a module for downloading and installing the latest version of Chormedriver. A security vulnerability exists in windows-latestchromedriver that originates when the program downloads a binary file over an unencrypted HTTP connection. A remote attacker can exploit the...

windows-seleniumjar remote code execution vulnerability

windows-seleniumjar is a package for downloading selenium jar files in Node.js. A security vulnerability exists in windows-seleniumjar that originates when the program downloads a binary file over an unencrypted HTTP connection. A remote attacker can exploit this vulnerability by intercepting the...

rs-brightcove remote code execution vulnerability

rs-brightcove is a set of wrapper tools for the brightcove web API. A security vulnerability exists in rs-brightcove, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the response an...

selenium-portal remote code execution vulnerability

selenium-portal is a Node.js based on the use of JavaScript to write Selenium test program tools . A security vulnerability exists in selenium-portal, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the vulnerabilit...

react-native-baidu-voice-synthesizer code execution vulnerability

react-native-baidu-voice-synthesizer is a speech synthesizer for use in Node.js. A security vulnerability exists in react-native-baidu-voice-synthesizer, which originates when the program downloads a binary file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerabilit...

libsbmlsim Remote Code Execution Vulnerability

libsbmlsim is a library for simulating SBML models containing ordinary differential equations. A security vulnerability exists in libsbmlsim that originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by...

google-closure-tools-latest code execution vulnerability

google-closure-tools-latest is a package for downloading/installing the latest version of Google Closure tools. A security vulnerability exists in google-closure-tools-latest, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker cou...

clang-extra remote code execution vulnerability

clang-extra is a tool for installing LLVM. A security vulnerability exists in clang-extra, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the vulnerability by intercepting the response and replacing the requested...

Unspecified vulnerability in fis-sass-all

fis-sass-all is a package for implementing Sass compilation in Node.js. A security vulnerability exists in fis-sass-all, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the response...