Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilties

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Cognos Business Intelligence. These issues were disclosed as part of the IBM Java SDK updates in October 2018, January 2019, April 2019, July 2019 and October 2019. IBM Cognos Business Intelligence...

Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilties

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Cognos Analytics. These issues were disclosed as part of the IBM Java SDK updates in October 2017, January 2018, April 2018, July 2018, October 2018, January 2019 and April 2019. Cognos Analytics has...

Various Jira Server setup resources are vulnerable to XSRF/CSRF - CVE-2019-20401

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities. Once a Jira instance is setup i.e. database, admin account, licence, etc. form ar...

Various Jira Server setup resources are vulnerable to XSRF/CSRF - CVE-2019-20401

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities. Once a Jira instance is setup i.e. database, admin account, licence, etc. form ar...

Cisco Unified Communications Manager Cross-Site Request Forgery (XSRF) Vulnerability (cisco-sa-20191002-cucm-csrf)

According to its self-reported version, Cisco Unified Communications Manager is affected by a cross-site request forgery XSRF vulnerability exists in its web application interface component due to insufficient XSRF protections. A remote attacker can exploit this by tricking a user into visiting a...

Mozilla Firefox ESR < 31.6 Multiple Vulnerabilities

Binary data 701254.prm...

Jenkins < 2.176.3 LTS / 2.192 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.192 or is a version of Jenkins LTS prior to 2.176.3. It is, therefore, affected by multiple vulnerabilities: - A stored Cross-site scripting XSS vulnerability exists in the Jenkins update center. An authenticated, remote attack...

Atlassian JIRA 7.13.x < 7.13.6 / 8.x < 8.2.3 / 8.3.x < 8.3.2 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by multiple vulnerabilities: - An open redirect vulnerability exists in the startup.jsp resource. An unauthenticated, remote attacker can exploit this via the...

Atlassian JIRA < 8.4.0 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to prior to 8.4.0. It is, therefore, affected by multiple vulnerabilities: - An authorization bypass vulnerability exists in the /rest/issueNav/1/issueTable resource as well as t...

PHP Laravel Framework Token Unserialize Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x up to 5.6.29. Remote command execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to an insecure unserialize call of the decrypt method in...

phpMyAdmin 4.x < 4.9.0 CSRF vulnerablity (PMASA-2019-4)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.x prior to 4.9.0. It is, therefore, affected by a cross-site request forgery XSRF vulnerability. A remote attacker can exploit this by tricking a user into visiting a specially crafted w...

Security Updates for Azure DevOps Server (June 2019)

The Azure DevOps Server is missing a security update. It is, therefore, affected by a cross-site request forgery XSRF vulnerability: - A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. A...

Apache Tomcat 9.0.x < 9.0.0.M3 Multiple Vulnerabilities

Binary data 700699.pasl...

openSUSE Security Update : phpMyAdmin (openSUSE-2019-1009)

This update for phpMyAdmin fixes security issues and bugs. Security issues addressed in the 4.8.4 release bsc1119245 : - CVE-2018-19968: Local file inclusion through transformation feature - CVE-2018-19969: XSRF/CSRF vulnerability - CVE-2018-19970: XSS vulnerability in navigation tree This update...

WordPress < 5.1.1 Multiple Vulnerabilities

According to its self-reported version number, the WordPress application running on the remote web server is affected by multiple vulnerabilities: - A cross-site request forgery XSRF vulnerability exists in the comment form due to improper validation. A remote attacker can exploit this by trickin...

CVE-2019-0267

SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, Illuminator Servlet currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application...

Information disclosure

SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, Illuminator Servlet currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application...

CVE-2019-0267

CVE-2019-0267 affects SAP Manufacturing Integration and Intelligence (MII), specifically versions 15.0, 15.1 and 15.2, where the Illuminator Servlet does not provide Anti-XSRF tokens. Root cause: lack of anti-forgery protections in the Illuminator Servlet, which can enable Cross-Site Request Forg...

CVE-2019-0267

SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, Illuminator Servlet currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application...

Apache Tomcat < 9.0.0.M3 Multiple Vulnerabilities

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 9.0.0.M3. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists due to a failure to enforce access restrictions when handling...