Security Bulletin: IBM Elastic Storage Server GUI is affected by verbose error messages being displayed.

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server GUI where verbose error messages may be displayed. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4357 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could...

GHSA-55J9-849X-26H4 Remote Code Execution in Red Discord Bot

Impact A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 -CVE-2020-2590 affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. CVE-2020-2590 was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerability...

GHSA-P4PJ-9G59-4PPV Remote Code Execution in SyliusResourceBundle

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...

Remote Code Execution in SyliusResourceBundle

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to CVE-2020-4449

Summary Information disclosure in WebSphere Application Server. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- Jazz for Service Management| 1.1.3...

Security Bulletin: Vulnerability identified in docker for Red Hat Enterprise Linux

Summary Vulnerability identified in docker package for Red Hat Enterprise Linux potentially impact IBM Cloud Pak System. Vulnerability Details CVEID: CVE-2020-14300 DESCRIPTION: Docker package for Red Hat Enterprise Linux could allow a remote attacker to execute arbitrary code on the system, caus...

August 11, 2020-KB4569751 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 1903 and Windows Server 1903 RTM and Windows 10, version 1909 and Windows Server, version 1909

None None...

Multiple vulnerabilities in CyberMail

Overview CyberMail contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5540 Open Redirect CWE-601 - CVE-2020-5541 Tony Kuo and Chia-Lung Hsieh of CHT Security reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#46258789: Multiple vulnerabilities in CyberMail

CyberMail contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5540 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 Open Redirect CWE-601 -...

GHSA-WVHM-4HHF-97X9 Cross-Site Scripting in Prism

Impact The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism =v1.1.0 that use the Previewers plugin =v1.10.0 or the Previewer: Easing plugin...

Reliance on Cookies without validation in OctoberCMS

Impact Previously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code nothing exploitable in the core project itself had a higher chance of...

Security Bulletin: CVE-2020-2590 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-2590 was disclosed as part of the Oracle January 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-2590 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause no confidentiali...

GHSA-67J9-C52G-W2Q9 Authorization Bypass in I hate money

Impact An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default...

Security Bulletin: IBM MQ Appliance is vulnerable to a buffer overflow vulnerability (CVE-2020-4465)

Summary IBM MQ Appliance has resolved a buffer overflow vulnerability. Vulnerability Details CVEID: CVE-2020-4465 DESCRIPTION: IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop are vulnerable to a buffer overflow vulnerability due to an error within the channel processing code. A remote attack...

Security Bulletin: IBM Sterling Connect:Direct FTP+ is affected by a vulnerability in the IBM Runtime Environment, Java™ Technology Edition (CVE-2013-1500)

Summary IBM Sterling Connect:Direct FTP+ is shipped with IBM Runtime Environment, Java™ Technology Edition the “IBM RE”, that is based on an Oracle Java Runtime Environment JRE. Oracle has released the June 2013 critical patch updates CPU that contain security vulnerability fixes for the JRE. The...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Sterling Connect:Direct FTP+ (CVE-2015-7575).

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 7.0.5 and 6.0.14 that are used by IBM Sterling Connect:Direct FTP+. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability...

Security Bulletin: Vulnerability in RC4 stream cipher affects Connect:Express for UNIX (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Connect:Express for UNIX Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Connect:Direct Browser User Interface (CVE-2015-7575, CVE-2016-0475, CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7.0 that is used by IBM Sterling Connect:Direct Browser User Interface. These issues were disclosed as part of the IBM Java Runtime updates in October 2015 and January 2016 and include the...

Security Bulletin: A Vulnerability in IBM Java Runtime Affects IBM Sterling Connect:Direct for UNIX

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 8 and 7 that are used by IBM Sterling Connect:Direct for UNIX. This issue was disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2602 DESCRIPTION: An...