Security Bulletin: Vulnerability in IBM Java SDK affects IBM Process Designer used in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition (CVE-2018-2783)

Summary There is a vulnerability CVE-2018-2783 in IBM® SDK Java™ Technology Edition that is used by IBM Process Designer in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition. The issue was disclosed as part of the IBM Java SDK updates in April 2018...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Process Designer used in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Process Designer in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition. These issues were disclosed as part of the IBM Java SDK updates in January 2018...

Security Bulletin: Vulnerability in SSLv3 affects IBM Workflow for Bluemix beta (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 was enabled by default in IBM Workflow for Bluemix beta. Vulnerability Details CVE ID: CVE-2014-3566 DESCRIPTION: IBM Workflow for Bluemix beta could allow a...

File Exposure

oozie-core is vulnerable to file exposure. Using a XML directives within a XML workflow file, attackers can expose private/sensitive files within the Oozie server...

CVE-2017-15712

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host...

PT-2018-5983

Name of the Vulnerable Software and Affected Versions: Apache Oozie versions 3.1.3-incubating through 4.3.0 Apache Oozie version 5.0.0-beta1 Description: The issue allows a user to expose private files on the Oozie server process by constructing a workflow XML file containing XML directives and...

LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution

LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary:...

LogicalDOC Enterprise 7.7.4 - User Enumeration Vulnerability

Exploit for java platform in category web applications LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document...

LogicalDOC Enterprise 7.7.4 - Directory Traversal Vulnerability

Exploit for java platform in category web applications LogicalDOC Enterprise 7.7.4 Multiple Directory Traversal Vulnerabilities Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free...

LogicalDOC Enterprise 7.7.4 - User Enumeration

LogicalDOC Enterprise 7.7.4 - User Enumeration LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management...

LogicalDOC Enterprise 7.7.4 Reflected Cross Site Scripting

history.pushState'', '', '/' input type="hid...

LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution

LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management system that is designe...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +133 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (>=0.1-beta-1, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.0, =1.3.0, =1.0, =1.0, =0.9.0-beta-1, =1.0, =2.5.8, =2.5.8.1 and more Source cves: CVE-2018-1000058 Source advisory: MEND:CVE-2018-1000058...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +52 more potentially affected by CVE-2018-1000015 via org.jenkins-ci.plugins.workflow:workflow-durable-task-step (>=0.1-beta-1, <=2.14)

org.jenkins-ci.plugins.workflow:workflow-durable-task-step MAVEN version =0.1-beta-1, =1.9.2-beta, =1.3.0, =0.1.18, =1.0-alpha-2, =1.0-alpha-2, =1.0-alpha-2, =1.0.0-b15, =1.0.0-b15, =1.0-alpha-8, =1.0-alpha-4, =0.1-preview-1, =1.0-alpha-2, =2.2.0, =2.2.1 and more Source cves: CVE-2018-1000015...

Security Strategies for DevOps, APIs, Containers and Microservices

More and more IT professionals see DevSecOps, a practice which integrates security measures earlier in the development process to improve production code quality, as a mainstay for future application development. Much of this stems from the growing trend towards speeding up application developmen...

Change Healthcare Conserus Workflow Intelligence Authentication Bypass Vulnerability

Change Healthcare Conserus Workflow Intelligence application is a diagnostic imaging workflow application for hospitals and health systems from Change Healthcare, USA. An authentication bypass vulnerability exists in the Change Healthcare Conserus Workflow Intelligence application version 2.0.2. ...

CVE-2017-16776

Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical Imaging Company, which is now a Change Healthcare company. The attacker must send a malicious HTTP GET request to exploit the vulnerability...

Authentication flaw

Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical Imaging Company, which is now a Change Healthcare company. The attacker must send a malicious HTTP GET request to exploit the vulnerability...

CVE-2017-16776

Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical Imaging Company, which is now a Change Healthcare company. The attacker must send a malicious HTTP GET request to exploit the vulnerability...

CVE-2017-16776

CVE-2017-16776 concerns Change Healthcare’s Conserus Workflow Intelligence (McKesson Medical Imaging) v2.0.2, where an authentication bypass exists. The exposed component allows exploitation via a malicious HTTP GET request, enabling both unauthenticated users to gain limited access and authentic...