logo
DATABASE RESOURCES PRICING ABOUT US

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

2023-06-08T21:56:13

Description

## Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security (CP4S). ## Vulnerability Details ** CVEID: **[CVE-2023-28154](<https://vulners.com/cve/CVE-2023-28154>) ** DESCRIPTION: **Webpack could allow a remote attacker to bypass security restrictions, caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain access to the real global object. CVSS Base score: 9.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/249874](<https://exchange.xforce.ibmcloud.com/vulnerabilities/249874>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) ** CVEID: **[CVE-2021-25741](<https://vulners.com/cve/CVE-2021-25741>) ** DESCRIPTION: **Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a symlink exchange flaw in kubelet. By sending a specially-crafted request, an attacker could exploit this vulnerability to create a container with subpath volume mounts to access files and directories outside of the volume. CVSS Base score: 8.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209533](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209533>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2021-25735](<https://vulners.com/cve/CVE-2021-25735>) ** DESCRIPTION: **Kubernetes kube-apiserver could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when performing note updates. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass a Validating Admission Webhook. CVSS Base score: 6.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/199931](<https://exchange.xforce.ibmcloud.com/vulnerabilities/199931>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) ** CVEID: **[CVE-2021-25737](<https://vulners.com/cve/CVE-2021-25737>) ** DESCRIPTION: **Kubernetes could allow a remote authenticated attacker to obtain sensitive information, caused by a host network hijacking flaw due to holes in EndpointSlice validation. By redirecting pod traffic to private networks on a Node, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system. CVSS Base score: 2.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202128](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202128>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) ** CVEID: **[CVE-2020-8562](<https://vulners.com/cve/CVE-2020-8562>) ** DESCRIPTION: **Kubernetes could allow a remote authenticated attacker to obtain sensitive information, caused by a time-of-check time-of-use (TOCTOU) race condition flaw in the API Server proxy. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain access to private networks on the Kubernetes control plane components. CVSS Base score: 2.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/201273](<https://exchange.xforce.ibmcloud.com/vulnerabilities/201273>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) ** CVEID: **[CVE-2022-43441](<https://vulners.com/cve/CVE-2022-43441>) ** DESCRIPTION: **Ghost node-sqlite3 could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the underlying implementation of .ToString() function. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. CVSS Base score: 8.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/250292](<https://exchange.xforce.ibmcloud.com/vulnerabilities/250292>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2020-36518](<https://vulners.com/cve/CVE-2020-36518>) ** DESCRIPTION: **FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By using a large depth of nested objects, a remote attacker could exploit this vulnerability to cause a denial of service. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/222319](<https://exchange.xforce.ibmcloud.com/vulnerabilities/222319>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2021-32797](<https://vulners.com/cve/CVE-2021-32797>) ** DESCRIPTION: **JupyterLab could allow a remote attacker to execute arbitrary code on the system, caused by the lack of sanitization of the action attribute of an HTML form. By persuading a victim to open a specially-crafted notebook, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 7.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/207158](<https://exchange.xforce.ibmcloud.com/vulnerabilities/207158>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) ** CVEID: **[CVE-2017-15708](<https://vulners.com/cve/CVE-2017-15708>) ** DESCRIPTION: **Apache Synapse could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Apache Commons Collections. By injecting specially-crafted serialized objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/136262](<https://exchange.xforce.ibmcloud.com/vulnerabilities/136262>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2015-7501](<https://vulners.com/cve/CVE-2015-7501>) ** DESCRIPTION: **Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. CVSS Base score: 9.8 CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2015-6420](<https://vulners.com/cve/CVE-2015-6420>) ** DESCRIPTION: **Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. CVSS Base score: 9.8 CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2015-4852](<https://vulners.com/cve/CVE-2015-4852>) ** DESCRIPTION: **The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product. CVSS Base score: 9.8 CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2019-13116](<https://vulners.com/cve/CVE-2019-13116>) ** DESCRIPTION: **MuleSoft Mule runtime could allow a remote attacker to execute arbitrary code on the system, caused by Java deserialization, related to Apache Commons Collections. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/169704](<https://exchange.xforce.ibmcloud.com/vulnerabilities/169704>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2022-34305](<https://vulners.com/cve/CVE-2022-34305>) ** DESCRIPTION: **Apache Tomcat is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability using the Form authentication example in the examples web application to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. CVSS Base score: 6.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/229596](<https://exchange.xforce.ibmcloud.com/vulnerabilities/229596>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) ** CVEID: **[CVE-2021-3121](<https://vulners.com/cve/CVE-2021-3121>) ** DESCRIPTION: **An unspecified error with the lack of certain index validation, aka the skippy peanut butter issue in GoGo Protobuf has an unknown impact and attack vector. CVSS Base score: 5.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/194539](<https://exchange.xforce.ibmcloud.com/vulnerabilities/194539>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) ** CVEID: **[CVE-2021-4264](<https://vulners.com/cve/CVE-2021-4264>) ** DESCRIPTION: **LinkedIn Dust.js could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. CVSS Base score: 6.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/242937](<https://exchange.xforce.ibmcloud.com/vulnerabilities/242937>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) ** CVEID: **[CVE-2022-0413](<https://vulners.com/cve/CVE-2022-0413>) ** DESCRIPTION: **Vim could allow a local attacker to execute arbitrary code on the system, caused by a use-after-free in the skipwhite function. An attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 8.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218421](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218421>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2022-0361](<https://vulners.com/cve/CVE-2022-0361>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By submitting a specially-crafted input, a local attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 8.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218216](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218216>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2021-3872](<https://vulners.com/cve/CVE-2021-3872>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By sending a specially-crafted input using Clang 12 + ASan, a local attacker could overflow a buffer and execute arbitrary code or cause a denial of service condition on the system. CVSS Base score: 8.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211573](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211573>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2021-3796](<https://vulners.com/cve/CVE-2021-3796>) ** DESCRIPTION: **Vim is vulnerable to a denial of service, caused by a use-after-free in nv_replace. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause a denial of service. CVSS Base score: 8.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209462](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209462>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) ** CVEID: **[CVE-2022-1154](<https://vulners.com/cve/CVE-2022-1154>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by a use-after-free in mbyte.c in utf_ptr2char. By sending a specially-crafted request, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service. CVSS Base score: 7.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/223115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/223115>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) ** CVEID: **[CVE-2021-4019](<https://vulners.com/cve/CVE-2021-4019>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 7.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/214374](<https://exchange.xforce.ibmcloud.com/vulnerabilities/214374>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2021-3984](<https://vulners.com/cve/CVE-2021-3984>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 7.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/214373](<https://exchange.xforce.ibmcloud.com/vulnerabilities/214373>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2021-3778](<https://vulners.com/cve/CVE-2021-3778>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By sending a specially-crafted input, a local attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 7.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209481](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209481>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2022-1621](<https://vulners.com/cve/CVE-2022-1621>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by vim_strncpy find_word. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service. CVSS Base score: 7.3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/226099](<https://exchange.xforce.ibmcloud.com/vulnerabilities/226099>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) ** CVEID: **[CVE-2022-1629](<https://vulners.com/cve/CVE-2022-1629>) ** DESCRIPTION: **Vim is vulnerable to a buffer overflow, caused by buffer over-read in find_next_quote. By opening a specially-crafted file, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service. CVSS Base score: 6.6 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/226323](<https://exchange.xforce.ibmcloud.com/vulnerabilities/226323>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) ** CVEID: **[CVE-2022-0392](<https://vulners.com/cve/CVE-2022-0392>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system, modify memory, or cause a denial of service. CVSS Base score: 6.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218430](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218430>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) ** CVEID: **[CVE-2022-0359](<https://vulners.com/cve/CVE-2022-0359>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially-crafted session file, a remote attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 6.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218214](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218214>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) ** CVEID: **[CVE-2022-0318](<https://vulners.com/cve/CVE-2022-0318>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 6.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217941](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217941>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) ** CVEID: **[CVE-2021-4193](<https://vulners.com/cve/CVE-2021-4193>) ** DESCRIPTION: **Vim could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability obtain sensitive information, and use this information to launch further attacks against the affected system. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/216465](<https://exchange.xforce.ibmcloud.com/vulnerabilities/216465>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) ** CVEID: **[CVE-2021-4192](<https://vulners.com/cve/CVE-2021-4192>) ** DESCRIPTION: **Vim could allow a remote attacker to obtain sensitive information, caused by a use-after-free flaw. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability obtain sensitive information, and use this information to launch further attacks against the affected system. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/216466](<https://exchange.xforce.ibmcloud.com/vulnerabilities/216466>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) ** CVEID: **[CVE-2022-0261](<https://vulners.com/cve/CVE-2022-0261>) ** DESCRIPTION: **Vim is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system. CVSS Base score: 4.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217526](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217526>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) ** CVEID: **[CVE-2019-16777](<https://vulners.com/cve/CVE-2019-16777>) ** DESCRIPTION: **npm CLI could allow a local attacker to bypass security restrictions, caused by the failure to prevent existing globally-installed binaries to be overwritten by other package installations. An attacker could exploit this vulnerability to bypass filesystem access restrictions to overwrite an existing binary with a globally-installed package. CVSS Base score: 6.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/173159](<https://exchange.xforce.ibmcloud.com/vulnerabilities/173159>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) ** CVEID: **[CVE-2019-16775](<https://vulners.com/cve/CVE-2019-16775>) ** DESCRIPTION: **npm CLI could allow a local attacker to bypass security restrictions, caused by an arbitrary file overwrite vulnerability. An attacker could exploit this vulnerability to bypass filesystem access restrictions to create symlinks to files outside of the node_modules folder through the bin field upon installation. CVSS Base score: 6.2 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/173163](<https://exchange.xforce.ibmcloud.com/vulnerabilities/173163>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) ** CVEID: **[CVE-2020-15095](<https://vulners.com/cve/CVE-2020-15095>) ** DESCRIPTION: **Node.js npm CLI module could allow a local attacker to obtain sensitive information, caused by the storing of user credentials in the log file. By persuading a victim to open a log file, an attacker could exploit this vulnerability to obtain user credentials. CVSS Base score: 4.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/184666](<https://exchange.xforce.ibmcloud.com/vulnerabilities/184666>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) ** CVEID: **[CVE-2023-22467](<https://vulners.com/cve/CVE-2023-22467>) ** DESCRIPTION: **Moment.js Luxon is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw due to the use of quadratic (N^2) complexity in the DateTime.fromRFC2822() function. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a slowdown in data process, and results in a denial of service condition. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/243783](<https://exchange.xforce.ibmcloud.com/vulnerabilities/243783>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2021-23346](<https://vulners.com/cve/CVE-2021-23346>) ** DESCRIPTION: **Node.js html-parse-stringify and html-parse-stringify2 modules are vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS). By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the process to freeze, and results in a denial of service condition. CVSS Base score: 5.9 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/197736](<https://exchange.xforce.ibmcloud.com/vulnerabilities/197736>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2020-8559](<https://vulners.com/cve/CVE-2020-8559>) ** DESCRIPTION: **Kubernetes kube-apiserver could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when multiple clusters share the same certificate authority trusted by the client. By intercepting certain requests and sending a redirect response, an attacker could exploit this vulnerability to compromise other nodes. CVSS Base score: 6.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/185302](<https://exchange.xforce.ibmcloud.com/vulnerabilities/185302>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2022-3172](<https://vulners.com/cve/CVE-2022-3172>) ** DESCRIPTION: **Kubernetes kube-apiserver is vulnerable to server-side request forgery, caused by a flaw with allowing an aggregated API server to redirect client traffic to any URL. By sending a specially-crafted request, an attacker could exploit this vulnerability to conduct SSRF attack to unexpected actions and the client's API server credentials to third parties. CVSS Base score: 5.1 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/236344](<https://exchange.xforce.ibmcloud.com/vulnerabilities/236344>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) ** CVEID: **[CVE-2019-11253](<https://vulners.com/cve/CVE-2019-11253>) ** DESCRIPTION: **The Kubernetes API server is vulnerable to a denial of service, caused by a billion laughs attack, caused by an error when parsing YAML manifests. A remote attacker could exploit this vulnerability to cause a denial of service condition. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/168618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/168618>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2020-8565](<https://vulners.com/cve/CVE-2020-8565>) ** DESCRIPTION: **Kubernetes could allow a local authenticated attacker to obtain sensitive information, caused by a flaw when kube-apiserver is using logLevel >= 9. By gaining access to the log files, an attacker could exploit this vulnerability to obtain the Kubernetes authorization tokens information, and use this information to launch further attacks against the affected system. CVSS Base score: 4.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/189925](<https://exchange.xforce.ibmcloud.com/vulnerabilities/189925>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) ** CVEID: **[CVE-2021-41190](<https://vulners.com/cve/CVE-2021-41190>) ** DESCRIPTION: **Open Container Initiative Distribution Specification could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when a Content-Type header changed between two pulls of the same digest. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause a client to interpret the resulting content differently. CVSS Base score: 3 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/213802](<https://exchange.xforce.ibmcloud.com/vulnerabilities/213802>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N) ** CVEID: **[CVE-2020-14040](<https://vulners.com/cve/CVE-2020-14040>) ** DESCRIPTION: **Go Language x/text package is vulnerable to a denial of service, caused by a vulnerability in encoding/unicode in the UTF-16 decoder. By sending a single byte to a UTF16 decoder, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/184313](<https://exchange.xforce.ibmcloud.com/vulnerabilities/184313>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2019-11254](<https://vulners.com/cve/CVE-2019-11254>) ** DESCRIPTION: **Kubernetes is vulnerable to a denial of service, caused by a flaw in kube-apiserver. By sending a specially-crafted request using YAML payloads, a remote authenticated attacker could exploit this vulnerability to consume excessive CPU cycles. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/178935](<https://exchange.xforce.ibmcloud.com/vulnerabilities/178935>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2021-31525](<https://vulners.com/cve/CVE-2021-31525>) ** DESCRIPTION: **Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted header to ReadRequest or ReadResponse. Server, Transport, and Client, a remote attacker could exploit this vulnerability to cause a (panic) denial of service condition. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202709](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202709>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2020-9283](<https://vulners.com/cve/CVE-2020-9283>) ** DESCRIPTION: **Golang golang.org/x/crypto is vulnerable to a denial of service, caused by an error during signature verification in the golang.org/x/crypto/ssh package. By persuading a victim to run a specially crafted file, a remote attacker could exploit this vulnerability to cause a panic. CVSS Base score: 5.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/176688](<https://exchange.xforce.ibmcloud.com/vulnerabilities/176688>) for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) ** CVEID: **[CVE-2021-32760](<https://vulners.com/cve/CVE-2021-32760>) ** DESCRIPTION: **Containerd could allow a remote attacker to gain elevated privileges on the system, caused by improper file permissions. By pulling and extracting a specially-crafted container image, an attacker could exploit this vulnerability to perform Unix file permission changes for existing files in the host's filesystem. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205942](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205942>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2019-11250](<https://vulners.com/cve/CVE-2019-11250>) ** DESCRIPTION: **Kubernetes could allow a remote attacker to obtain sensitive information, caused by storing credentials in the log by the client-go library. By sending a specially-crafted command, a remote attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/166710](<https://exchange.xforce.ibmcloud.com/vulnerabilities/166710>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) ** CVEID: **[CVE-2021-41092](<https://vulners.com/cve/CVE-2021-41092>) ** DESCRIPTION: **Docker CLI could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when running "docker login my-private-registry.example.com" command with a misconfigured configuration file. By sending a specially-crafted HTTP request, an attacker could exploit this vulnerability to obtain credentials information, and use this information to launch further attacks against the affected system. CVSS Base score: 5.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/210712](<https://exchange.xforce.ibmcloud.com/vulnerabilities/210712>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) ** CVEID: **[CVE-2020-29652](<https://vulners.com/cve/CVE-2020-29652>) ** DESCRIPTION: **Golang Go is vulnerable to a denial of service, caused by a NULL pointer dereference in the golang.org/x/crypto/ssh component. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service. CVSS Base score: 7.5 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193622>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) ** IBM X-Force ID: **221455 ** DESCRIPTION: **Node.js bunyan module could allow a remote attacker to execute arbitrary code on the system, caused by improper validation of user-supplied input. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 9.8 CVSS Temporal Score: See: [https://exchange.xforce.ibmcloud.com/vulnerabilities/221455 ](<https://exchange.xforce.ibmcloud.com/vulnerabilities/221455>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ## Affected Products and Versions Affected Product(s)| Version(s) ---|--- Cloud Pak for Security (CP4S)| 1.10.0.0 - 1.10.10.0 ## Remediation/Fixes IBM encourages customers to update their systems promptly. Please upgrade to at least CP4S 1.10.11.0 following these instructions: <https://www.ibm.com/docs/en/cloud-paks/cp-security/1.10?topic=installing-upgrading-cloud-pak-security> ## Workarounds and Mitigations None ##


Affected Software


CPE Name Name Version
ibm cloud pak for security 1.10

Related


rosalinux
unix

Advisory ROSA-SA-2023-2214

2023-08-15T09:10:06
rosalinux
unix

Advisory ROSA-SA-2023-2215

2023-08-15T09:26:16
ibm
software

Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of Apache Commons Collections (multiple vulnerabilities)

2022-11-22T16:37:00
ibm
software

Security Bulletin: Multiple vulnerabilities in Apache Commons Collections affect IBM InfoSphere Information Server

2022-10-14T22:00:35
ibm
software

Security Bulletin: Multiple vulnerabilities of Apache common collections (commons-collections-3.2.jar) have affected APM WebSphere Application Server Agent

2023-07-17T06:26:40
ibm
software

Security Bulletin: IBM Jazz for Service Management (JazzSM) is affected with multiple vulnerabilities (CVE-2015-4852, CVE-2015-6420, CVE-2017-15708)

2020-10-20T11:33:26
ibm
software

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

2022-08-20T18:34:23
ibm
software

Security Bulletin: IBM Sterling Global Mailbox is vulnerable to arbitrary code execution due to Apache Commons Collections [CVE-2015-6420, CVE-2017-15708]

2023-07-21T12:22:34
ibm
software

Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Kubernetes.

2023-02-14T21:14:53
ibm
software

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

2022-08-20T18:32:48
ibm
software

Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Kubernetes.

2023-02-14T21:04:36
ibm
software

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Node.js

2023-05-17T20:51:25
ibm
software

Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager DR

2021-07-30T21:12:22
ibm
software

Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager HA

2021-07-30T21:03:51
ibm
software

Security Bulletin: IBM Cloud Pak for Security is vulnerable to using components with known vulnerabilities

2022-10-28T19:52:12
ibm
software

Security Bulletin: IBM Edge Application Manager 4.5 addresses multiple security vulnerabilities

2023-05-31T05:42:24
ibm
software

Security Bulletin: Open Source Secuity issues fixed for NPS softlayer provisioner.

2020-12-11T07:10:49
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM WebSphere eXtreme Scale Liberty Deployment.

2021-05-27T08:03:54
ibm
software

Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go and Kubernetes.

2023-02-14T21:14:53
ibm
software

Security Bulletin: IBM App Connect Enterprise Certified Container flows that use scheduled event nodes may be vulnerable to denial of service due to [CVE-2023-22467]

2023-02-02T20:24:18
ibm
software

Security Bulletin: A vulnerability in Luxon may affect IBM Robotic Process Automation and result in a denial of service (CVE-2023-22467)

2023-03-23T21:35:24
ibm
software

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to Moment CVE-2023-22467

2023-03-20T18:15:15
ibm
software

Security Bulletin: IBM Edge Application Manager has a vulnerability listed in CVE 2023-28154. IBM has addressed this vulnerability.

2023-06-01T20:27:52
ibm
software

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Webpack (CVE-2023-28154)

2023-04-11T12:52:52
ibm
software

Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go and Kubernetes.

2023-02-14T21:04:36
ibm
software

Security Bulletin: Open Source Dependency Vulnerability

2023-05-15T18:52:05
ibm
software

Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go.

2023-02-14T21:04:36
redhat
unix

(RHSA-2022:0894) Moderate: vim security update

2022-03-15T09:11:53
redhat
unix

(RHSA-2022:0366) Moderate: vim security update

2022-02-01T20:12:46
redhat
unix

(RHSA-2022:0476) Important: Red Hat OpenShift GitOps security update

2022-02-08T22:00:22
redhat
unix

(RHSA-2021:4517) Moderate: vim security update

2021-11-09T13:22:45
redhat
unix

(RHSA-2022:5319) Moderate: vim security update

2022-06-28T10:52:18
redhat
unix

(RHSA-2022:0721) Moderate: OpenShift Logging bug fix and security update (5.3.5)

2022-03-01T14:01:24
redhat
unix

(RHSA-2020:3372) Moderate: Red Hat OpenShift Service Mesh 3scale-istio-adapter-rhel8-container security update

2020-08-06T20:17:21
redhat
unix

(RHSA-2022:5242) Moderate: vim security update

2022-06-28T08:27:06
redhat
unix

(RHSA-2022:2183) Moderate: Release of containers for OSP 16.2.z director operator tech preview

2022-05-11T11:27:13
redhat
unix

(RHSA-2019:3132) Important: OpenShift Container Platform 4.1.20 openshift security update

2019-10-16T15:24:10
redhat
unix

(RHSA-2020:2789) Low: OpenShift Container Platform 4.4.11 ose-baremetal-operator-container security update

2020-07-06T20:25:04
redhat
unix

(RHSA-2020:3414) Low: OpenShift Container Platform 4.5.5 security update

2020-08-12T04:43:08
nessus
scanner

CentOS 8 : vim (CESA-2022:0894)

2022-03-15T00:00:00
nessus
scanner

Oracle Linux 8 : vim (ELSA-2022-0894)

2022-03-16T00:00:00
nessus
scanner

RHEL 8 : vim (RHSA-2022:0894)

2022-03-15T00:00:00
nessus
scanner

Oracle Linux 8 : vim (ELSA-2022-0366)

2022-02-03T00:00:00
nessus
scanner

RHEL 8 : vim (RHSA-2022:0366)

2022-02-02T00:00:00
nessus
scanner

AlmaLinux 8 : vim (ALSA-2022:0366)

2022-03-11T00:00:00
nessus
scanner

CentOS 8 : vim (CESA-2022:0366)

2022-02-02T00:00:00
nessus
scanner

openSUSE 15 Security Update : vim (openSUSE-SU-2022:0736-1)

2022-03-05T00:00:00
nessus
scanner

SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2022:0736-1)

2022-03-05T00:00:00
nessus
scanner

Ubuntu 16.04 ESM : Vim vulnerabilities (USN-5433-1)

2022-05-24T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.2.0 : vim (EulerOS-SA-2021-2845)

2021-12-29T00:00:00
nessus
scanner

EulerOS 2.0 SP5 : vim (EulerOS-SA-2021-2937)

2021-12-31T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.6.6 : vim (EulerOS-SA-2022-1153)

2022-02-13T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.2.6 : vim (EulerOS-SA-2023-1053)

2023-01-06T00:00:00
nessus
scanner

EulerOS Virtualization 2.9.1 : vim (EulerOS-SA-2022-1617)

2022-05-05T00:00:00
nessus
scanner

Amazon Linux AMI : vim (ALAS-2022-1597)

2022-06-10T00:00:00
nessus
scanner

EulerOS Virtualization 2.9.0 : vim (EulerOS-SA-2022-1641)

2022-05-05T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-1441)

2022-04-18T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-1462)

2022-04-18T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.6.0 : vim (EulerOS-SA-2022-1054)

2022-02-11T00:00:00
nessus
scanner

EulerOS 2.0 SP3 : vim (EulerOS-SA-2022-1769)

2022-05-26T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : vim (EulerOS-SA-2021-2817)

2021-12-25T00:00:00
nessus
scanner

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-1236)

2022-02-25T00:00:00
nessus
scanner

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-1217)

2022-02-25T00:00:00
nessus
scanner

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-1669)

2022-05-06T00:00:00
nessus
scanner

Rocky Linux 8 : vim (RLSA-2021:4517)

2022-02-09T00:00:00
nessus
scanner

EulerOS 2.0 SP10 : vim (EulerOS-SA-2022-1655)

2022-05-06T00:00:00
nessus
scanner

SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2020:0063-1)

2020-01-13T00:00:00
nessus
scanner

SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2020:0104-1)

2020-01-16T00:00:00
nessus
scanner

openSUSE Security Update : nodejs8 (openSUSE-2020-59)

2020-01-15T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.2.0 : vim (EulerOS-SA-2022-1699)

2022-05-07T00:00:00
nessus
scanner

RHEL 8 : vim (RHSA-2021:4517)

2021-11-11T00:00:00
nessus
scanner

Fedora 34 : 2:vim (2021-968f57ec98)

2021-10-17T00:00:00
nessus
scanner

CentOS 8 : vim (CESA-2021:4517)

2021-11-11T00:00:00
nessus
scanner

Oracle Linux 8 : vim (ELSA-2021-4517)

2021-11-17T00:00:00
nessus
scanner

Photon OS 3.0: Vim PHSA-2021-3.0-0346

2022-01-10T00:00:00
nessus
scanner

Rocky Linux 8 : vim (RLSA-2022:366)

2022-02-09T00:00:00
nessus
scanner

AlmaLinux 8 : vim (ALSA-2021:4517)

2022-02-09T00:00:00
nessus
scanner

RHEL 8 : vim (RHSA-2022:5319)

2022-07-01T00:00:00
nessus
scanner

Oracle Linux 8 : vim (ELSA-2022-5319)

2022-07-01T00:00:00
nessus
scanner

SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:0247-1)

2020-01-30T00:00:00
nessus
scanner

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:0043-1)

2020-01-09T00:00:00
nessus
scanner

FreeBSD : NPM -- Multiple vulnerabilities (2a3588b4-ab12-11ea-a051-001b217b3468)

2020-06-11T00:00:00
nessus
scanner

EulerOS 2.0 SP5 : vim (EulerOS-SA-2022-1339)

2022-03-21T00:00:00
nessus
scanner

Fedora 31 : 1:libuv / 1:nodejs (2020-595ce5e3cc)

2020-01-27T00:00:00
nessus
scanner

EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2022-1415)

2022-04-18T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : vim (EulerOS-SA-2021-2913)

2021-12-30T00:00:00
nessus
scanner

EulerOS 2.0 SP3 : vim (EulerOS-SA-2022-1193)

2022-02-23T00:00:00
nessus
scanner

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 21.04 : Vim vulnerabilities (USN-5093-1)

2021-09-29T00:00:00
nessus
scanner

EulerOS Virtualization 2.10.1 : vim (EulerOS-SA-2022-1389)

2022-04-18T00:00:00
nessus
scanner

EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2022-2042)

2022-07-14T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : vim (EulerOS-SA-2021-2921)

2021-12-30T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : vim (EulerOS-SA-2022-1363)

2022-03-28T00:00:00
nessus
scanner

AlmaLinux 9 : vim (ALSA-2022:5242)

2022-11-16T00:00:00
nessus
scanner

RHEL 9 : vim (RHSA-2022:5242)

2022-07-01T00:00:00
nessus
scanner

Oracle Linux 9 : vim (ELSA-2022-5242)

2022-07-07T00:00:00
nessus
scanner

Debian DLA-3011-1 : vim - LTS security update

2022-05-17T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2022-2218)

2022-08-17T00:00:00
nessus
scanner

Debian DLA-2947-1 : vim - LTS security update

2022-03-16T00:00:00
nessus
scanner

Debian DSA-5373-1 : node-sqlite3 - security update

2023-03-16T00:00:00
nessus
scanner

Rocky Linux 9 : pcs (RLSA-2023:1591)

2023-04-06T00:00:00
nessus
scanner

Amazon Linux 2 : vim (ALAS-2021-1728)

2021-12-10T00:00:00
nessus
scanner

openSUSE 15 Security Update : python-jupyterlab (openSUSE-SU-2022:10075-1)

2022-08-03T00:00:00
nessus
scanner

RHEL 7 / 8 : OpenShift Container Platform 4.5 package (RHSA-2020:2413)

2020-07-14T00:00:00
nessus
scanner

RHEL 7 / 8 : OpenShift Container Platform 4.1.20 openshift (RHSA-2019:3132)

2019-10-17T00:00:00
nessus
scanner

Amazon Linux 2 : vim (ALAS-2022-1751)

2022-02-21T00:00:00
nessus
scanner

Debian DLA-2455-1 : packer security update

2020-11-19T00:00:00
nessus
scanner

Fedora 38 : pcs (2023-4d546e6b4b)

2023-04-24T00:00:00
rocky
unix

vim security update

2022-03-15T09:11:53
rocky
unix

vim security update

2022-02-01T20:12:46
rocky
unix

vim security update

2021-11-09T13:22:45
rocky
unix

vim security update

2022-06-28T10:52:18
rocky
unix

12 enhancement update

2020-02-04T08:35:22
rocky
unix

vim security update

2022-02-02T04:36:58
oraclelinux
unix

vim security update

2022-03-16T00:00:00
oraclelinux
unix

vim security update

2022-02-03T00:00:00
oraclelinux
unix

vim security update

2021-11-16T00:00:00
oraclelinux
unix

vim security update

2022-07-01T00:00:00
oraclelinux
unix

vim security update

2022-06-30T00:00:00
almalinux
unix

Moderate: vim security update

2022-03-15T09:11:53
almalinux
unix

Moderate: vim security update

2022-02-01T20:12:46
almalinux
unix

Moderate: vim security update

2021-11-09T13:22:45
almalinux
unix

Moderate: vim security update

2022-06-30T00:00:00
almalinux
unix

Moderate: vim security update

2022-07-01T00:00:00
f5
software

Vim vulnerabilities CVE-2022-0261, CVE-2022-0318, CVE-2022-0361, CVE-2022-0392, and CVE-2022-0413

2022-04-04T17:18:00
suse
unix

Security update for vim (important)

2022-03-04T00:00:00
suse
unix

Security update for nodejs8 (important)

2020-01-15T00:00:00
ubuntu
unix

Vim vulnerabilities

2022-05-23T00:00:00
ubuntu
unix

Vim vulnerabilities

2021-09-28T00:00:00
veracode
software

Potential Remote Code Execution Via Java Object Deserialization

2015-11-09T19:34:22
veracode
software

Denial Of Service (DoS)

2020-12-18T10:28:37
veracode
software

Regular Expression Denial Of Service

2023-01-09T04:25:17
veracode
software

Unauthorized File Access

2019-12-12T02:26:11
veracode
software

Regular Expression Denial Of Service (ReDoS)

2021-03-05T00:54:55
veracode
software

Arbitrary Code Execution

2023-03-15T17:14:42
hackerone
bugbounty

Kubernetes: CVE-2019-11250 remains in effect.

2020-08-06T17:42:21
amazon
unix

Important: vim

2022-05-31T23:47:00
amazon
unix

Medium: vim

2021-12-08T16:27:00
amazon
unix

Medium: vim

2021-12-08T16:27:00
amazon
unix

Medium: vim

2022-02-17T18:34:00
amazon
unix

Medium: vim

2022-02-15T22:55:00
fedora
unix

[SECURITY] Fedora 35 Update: vim-8.2.3512-1.fc35

2021-10-29T23:26:46
fedora
unix

[SECURITY] Fedora 33 Update: vim-8.2.3512-1.fc33

2021-10-23T03:25:44
fedora
unix

[SECURITY] Fedora 34 Update: vim-8.2.3512-1.fc34

2021-10-16T20:44:57
fedora
unix

[SECURITY] Fedora 31 Update: nodejs-12.14.1-3.fc31

2020-01-24T17:08:57
fedora
unix

[SECURITY] Fedora 31 Update: libuv-1.34.1-1.fc31

2020-01-24T17:08:56
fedora
unix

[SECURITY] Fedora 34 Update: vim-8.2.4232-1.fc34

2022-02-04T01:24:30
ubuntucve
info

CVE-2015-4852

2015-11-18T00:00:00
ubuntucve
info

CVE-2019-16777

2019-12-13T00:00:00
ubuntucve
info

CVE-2022-43441

2023-03-16T00:00:00
ubuntucve
info

CVE-2020-29652

2020-12-17T00:00:00
redhatcve
info

CVE-2020-8565

2020-10-16T00:02:11
redhatcve
info

CVE-2020-29652

2020-12-17T20:48:54
redhatcve
info

CVE-2021-23346

2021-03-22T15:58:33
redhatcve
info

CVE-2023-22467

2023-01-11T08:35:01
redhatcve
info

CVE-2019-16777

2020-04-03T02:09:04
canvas
exploit

Immunity Canvas: WEBLOGIC_T3_DESERIALIZATION

2017-11-09T17:29:00
cloudlinux
unix

Fix of CVE: CVE-2021-3778, CVE-2021-3796

2021-10-11T15:13:49
cloudlinux
unix

Fix of CVE: CVE-2021-3778, CVE-2021-3796

2021-10-20T15:51:58
cloudlinux
unix

Fix of CVE: CVE-2021-4192, CVE-2021-4193

2022-01-13T15:24:57
mageia
unix

Updated vim packages fix security vulnerability

2021-10-20T21:28:32
photon
unix

Important Photon OS Security Update - PHSA-2021-0430

2021-12-21T00:00:00
openvas
scanner

openSUSE: Security Advisory for nodejs8 (openSUSE-SU-2020:0059_1)

2020-01-27T00:00:00
openvas
scanner

Fedora: Security Advisory for nodejs (FEDORA-2020-595ce5e3cc)

2020-01-27T00:00:00
openvas
scanner

Fedora: Security Advisory for libuv (FEDORA-2020-595ce5e3cc)

2020-01-27T00:00:00
freebsd
unix

NPM -- Multiple vulnerabilities

2019-12-18T00:00:00
cloudfoundry
software

USN-5093-1: Vim vulnerabilities | Cloud Foundry

2021-10-28T00:00:00
cve
NVD

CVE-2019-13116

2019-10-16T20:15:00
cve
NVD

CVE-2021-23346

2021-03-04T17:15:00
cve
NVD

CVE-2019-11250

2019-08-29T01:15:00
cve
NVD

CVE-2022-43441

2023-03-16T21:15:00
cve
NVD

CVE-2020-29652

2020-12-17T05:15:00
github
software

Mulesoft Mule Unsafe Deserialization

2022-05-24T16:58:52
github
software

Arbitrary File Write in npm

2019-12-13T15:39:19
github
software

Luxon Inefficient Regular Expression Complexity vulnerability

2023-01-09T14:10:49
github
software

npm Vulnerable to Global node_modules Binary Overwrite

2019-12-13T15:39:32
github
software

Kubernetes client-go library logs may disclose credentials to unauthorized users

2022-05-24T16:55:06
github
software

html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)

2021-03-18T19:39:31
github
software

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

2021-08-23T19:40:22
osv
software

vim - security update

2022-05-16T00:00:00
osv
software

Mulesoft Mule Unsafe Deserialization

2022-05-24T16:58:52
osv
software

Arbitrary File Write in npm

2019-12-13T15:39:19
osv
software

html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)

2021-03-18T19:39:31
osv
software

vim - security update

2022-01-10T00:00:00
osv
software

PYSEC-2021-130

2021-08-09T21:15:00
debian
unix

[SECURITY] [DLA 3011-1] vim security update

2022-05-16T19:42:09
debian
unix

[SECURITY] [DLA 2947-1] vim security update

2022-03-11T22:50:56
debian
unix

[SECURITY] [DLA 2455-1] packer security update

2020-11-18T21:02:24
debiancve
info

CVE-2019-16775

2019-12-13T01:15:00
debiancve
info

CVE-2022-43441

2023-03-16T21:15:00
debiancve
info

CVE-2019-11253

2019-10-17T16:15:00
debiancve
info

CVE-2020-9283

2020-02-20T20:15:00
prion
NVD

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

2021-08-09T21:15:00
prion
NVD

Regular Expression Denial of Service (ReDoS)

2021-03-04T17:15:00
talos
info

Ghost Foundation node-sqlite3 code execution vulnerability

2023-03-16T00:00:00
gitlab
software

Credentials Management

2019-08-29T00:00:00
gitlab
software

Insertion of Sensitive Information into Log File

2022-05-24T00:00:00
archlinux
unix

[ASA-202108-10] jupyterlab: cross-site scripting

2021-08-10T00:00:00
talosblog
blog

Vulnerability Spotlight: Node-SQLite3 issue could lead to denial of service in Ghost CMS

2023-03-16T18:32:29
exploitpack
exploit

Go SSH servers 0.0.2 - Denial of Service (PoC)

2020-02-24T00:00:00