Security Bulletin: TLS padding vulnerability affects IBM Security SiteProtector (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Security SiteProtector System and IBM Security SiteProtector Appliance. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a...

Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Transactions (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM PureData™ System for Transactions. Vulnerability Details CVE-ID:...

Unspecified vulnerability in nodemailer.js

nodemailer.js is a JavaScript implementation for sending e-mail . A security vulnerability exists in nodemailer.js. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in nodemailer.js (CNVD-2018-22103)

nodemailer.js is a JavaScript implementation for sending e-mail . A security vulnerability exists in nodemailer.js. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in mongose

mongose is an embedded web server. A security vulnerability exists in mongose. An attacker can exploit this vulnerability to steal environment variables...

Unspecified vulnerability in proxy.js

proxy.js is an HTTP proxy. A security vulnerability exists in proxy.js. An attacker can exploit this vulnerability to steal environment variables...

Unspecified vulnerability in noderequest

noderequest is a package of request nodes for use in Node.js. A security vulnerability exists in noderequest. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in nodeffmpeg

nodeffmpeg is a package for connecting FFmpeg. A security vulnerability exists in nodeffmpeg. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in ffmepg

ffmepg is a package that steals environment variables. A security vulnerability exists in ffmepg. An attacker can exploit the vulnerability to steal environment variables...

Unspecified vulnerability in crossenv

crossenv is a module for setting and using environment variables that supports several platforms. A security vulnerability exists in crossenv. An attacker can exploit this vulnerability to steal environment variables...

Unspecified vulnerability in nodecaffe

nodecaffe is a package that allows JavaScript to inspect Caffe layers and content. A security vulnerability exists in nodecaffe. An attacker could exploit the vulnerability to steal environment variables...

Unspecified vulnerability in http-proxy.js

http-proxy.js is a JavaScript-based HTTP proxy . A security vulnerability exists in http-proxy.js. An attacker can exploit the vulnerability to steal environment variables...

node-opencv design vulnerability

node-opencv is a JavaScript library for connecting to OpenCV. A security vulnerability exists in node-opencv. An attacker can exploit the vulnerability to steal environment variables...

CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

CVE-2018-1281

The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLCPSROOTURI and DMLCPSROOTPORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLCPSROOTURI onc...

Malicious Typo-Squatting

cross-env.js is a malicious typo-squatter package. The package uses a similar name to the original library so that developers may mistake it for the real one but have malicious actions under the hood such as stealing environment variables...

Malicious Typo-Squatting

nodesass is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake it for the real one but have malicious actions under the hood such as stealing environment variables...

Malicious Typo-Squatting

smb is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake it for the real one but have malicious actions under the hood such as stealing environment variables...

Malicious Typo-Squatting

shadowsock is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake it for the real one but have malicious actions under the hood such as stealing environment variables...