IBM QRadar SIEM Users at Risk of XSS Attack and Information Disclosure

IBM QRadar is a popular SIEM (Security Incident and Event Management) tool that organizations use to detect and monitor threats. It can be used in the form of a physical appliance, a software-only solution, or a virtual appliance. As of 2023, over 1,130 companies worldwide use IBM QRadar as part of their SIEM.

Recently, IBM discovered three new vulnerabilities in IBM QRadar. These vulnerabilities were related to cryptography, cross-site scripting (XSS), and information disclosure. IBM has released fixes for these vulnerabilities. The vulnerabilities were discovered by IBM’s Security Ethical Hacking team.

• Cyber Attack

Apple fixed year’s first actively exploited zero-day flaw

By infosecbulletin / Tuesday , January 28 2025

Apple has issued security updates to address a zero-day flaw affecting iPhone users that is currently being exploited in attacks....

Read More

• Alert
• Cyber Attack

DeepSeek Hit by massive Cyber Attack, Limits Registrations

By infosecbulletin / Tuesday , January 28 2025

DeepSeek, a Chinese AI startup that recently surpassed OpenAI's ChatGPT as the top free app on Apple's App Store in...

Read More

• Alert
• Vulnerabilities

GitHub Desktop Vuln Credential Leaks via Malicious Remote URLs

By infosecbulletin / Tuesday , January 28 2025

Multiple security vulnerabilities have been found in GitHub Desktop and other Git projects. If exploited, these could allow attackers to...

Read More

• Uncategorized

Burp Suite 2025.1 released: Featuring Intruder Capabilities & Bug Fixes

By infosecbulletin / Monday , January 27 2025

PortSwigger has launched Burp Suite 2025.1, adding new features and improvements to enhance usability and efficiency for penetration testers. This...

Read More

• Uncategorized

UnitedHealth confirms 190 million impacted by 2024 data breach

By infosecbulletin / Monday , January 27 2025

UnitedHealth confirmed that the ransomware attack on its Change Healthcare unit last February impacted about 190 million Americans, nearly double...

Read More

• Event

Registration Open For BCS CTF 2025

By infosecbulletin / Monday , January 27 2025

So, to test your cyber security skill, here is another chance to do that. Bangladesh computer society (BCS) is going...

Read More

• International

New Ransomware Tactics Target VMware ESXi Via SSH Tunneling

By infosecbulletin / Sunday , January 26 2025

Sygnia's recent report highlights the changing strategies of ransomware groups targeting VMware ESXi appliances. These attackers exploit vital virtual infrastructure...

Read More

• Uncategorized

Palo Alto Firewalls Found Vulnerable to Secure Boot Bypass

By infosecbulletin / Friday , January 24 2025

An exhaustive evaluation of three firewall models from Palo Alto Networks has uncovered a host of known security flaws impacting...

Read More

• Alert

CISA Releases 6 ICS Advisories Detailing Security Issues

By infosecbulletin / Friday , January 24 2025

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released 6 advisories for Industrial Control Systems (ICS), highlighting vulnerabilities in various...

Read More

• Hot Topic

Account Credentials for Security Vendors Found on Dark Web: Cyble Report

By infosecbulletin / Thursday , January 23 2025

# "While many leaked security credentials belong to customers, some exposed sensitive accounts suggest that security vendors too have been...

Read More

IBM QRadar SIEM Flaw

CVE-2023-26276: Weak Cryptographic Algorithm:

This vulnerability exists due to the use of a weaker or expected cryptographic algorithm in the QRadar tool, which could allow a threat actor to decrypt highly sensitive information. This vulnerability was given a CVSS Score of 5.9 (medium)

ALSO READ:

Cisco AsyncOS Software Flaw Let Remote Hackers Launch XSS Attack

CVE-2023-26274: Cross-Site Scripting (XSS):

An attacker can exploit this vulnerability to embed arbitrary JS code in the Web UI that can alter the functionality that can lead to credentials disclosure through XSS on a trusted session. This vulnerability was given a CVSS Score of 4.6 (medium).

CVE-2022-34352: Information Disclosure
This vulnerability allows a delegated Admin tenant with a specific domain security profile to see other domain data.This vulnerability was given a CVSS Score of 6.5 (medium).

IBM recommended all its users patch their IBM QRadar SIEM by upgrading it to the latest version.

Source: IBM, GB hacker, vulners.com