IBM QRadar SIEM Users at Risk of XSS Attack and Information Disclosure

IBM QRadar is a popular SIEM (Security Incident and Event Management) tool that organizations use to detect and monitor threats. It can be used in the form of a physical appliance, a software-only solution, or a virtual appliance. As of 2023, over 1,130 companies worldwide use IBM QRadar as part of their SIEM.

Recently, IBM discovered three new vulnerabilities in IBM QRadar. These vulnerabilities were related to cryptography, cross-site scripting (XSS), and information disclosure. IBM has released fixes for these vulnerabilities. The vulnerabilities were discovered by IBM’s Security Ethical Hacking team.

• Alert
• Vulnerabilities

AWS Patches Multiple Vulns in WorkSpaces, AppStream 2.0

By infosecbulletin / Friday , January 17 2025

Amazon Web Services (AWS) has recently fixed two major security vulnerabilities in its cloud services: Amazon WorkSpaces, Amazon AppStream 2.0,...

Read More

• International

Malware Trends Review 2024: Ever Recorded Cyber Threats

By infosecbulletin / Friday , January 17 2025

Last year saw a significant rise in cyber threats, with malware becoming more advanced and attack strategies more sophisticated. A...

Read More

• Alert
• Vulnerabilities

Botnet Exploits 13,000 MikroTik Devices Abusing Misconfigured DNS

By infosecbulletin / Thursday , January 16 2025

A recent Infoblox Threat Intel report reveals a sophisticated botnet that exploits DNS misconfigurations to spread malware widely. This botnet,...

Read More

• Alert
• Vulnerabilities

CVE-2024-9042
Code Execution Vulnerability Found in Kubernetes Windows Nodes

By infosecbulletin / Thursday , January 16 2025

A new security flaw traced, CVE-2024-9042, poses a serious risk to Kubernetes clusters with Windows worker nodes. It has a...

Read More

• Data Breach
• Vulnerabilities

Hacker leaked 15k config files and VPN passwords of FortiGate firewall device

By infosecbulletin / Thursday , January 16 2025

The hacking group "Belsen Group" has posted over 15,000 unique FortiGate firewall configurations online. The data dump, reportedly obtained by exploiting...

Read More

• Event

Registration open for 1st Agile Cyber Drill 2025

By infosecbulletin / Thursday , January 16 2025

Registration open for "1st Agile Cyber Drill-2025" scheduled for February 26, 2025 online with an awards ceremony for 9 March...

Read More

• Event

30 Days to Go for FutureCrime Summit 2025

By infosecbulletin / Wednesday , January 15 2025

The FutureCrime Summit 2025 is just 30 days away. This conference is the largest on technology-driven crime, covering topics like...

Read More

• Uncategorized

Microsoft January 2025 Patch, 159 Vuls, 10 Critical RCE’s

By infosecbulletin / Wednesday , January 15 2025

Microsoft's January Patch Tuesday update fixed 159 vulnerabilities, including 10 critical Remote Code Execution (RCE) issues. These updates are essential...

Read More

• Uncategorized

CVE-2023-37936
Fortinet released update for a critical cryptographic key vuln

By infosecbulletin / Tuesday , January 14 2025

Fortinet released security patches for a critical vulnerability (CVE-2023-37936) involving a hard-coded cryptographic key. This flaw lets remote, unauthorized attackers...

Read More

• Alert
• Vulnerabilities

Millions of Accounts Vulnerable due to Google’s OAuth Flaw

By infosecbulletin / Tuesday , January 14 2025

A critical flaw in Google’s "Sign in with Google" system has put millions of Americans at risk of data theft....

Read More

IBM QRadar SIEM Flaw

CVE-2023-26276: Weak Cryptographic Algorithm:

This vulnerability exists due to the use of a weaker or expected cryptographic algorithm in the QRadar tool, which could allow a threat actor to decrypt highly sensitive information. This vulnerability was given a CVSS Score of 5.9 (medium)

ALSO READ:

Cisco AsyncOS Software Flaw Let Remote Hackers Launch XSS Attack

CVE-2023-26274: Cross-Site Scripting (XSS):

An attacker can exploit this vulnerability to embed arbitrary JS code in the Web UI that can alter the functionality that can lead to credentials disclosure through XSS on a trusted session. This vulnerability was given a CVSS Score of 4.6 (medium).

CVE-2022-34352: Information Disclosure
This vulnerability allows a delegated Admin tenant with a specific domain security profile to see other domain data.This vulnerability was given a CVSS Score of 6.5 (medium).

IBM recommended all its users patch their IBM QRadar SIEM by upgrading it to the latest version.

Source: IBM, GB hacker, vulners.com