Security Bulletin: Tivoli Management Framework is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Service Monitors is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

Security Bulletin: Security vulnerability has been identified in Jazz Reporting Service shipped with Rational Insight (CVE-2017-1370)

Summary Jazz Reporting Service is shipped as a component of Rational Insight. Information about a security vulnerability affecting Jazz Reporting Service has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-1370 DESCRIPTION: IBM Jazz Reporting Service JRS could disclos...

Security Bulletin: Security vulnerability has been identified in Jazz Reporting Service shipped with Rational Reporting for Development Intelligence (CVE-2017-1370)

Summary Jazz Reporting Service is shipped as a component of Rational Reporting for Development Intelligence RRDI. Information about a security vulnerability affecting Jazz Reporting Service has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-1370 DESCRIPTION: IBM Jazz...

Security Bulletin: Rational Build Forge is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. These vulnerabilities affect IBM Rational Build Forge 8.0 and 8.0.0.1. Fixes for the vulnerabilities have been added to the Rational Build Forge 8.0.0.1 iFix1 release. If https and SSL are not enabled, Build Forge 8.0 and 8.0.0.1 a...

Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Password in Clear Text vulnerability (CVE-2018-1377 )

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1377 DESCRIPTION: IBM Security Guardium Big Data Intelligence SonarG stores user credentials in plain in clear text which can be read by a local user. CVSS...

Security Bulletin: IBM Security Guardium is affected by Password in Clear Text vulnerability (CVE-2017-1259)

Summary IBM Security Guardium transmits user credentials in plain in clear text which can be read by an attacker. IBM Security Guardium has provided a fix for this vulnerability. Vulnerability Details CVEID: CVE-2017-1259 DESCRIPTION: IBM Security Guardium transmits user credentials in plain in...

Security Bulletin: IBM Security Key Lifecycle Manager stores unencrypted password (CVE-2016-6092)

Summary IBM Security Key Lifecycle Manager has identified a vulnerability where a password is stored in clear text. This vulnerability can enable attackers to obtain unauthorized access to other integrated systems. IBM Security Key Lifecycle Manager has addressed this vulnerability with the...

Security Bulletin: IBM Tealeaf Customer Experience (CX) is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

Security Bulletin: Link Injection vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0970)

Summary Link Injection vulnerabilities can allow an attacker to embed links URLs to an external site or to different pages forms within IBM® InfoSphere® Master Data Management - Collaborative Edition. The links can appear to be valid application links. Clicking a link might cause the user to...

Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability

A vulnerability in Cisco-provided scripts disk-check.sh and harcap.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to...

Researcher Finds Credentials for 92 Million Users of DNA Testing Firm MyHeritage

MyHeritage, an Israeli-based genealogy and DNA testing company, disclosed today that a security researcher found on the Internet a file containing the email addresses and hashed passwords of more than 92 million of its users. MyHeritage says it has no reason to believe other user data was...

Design/Logic Flaw

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara...

CVE-2018-11195

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara...

Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting

Exploit Title: Multiple XSS Oracle WebCenter Sites FatWire Content Server 7.x 11gR1 Dork: inurl:Satellite?c Date: 18.12.201 Exploit Author: Richard Alviarez Vendor Homepage: http://oracle.com Version: 7.x 11gR1 CVE: CVE-2018-2791 Category: Webapps Tested on: Kali linux...

CVE-2018-7295

ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel, allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http befor...

Design/Logic Flaw

A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, remote attacker to log in to an affected system by using an administrative account that has default, static user credentials. The vulnerability is due to the presence of undocumented, static user...

SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response Exploit

Exploit for linux platform in category web applications Exploit Title: SickRage v2018.03.09 - Clear-Text Credentials HTTP Response Exploit Author: Sven Fassbender Vendor Homepage: https://sickrage.github.io Software Link: https://github.com/SickRage/SickRage Version: v2018.03.09-1 CVE :...

SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response

Exploit Title: SickRage v2018.03.09 - Clear-Text Credentials HTTP Response Date: 2018-04-01 Exploit Author: Sven Fassbender Vendor Homepage: https://sickrage.github.io Software Link: https://github.com/SickRage/SickRage Version: v2018.03.09-1 CVE : CVE-2018-9160 Category: webapps 1. Background...

Shopy Point of Sale 1.0 - CSV Injection

Shopy Point of Sale 1.0 - CSV Injection Exploit Title: Shopy Point of Sale v1.0 - CSV Injection Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10258 Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/shopy-point-of-sales/21730225 Version: 1.0 Tested on: Ka...