Dmitryi Beryoza

The issue allows an authenticated user to access some privileged functionality of the server.

The issue is related to an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials.

The issue is caused by a XML external entity (XXE) error when processing XML data by the XML parser, allowing a remote attacker to obtain sensitive information. This could enable the attacker to read arbitrary files on the system or cause a denial of service.

The issue allows an authenticated attacker to potentially load malicious code due to insufficient verification of the origin and integrity of patches, image backups, and other updates.

The issue is related to security misconfigurations that could allow a remote attacker to obtain sensitive information.

The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session.

The issue allows an authenticated user to gain access to highly sensitive information due to incorrect file permissions.

The issue allows an unauthenticated user to gain access to sensitive information by entering invalid file names.

The issue allows web pages to be stored locally, which can then be accessed by another user on the system, potentially leading to unauthorized data access.

The issue is related to an XML External Entity Injection (XXE) error when processing XML data, which can lead to a denial of service. A remote attacker could exploit this to expose highly sensitive information or consume all available memory resources.

The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions from a user that the website trusts.

The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle techniques.

The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the URLs through server logs, referer headers, or browser history.

The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view information in the back-end database. This is due to the software being vulnerable to SQL injection.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the UI of IBM QRadar SIEM. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via crafted fields in a URL.

A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands.

The issue is related to the mishandling of authorization, allowing remote authenticated users to obtain sensitive information.

The issue allows local users to modify data by writing to a file due to weak permissions for unspecified directories under the web root.

The issue allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences due to multiple cross-site request forgery (CSRF) vulnerabilities.

The issue allows remote attackers to bypass intended access restrictions via modified request parameters.