VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)

1. Impacted Products VMware vRealize Operations VMware Cloud Foundation vRealize Suite Lifecycle Manager 2. Introduction Multiple vulnerabilities in VMware vRealize Operations were privately reported to VMware. Patches and Workarounds are available to address these vulnerabilities in impacted...

Security Bulletin: Multiple vulnerabilities in affect IBM® SDK, Java™ Technology Edition may affect IBM Operations Analytics Predictive Insights

Summary Multiple vulnerabilities CVE-2020-14803, CVE-2020-27221 in IBM® SDK, Java™ Technology Edition affect IBM Operations Analytics Predictive Insights 1.3.6 and earlier and were disclosed as part of the IBM SDK, Java Technology Edition Quarterly CPU - Jan 2021. Vulnerability Details Refer to t...

HTML injection in email and account expiry notifications

Impact The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled ...

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources...

GHSA-79RG-7MV3-JRR5 Rating Script Service expose XWiki to SQL injection

Impact This issue impacts only XWiki with the Ratings API installed. The Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. Patches Th...

XStream is vulnerable to an Arbitrary Code Execution attack

Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required...

XStream is vulnerable to an Arbitrary Code Execution attack

Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required...

XStream can cause a Denial of Service.

Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation ...

JVN#12737530: UNIVERGE Aspire series PBX vulnerable to denial-of-service (DoS)

Remote system maintenance feature of UNIVERGE Aspire series PBX contain an issue in handling commands, which may cause a denial-of-service DoS. Impact An attacker may cause system down and reboot of the products by sending a specially crafted command. Solution Update the Software Update to the...

Security Bulletin: Multiple vulnerabilities in IBM Java SE, Java SE Embedded affects IBM Operations Analytics Predictive Insights

Summary Multiple security vulnerablities in Java SE, Java SE Embedded product of Oracle Java SE components: Serialization, Hotspot, Libraries were disclosed as part of their October 2020 Critical Patch Update. Those vulnerabilities affect IBM Operations Analytics Predictive Insights 1.3.6 and...

Fuji Xerox multifunction devices and printers vulnerable to denial-of-service (DoS)

Overview Multifunction devices and printers provided by Fuji Xerox Co.,Ltd. contain a denial-of-service DoS vulnerability. Masahiro Kawada of Ierae Security Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...

JVN#37607293: Fuji Xerox multifunction devices and printers vulnerable to denial-of-service (DoS)

Multifunction devices and printers provided by Fuji Xerox Co.,Ltd. contain a denial-of-service DoS vulnerability. Impact An attacker may cause the products to be terminated by sending a specially crafted command. In order to restart the products, the physical power button on the devices must be...

DOS vulnerability for Quoted Quality CSV headers

Impact When Jetty handles a request containing request headers with a large number of “quality” i.e. q parameters such as what are seen on the Accept, Accept-Encoding, and Accept-Language request headers, the server may enter a denial of service DoS state due to high CPU usage while sorting the...

Security Bulletin: IBM Verify Gateway PAM components do not set restricted access permission for debug logs (CVE-2020-4405)

Summary To debug the IBM Verify Gateway IVG PAM components, customers can add "trace-file" parameters in the PAM configuration so that .log files are written to the /tmp directory. These debug logs potentially contain sensitive information, and yet they default to world readable. They should have...

Siemens SCALANCE and SIMATIC libcurl

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SCALANCE and SIMATIC Vulnerability: Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of this third-party vulnerability could allow an attacker to cause a...

Siemens LOGO! 8 BM

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

GHSA-CQFF-FX2X-P86V botframework-connector vulnerable to Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see the...

Remote Code Execution

Overview Impact In affected versions of pug and pug-code-gen, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remot...

How to Configure and Secure Amazon S3

In this article, we’ll dive into some of the workarounds and considerations you may encounter with Amazon S3, since it’s the most used—and misused—cloud storage option on AWS...

GHSA-9FHW-R42P-5C7R Regular expression Denial of Service in @progfay/scrapbox-parser

Impact A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js. The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU. Patches Upgrade to version 6.0.3,...