DATABASE RESOURCES PRICING ABOUT US

{"id": "B2EA2FBA4D280351FEA7F9EC1921C448D44F4D9EC613590A87A15467F7D34153", "vendorId": null, "type": "ibm", "bulletinFamily": "software", "title": "Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)", "description": "## Summary\n\nIBM Data Risk Manager (IDRM) is affected but not classified as vulnerable to a remote code execution in Spring Framework (CVE-2022-22965) as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR (in contrast to a Spring Boot executable jar), 4. Spring-webmvc or spring-webflux dependency, 5. Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions. This fix includes Spring Boot 2.6.6 and Spring Framework 5.3.18, and addresses multiple vulnerabilities with an updated version of IDRM 2.0.6.13. Please see the remediation steps below to apply the fix. All customers are encouraged to act quickly to update their systems.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-22942](<https://vulners.com/cve/CVE-2022-22942>) \n** DESCRIPTION: **Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by improper file descriptor handling in the vmwgfx driver. By sending a specially-crafted ioctl call, an attacker could exploit this vulnerability to gain access to files opened by other processes on the system, and use this information to launch further attacks against the affected system. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218323](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218323>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2021-4155](<https://vulners.com/cve/CVE-2021-4155>) \n** DESCRIPTION: **Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by data leak flaw in the way how XFS_IOC_ALLOCSP IOCTL in the XFS filesystem is allowed for size increase of files with unaligned size. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information on the XFS filesystem, and use this information to launch further attacks against the affected system. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/216919](<https://exchange.xforce.ibmcloud.com/vulnerabilities/216919>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2022-23181](<https://vulners.com/cve/CVE-2022-23181>) \n** DESCRIPTION: **Apache Tomcat could allow a local authenticated attacker to gain elevated privileges on the system, caused by a time of check, time of use flaw when configured to persist sessions using the FileStore. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to perform actions with the privileges of Tomcat process. \nCVSS Base score: 7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218221](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218221>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2016-6796](<https://vulners.com/cve/CVE-2016-6796>) \n** DESCRIPTION: **Apache Tomcat could allow a local attacker to bypass security restrictions. By modifying configuration parameters for the JSP Servlet, an attacker could exploit this vulnerability to bypass a configured SecurityManager. \nCVSS Base score: 4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/118404](<https://exchange.xforce.ibmcloud.com/vulnerabilities/118404>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2021-3573](<https://vulners.com/cve/CVE-2021-3573>) \n** DESCRIPTION: **Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw in the hci_sock_bound_ioctl function. By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause the kernel to crash. \nCVSS Base score: 6.2 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203249](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203249>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-22096](<https://vulners.com/cve/CVE-2021-22096>) \n** DESCRIPTION: **VMware Spring Framework could allow a remote attacker to bypass security restrictions. By sending a specially-crafted input, an attacker could exploit this vulnerability to cause the insertion of additional log entries. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/212430](<https://exchange.xforce.ibmcloud.com/vulnerabilities/212430>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2016-1000027](<https://vulners.com/cve/CVE-2016-1000027>) \n** DESCRIPTION: **Pivota Spring Framework could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a code injection vulnerability. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 6.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/174367](<https://exchange.xforce.ibmcloud.com/vulnerabilities/174367>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) \n \n** CVEID: **[CVE-2021-22118](<https://vulners.com/cve/CVE-2021-22118>) \n** DESCRIPTION: **VMware Tanzu Spring Framework could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the WebFlux application. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges to read or modify files in the WebFlux application, or overwrite arbitrary files with multipart request data. \nCVSS Base score: 7.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202705](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202705>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) \n \n** CVEID: **[CVE-2020-5421](<https://vulners.com/cve/CVE-2020-5421>) \n** DESCRIPTION: **VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a specially-crafted jsessionid path parameter, an attacker could exploit this vulnerability to bypass RFD Protection. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/188530](<https://exchange.xforce.ibmcloud.com/vulnerabilities/188530>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2018-10237](<https://vulners.com/cve/CVE-2018-10237>) \n** DESCRIPTION: **Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and CompoundOrdering class. By sending a specially-crafted data, a remote attacker could exploit this vulnerability to cause a denial of service condition. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/142508](<https://exchange.xforce.ibmcloud.com/vulnerabilities/142508>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2020-8908](<https://vulners.com/cve/CVE-2020-8908>) \n** DESCRIPTION: **Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp directory creation vulnerability in com.google.common.io.Files.createTempDir(). By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access restrictions. \nCVSS Base score: 5.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/192996](<https://exchange.xforce.ibmcloud.com/vulnerabilities/192996>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2021-36373](<https://vulners.com/cve/CVE-2021-36373>) \n** DESCRIPTION: **Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted TAR archive, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205311](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205311>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2012-2098](<https://vulners.com/cve/CVE-2012-2098>) \n** DESCRIPTION: **Apache Commons Compress and Apache Ant are vulnerable to a denial of service, caused by an error when using bzip2 compression to compress files. By passing specially-crafted input to the BZip2CompressorOutputStream class, a remote attacker could exploit this vulnerability to consume all available resources. \nCVSS Base score: 5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/75857](<https://exchange.xforce.ibmcloud.com/vulnerabilities/75857>) for the current score. \nCVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) \n \n** CVEID: **[CVE-2021-31811](<https://vulners.com/cve/CVE-2021-31811>) \n** DESCRIPTION: **Apache PDFBox is vulnerable to a denial of service, caused by an out-of-memory exception while loading a file. By persuading a victim to open a specially-crafted PDF file, a remote attacker could exploit this vulnerability to cause a denial of service. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203615](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203615>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-31812](<https://vulners.com/cve/CVE-2021-31812>) \n** DESCRIPTION: **Apache PDFBox is vulnerable to a denial of service, caused by an error while loading a file. By persuading a victim to open a specially-crafted PDF file, a remote attacker could exploit this vulnerability to cause the system to enter into an infinite loop. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/203587](<https://exchange.xforce.ibmcloud.com/vulnerabilities/203587>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-27906](<https://vulners.com/cve/CVE-2021-27906>) \n** DESCRIPTION: **Apache PDFBox is vulnerable to a denial of service, caused by an OutOfMemory-Exception flaw. By persuading a victim to open a specially-crafted .PDF file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198452](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198452>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-27807](<https://vulners.com/cve/CVE-2021-27807>) \n** DESCRIPTION: **Apache PDFBox is vulnerable to a denial of service, caused by an infinite loop flaw. By persuading a victim to open a specially-crafted .PDF file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198451](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198451>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2022-22950](<https://vulners.com/cve/CVE-2022-22950>) \n** DESCRIPTION: **VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service condition. \nCVSS Base score: 5.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/223096](<https://exchange.xforce.ibmcloud.com/vulnerabilities/223096>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) \n \n** CVEID: **[CVE-2019-12415](<https://vulners.com/cve/CVE-2019-12415>) \n** DESCRIPTION: **Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by tool XSSFExportToXml. By sending a specially-crafted document, a remote attacker could exploit this vulnerability to obtain sensitive information. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/170015](<https://exchange.xforce.ibmcloud.com/vulnerabilities/170015>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2018-14040](<https://vulners.com/cve/CVE-2018-14040>) \n** DESCRIPTION: **Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the collapse data-parent attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/146468](<https://exchange.xforce.ibmcloud.com/vulnerabilities/146468>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2016-10735](<https://vulners.com/cve/CVE-2016-10735>) \n** DESCRIPTION: **Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-target attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/155339](<https://exchange.xforce.ibmcloud.com/vulnerabilities/155339>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2019-8331](<https://vulners.com/cve/CVE-2019-8331>) \n** DESCRIPTION: **Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the tooltip or popover data-template. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/157409](<https://exchange.xforce.ibmcloud.com/vulnerabilities/157409>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2018-14042](<https://vulners.com/cve/CVE-2018-14042>) \n** DESCRIPTION: **Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-container property of tooltip. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/146466](<https://exchange.xforce.ibmcloud.com/vulnerabilities/146466>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2018-20676](<https://vulners.com/cve/CVE-2018-20676>) \n** DESCRIPTION: **Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/155338](<https://exchange.xforce.ibmcloud.com/vulnerabilities/155338>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2018-20677](<https://vulners.com/cve/CVE-2018-20677>) \n** DESCRIPTION: **Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the affix configuration target property. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/155337](<https://exchange.xforce.ibmcloud.com/vulnerabilities/155337>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** CVEID: **[CVE-2019-10202](<https://vulners.com/cve/CVE-2019-10202>) \n** DESCRIPTION: **Red Hat JBoss Enterprise Application Platform (EAP) could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization in Codehaus. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/168251](<https://exchange.xforce.ibmcloud.com/vulnerabilities/168251>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26217](<https://vulners.com/cve/CVE-2020-26217>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and SecurityVulnerabilityTest.java scripts. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/192210](<https://exchange.xforce.ibmcloud.com/vulnerabilities/192210>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-29505](<https://vulners.com/cve/CVE-2021-29505>) \n** DESCRIPTION: **XStream XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202795](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202795>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2020-26258](<https://vulners.com/cve/CVE-2020-26258>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when unmarshalling. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to obtain sensitive data. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193525](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193525>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26259](<https://vulners.com/cve/CVE-2020-26259>) \n** DESCRIPTION: **XStream could allow a remote attacker to delete arbitrary files from the system, caused by improper input sanitization. By manipulating the processed input, an attacker could exploit this vulnerability to delete arbitrary files from the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193524](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193524>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-43859](<https://vulners.com/cve/CVE-2021-43859>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker could exploit this vulnerability to allocate 100% CPU time on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/219177](<https://exchange.xforce.ibmcloud.com/vulnerabilities/219177>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2022-22965](<https://vulners.com/cve/CVE-2022-22965>) \n** DESCRIPTION: **Spring Framework could allow a remote attacker to execute arbitrary code on the system, caused by the improper handling of PropertyDescriptor objects used with data binding. By sending specially-crafted data to a Spring Java application, an attacker could exploit this vulnerability to execute arbitrary code on the system. Note: The exploit requires Spring Framework to be run on Tomcat as a WAR deployment with JDK 9 or higher using spring-webmvc or spring-webflux. Note: This vulnerability is also known as Spring4Shell or SpringShell. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/223103](<https://exchange.xforce.ibmcloud.com/vulnerabilities/223103>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-28657](<https://vulners.com/cve/CVE-2021-28657>) \n** DESCRIPTION: **Apache Tika is vulnerable to a denial of service, caused by an infinite loop flaw in the MP3 parser. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/199112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/199112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-37714](<https://vulners.com/cve/CVE-2021-37714>) \n** DESCRIPTION: **jsoup is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the HTML and XML parser to get stuck, timeout, or throw unchecked exceptions resulting in a denial of service condition. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/207858](<https://exchange.xforce.ibmcloud.com/vulnerabilities/207858>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2020-36322](<https://vulners.com/cve/CVE-2020-36322>) \n** DESCRIPTION: **Linux Kernel is vulnerable to a denial of service, caused by a flaw in the fuse_do_getattr function in the FUSE filesystem implementation in . By sending a specially-crafted request, a local attacker could exploit this vulnerability to cause the system to crash. \nCVSS Base score: 6.2 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/200230](<https://exchange.xforce.ibmcloud.com/vulnerabilities/200230>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2022-23437](<https://vulners.com/cve/CVE-2022-23437>) \n** DESCRIPTION: **Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading a victim to open a specially-crafted XML document payloads, a remote attacker could exploit this vulnerability to consume system resources for prolonged duration. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217982](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217982>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2019-10086](<https://vulners.com/cve/CVE-2019-10086>) \n** DESCRIPTION: **Apache Commons Beanutils could allow a remote attacker to gain unauthorized access to the system, caused by the failure to suppresses the class property in bean introspection by default. An attacker could exploit this vulnerability to gain unauthorized access to the classloader. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/166353](<https://exchange.xforce.ibmcloud.com/vulnerabilities/166353>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2014-0114](<https://vulners.com/cve/CVE-2014-0114>) \n** DESCRIPTION: **Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/92889](<https://exchange.xforce.ibmcloud.com/vulnerabilities/92889>) for the current score. \nCVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P) \n \n** CVEID: **[CVE-2022-27772](<https://vulners.com/cve/CVE-2022-27772>) \n** DESCRIPTION: **Spring Boot could allow a local authenticated attacker to gain elevated privileges on the system, caused by temporary directory hijacking in org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. By placing a specially-crafted file, an attacker could exploit this vulnerability to take over the application. \nCVSS Base score: 7.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/223090](<https://exchange.xforce.ibmcloud.com/vulnerabilities/223090>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-3752](<https://vulners.com/cve/CVE-2021-3752>) \n** DESCRIPTION: **Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw in the Bluetooth module. By sending a specially-crafted payload, a local attacker could exploit this vulnerability to cause a denial of service condition. \nCVSS Base score: 6.2 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209448](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209448>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2015-4852](<https://vulners.com/cve/CVE-2015-4852>) \n** DESCRIPTION: **The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-6420](<https://vulners.com/cve/CVE-2015-6420>) \n** DESCRIPTION: **Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2017-15708](<https://vulners.com/cve/CVE-2017-15708>) \n** DESCRIPTION: **Apache Synapse could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Apache Commons Collections. By injecting specially-crafted serialized objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/136262](<https://exchange.xforce.ibmcloud.com/vulnerabilities/136262>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-7501](<https://vulners.com/cve/CVE-2015-7501>) \n** DESCRIPTION: **Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2019-13116](<https://vulners.com/cve/CVE-2019-13116>) \n** DESCRIPTION: **MuleSoft Mule runtime could allow a remote attacker to execute arbitrary code on the system, caused by Java deserialization, related to Apache Commons Collections. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/169704](<https://exchange.xforce.ibmcloud.com/vulnerabilities/169704>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-3564](<https://vulners.com/cve/CVE-2021-3564>) \n** DESCRIPTION: **Linux Kernel is vulnerable to a denial of service, caused by a double free memory corruption flaw in the implementation of the BlueTooth subsystem. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause the system to crash. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202424](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202424>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2015-1796](<https://vulners.com/cve/CVE-2015-1796>) \n** DESCRIPTION: **Shibboleth Identity Provider could allow a remote attacker to bypass security restrictions, caused by an error in the PKIX trust component. An attacker could exploit this vulnerability using a certificate issued by the shibmd:KeyAuthority trust anchors to impersonate any eneity. \nCVSS Base score: 5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/105594](<https://exchange.xforce.ibmcloud.com/vulnerabilities/105594>) for the current score. \nCVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N) \n \n** CVEID: **[CVE-2020-15522](<https://vulners.com/cve/CVE-2020-15522>) \n** DESCRIPTION: **Bouncy Castle BC Java, BC C# .NET, BC-FJA, BC-FNA could allow a remote attacker to obtain sensitive information, caused by a timing issue within the EC math library. By utilize cryptographic attack techniques, an attacker could exploit this vulnerability to obtain the private key information, and use this information to launch further attacks against the affected system. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202188](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202188>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2020-26939](<https://vulners.com/cve/CVE-2020-26939>) \n** DESCRIPTION: **Legion of the Bouncy Castle BC and Legion of the Bouncy Castle BC-FJA could allow a remote attacker to obtain sensitive information, caused by observable differences in behavior to rrror inputs in org.bouncycastle.crypto.encodings.OAEPEncoding. By using the OAEP Decoder to send invalid ciphertext that decrypts to a short payload, a remote attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/191108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/191108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2019-17359](<https://vulners.com/cve/CVE-2019-17359>) \n** DESCRIPTION: **Bouncy Castle Crypto is vulnerable to a denial of service, caused by OutOfMemoryError error in ASN.1 parser. By sending specially crafted ASN.1 data, a local attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base score: 4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/168581](<https://exchange.xforce.ibmcloud.com/vulnerabilities/168581>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2021-22060](<https://vulners.com/cve/CVE-2021-22060>) \n** DESCRIPTION: **VMware Tanzu Spring Framework could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation. By sending a specially-crafted request, an attacker could exploit this vulnerability to insert additional log entries. \nCVSS Base score: 4.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217183](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217183>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2020-25704](<https://vulners.com/cve/CVE-2020-25704>) \n** DESCRIPTION: **Linux Kernel is vulnerable to a denial of service, caused by a memory leak in the perf_event_parse_addr_filter function. By executing a specially-crafted program, a local attacker could exploit this vulnerability to exhaust available memory on the system. \nCVSS Base score: 6.2 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/191348](<https://exchange.xforce.ibmcloud.com/vulnerabilities/191348>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2022-0330](<https://vulners.com/cve/CVE-2022-0330>) \n** DESCRIPTION: **Linux Kernel could allow a local attacker to obtain sensitive information, caused by a security sensitive bug in the i915 kernel driver. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause random memory corruption. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218086](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218086>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n** CVEID: **[CVE-2021-35515](<https://vulners.com/cve/CVE-2021-35515>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an infinite loop flaw in the construction of the list of codecs that decompress an entry. By persuading a victim to open a specially-crafted 7Z archive, a remote attacker could exploit this vulnerability to cause a denial of service condition against services that use Compress' sevenz package. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205304](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205304>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2019-12402](<https://vulners.com/cve/CVE-2019-12402>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an error in the internal file name encoding algorithm. By choosing the file names inside of a specially crafted archive, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/165956](<https://exchange.xforce.ibmcloud.com/vulnerabilities/165956>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2021-35517](<https://vulners.com/cve/CVE-2021-35517>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts of memory. By persuading a victim to open a specially-crafted TAR archive, a remote attacker could exploit this vulnerability to cause a denial of service condition against services that use Compress' tar package. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205307](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205307>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2018-1324](<https://vulners.com/cve/CVE-2018-1324>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an error in the extra field parser used by the ZipFile and ZipArchiveInputStream classes. By persuading a victim to open a specially crafted ZIP archive, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop. \nCVSS Base score: 4.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/140401](<https://exchange.xforce.ibmcloud.com/vulnerabilities/140401>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2021-36090](<https://vulners.com/cve/CVE-2021-36090>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By reading a specially-crafted ZIP archive, a remote attacker could exploit this vulnerability to cause a denial of service condition against services that use Compress' zip package. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205310](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205310>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2018-11771](<https://vulners.com/cve/CVE-2018-11771>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by the failure to return the correct EOF indication after the end of the stream has been reached by the ZipArchiveInputStream method. By reading a specially crafted ZIP archive, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop. \nCVSS Base score: 3.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/148429](<https://exchange.xforce.ibmcloud.com/vulnerabilities/148429>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2021-35516](<https://vulners.com/cve/CVE-2021-35516>) \n** DESCRIPTION: **Apache Commons Compress is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By reading a specially-crafted 7Z archive, a remote attacker could exploit this vulnerability to cause a denial of service condition against services that use Compress' sevenz package. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/205306](<https://exchange.xforce.ibmcloud.com/vulnerabilities/205306>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-23222](<https://vulners.com/cve/CVE-2021-23222>) \n** DESCRIPTION: **PostgreSQL is vulnerable to a man-in-the-middle attack, caused by improper validation of user-supplied input by libpq. A remote attacker could exploit this vulnerability to launch a man-in-the-middle attack to inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218383](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218383>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2020-9492](<https://vulners.com/cve/CVE-2020-9492>) \n** DESCRIPTION: **Apache Hadoop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of SPNEGO authorization header. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges to trigger services to send server credentials to a webhdfs path for capturing the service principal. \nCVSS Base score: 8.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/195656](<https://exchange.xforce.ibmcloud.com/vulnerabilities/195656>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2018-8009](<https://vulners.com/cve/CVE-2018-8009>) \n** DESCRIPTION: **Apache Hadoop could could allow a remote attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing \"dot dot slash\" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as \"Zip-Slip\" \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/150617](<https://exchange.xforce.ibmcloud.com/vulnerabilities/150617>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2020-13936](<https://vulners.com/cve/CVE-2020-13936>) \n** DESCRIPTION: **Apache Velocity could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox bypass flaw. By modifying the Velocity templates, an attacker could exploit this vulnerability to execute arbitrary code with the same privileges as the account running the Servlet container. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/197993](<https://exchange.xforce.ibmcloud.com/vulnerabilities/197993>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-10683](<https://vulners.com/cve/CVE-2020-10683>) \n** DESCRIPTION: **dom4j could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending specially crafted XML data, a remote attacker could exploit this vulnerability to obtain sensitive information. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/181356](<https://exchange.xforce.ibmcloud.com/vulnerabilities/181356>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2020-13956](<https://vulners.com/cve/CVE-2020-13956>) \n** DESCRIPTION: **Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by the improper handling of malformed authority component in request URIs. By passing request URIs to the library as java.net.URI object, an attacker could exploit this vulnerability to pick the wrong target host for request execution. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/189572](<https://exchange.xforce.ibmcloud.com/vulnerabilities/189572>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2021-40690](<https://vulners.com/cve/CVE-2021-40690>) \n** DESCRIPTION: **Apache Santuario XML Security for Java could allow a remote attacker to bypass security restrictions, caused by the improper passing of the \"secureValidation\" property when creating a KeyInfo from a KeyInfoReference element. An attacker could exploit this vulnerability to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2014-3604](<https://vulners.com/cve/CVE-2014-3604>) \n** DESCRIPTION: **Not-Yet-Commons-SSL could allow a remote attacker to bypass security restrictions, caused by the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the SSL certificates. By persuading a victim to visit a Web site containing a specially-crafted certificate, a remote attacker could exploit this vulnerability using man-in-the-middle techniques to cause the victim to impersonate trusted servers. \nCVSS Base score: 4.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/97659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/97659>) for the current score. \nCVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) \n \n** CVEID: **[CVE-2020-28052](<https://vulners.com/cve/CVE-2020-28052>) \n** DESCRIPTION: **Legion of the Bouncy Castle BC Java could allow a remote attacker to bypass security restrictions. The OpenBSDBCrypt.checkPassword utility method compares incorrect data when checking the password. By using brute force techniques, an attacker could exploit this vulnerability to allow incorrect passwords to indicate they were matching with previously hashed ones that were different. \nCVSS Base score: 9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193563](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193563>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2014-3643](<https://vulners.com/cve/CVE-2014-3643>) \n** DESCRIPTION: **Jersey could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by jersey SAX parser. By sending a specially-crafted XML data, a remote attacker could exploit this vulnerability to obtain sensitive information. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/174788](<https://exchange.xforce.ibmcloud.com/vulnerabilities/174788>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2012-5783](<https://vulners.com/cve/CVE-2012-5783>) \n** DESCRIPTION: **Apache Commons HttpClient, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. By persuading a victim to visit a Web site containing a specially-crafted certificate, an attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server. \nCVSS Base score: 4.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/79984](<https://exchange.xforce.ibmcloud.com/vulnerabilities/79984>) for the current score. \nCVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) \n \n** CVEID: **[CVE-2022-23596](<https://vulners.com/cve/CVE-2022-23596>) \n** DESCRIPTION: **Junrar is vulnerable to a denial of service, caused by an infinite loop when extracting RAR files. By persuading a victim to open a specially-crafted RAR file, a remote attacker could exploit this vulnerability to cause a denial of service. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218764](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218764>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-29425](<https://vulners.com/cve/CVE-2021-29425>) \n** DESCRIPTION: **Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/199852](<https://exchange.xforce.ibmcloud.com/vulnerabilities/199852>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2017-18640](<https://vulners.com/cve/CVE-2017-18640>) \n** DESCRIPTION: **SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature during a load operation. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/174331](<https://exchange.xforce.ibmcloud.com/vulnerabilities/174331>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2021-22569](<https://vulners.com/cve/CVE-2021-22569>) \n** DESCRIPTION: **Google Protocol Buffer (protobuf-java) is vulnerable to a denial of service, caused by an issue with allow interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open a specially-crafted content, a remote attacker could exploit this vulnerability to cause a timeout in ProtobufFuzzer function, and results in a denial of service condition. \nCVSS Base score: 3.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/216851](<https://exchange.xforce.ibmcloud.com/vulnerabilities/216851>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2020-7746](<https://vulners.com/cve/CVE-2020-7746>) \n** DESCRIPTION: **Node.js chart.js moudle is vulnerable to a denial of service, caused by a prototype pollution flaw when processing the options parameter. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/190880](<https://exchange.xforce.ibmcloud.com/vulnerabilities/190880>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-38153](<https://vulners.com/cve/CVE-2021-38153>) \n** DESCRIPTION: **Apache Kafka could allow a remote attacker to obtain sensitive information, caused by a timing attack flaw due to the use of \"Arrays.equals\" to validate a password or key. By utilizing brute-force attack techniques, an attacker could exploit this vulnerability to obtain credentials information, and use this information to launch further attacks against the affected system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/209762](<https://exchange.xforce.ibmcloud.com/vulnerabilities/209762>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2020-13954](<https://vulners.com/cve/CVE-2020-13954>) \n** DESCRIPTION: **Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using the styleSheetPath in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. \nCVSS Base score: 6.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/191650](<https://exchange.xforce.ibmcloud.com/vulnerabilities/191650>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) \n \n** IBM X-Force ID: **220313 \n** DESCRIPTION: **PostgreSQL JDBC Driver could allow a remote attacker to gain unauthorized access to the system, caused by the exposure of the connection properties for configuring a pgjdbc connection. By specifying arbitrary connection properties, a remote attacker could exploit this vulnerability to gain unauthorized access to the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [https://exchange.xforce.ibmcloud.com/vulnerabilities/220313 ](<https://exchange.xforce.ibmcloud.com/vulnerabilities/220313>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** IBM X-Force ID: **220912 \n** DESCRIPTION: **Apache HttpComponents Client could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests. An attacker could send a specially-crafted URL request containing \"dot dot\" sequences (/../) to view files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [https://exchange.xforce.ibmcloud.com/vulnerabilities/220912 ](<https://exchange.xforce.ibmcloud.com/vulnerabilities/220912>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM DRM| 2.0.6.12 \n \n\n\n## Remediation/Fixes\n\nTo obtain fixes for all reported issues, customers are advised first to upgrade to v2.0.6.12, and then apply the latest FixPack 2.0.6.13.\n\n_Product_| _VRMF_| _APAR \n_| _Remediation / First Fix_ \n---|---|---|--- \nIBM Data Risk Manager| 2.0.6.12| \n\n-\n\n| \n\n1) Apply [DRM_2.0.6.13_FixPack](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Data+Risk+Manager&release=2.0.6.12&platform=Linux&function=all>) \n \n---|---|---|--- \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "published": "2022-04-11T15:17:28", "modified": "2022-04-11T15:17:28", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "baseScore": 10.0}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 10.0, "acInsufInfo": true, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL"}, "exploitabilityScore": 3.1, "impactScore": 6.0}, "href": "https://www.ibm.com/support/pages/node/6570915", "reporter": "IBM", "references": [], "cvelist": ["CVE-2012-2098", "CVE-2012-5783", "CVE-2014-0114", "CVE-2014-3604", "CVE-2014-3643", "CVE-2015-1796", "CVE-2015-4852", "CVE-2015-6420", "CVE-2015-7501", "CVE-2016-1000027", "CVE-2016-10735", "CVE-2016-6796", "CVE-2017-15708", "CVE-2017-18640", "CVE-2018-10237", "CVE-2018-11771", "CVE-2018-1324", "CVE-2018-14040", "CVE-2018-14042", "CVE-2018-20676", "CVE-2018-20677", "CVE-2018-8009", "CVE-2019-10086", "CVE-2019-10202", "CVE-2019-12402", "CVE-2019-12415", "CVE-2019-13116", "CVE-2019-17359", "CVE-2019-8331", "CVE-2020-10683", "CVE-2020-13936", "CVE-2020-13954", "CVE-2020-13956", "CVE-2020-15522", "CVE-2020-25704", "CVE-2020-26217", "CVE-2020-26258", "CVE-2020-26259", "CVE-2020-26939", "CVE-2020-28052", "CVE-2020-36322", "CVE-2020-5421", "CVE-2020-7746", "CVE-2020-8908", "CVE-2020-9492", "CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351", "CVE-2021-22060", "CVE-2021-22096", "CVE-2021-22118", "CVE-2021-22569", "CVE-2021-23222", "CVE-2021-27807", "CVE-2021-27906", "CVE-2021-28657", "CVE-2021-29425", "CVE-2021-29505", "CVE-2021-31811", "CVE-2021-31812", "CVE-2021-35515", "CVE-2021-35516", "CVE-2021-35517", "CVE-2021-35550", "CVE-2021-35603", "CVE-2021-3564", "CVE-2021-3573", "CVE-2021-36090", "CVE-2021-36373", "CVE-2021-3752", "CVE-2021-37714", "CVE-2021-38153", "CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154", "CVE-2021-40690", "CVE-2021-4155", "CVE-2021-43859", "CVE-2022-0330", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365", "CVE-2022-22942", "CVE-2022-22950", "CVE-2022-22965", "CVE-2022-23181", "CVE-2022-23437", "CVE-2022-23596", "CVE-2022-27772"], "immutableFields": [], "lastseen": "2023-02-28T01:47:43", "viewCount": 21, "enchantments": {"score": {"value": 0.4, "vector": "NONE"}, "dependencies": {"references": [{"type": "aix", "idList": ["JAVA_JUN2022_ADVISORY.ASC"]}, {"type": "almalinux", "idList": ["ALSA-2020:4670", "ALSA-2020:4807", "ALSA-2020:4847", "ALSA-2021:1578", "ALSA-2021:3891", "ALSA-2021:3893", "ALSA-2021:4135", "ALSA-2021:4356", "ALSA-2022:0161", "ALSA-2022:0185", "ALSA-2022:0188", "ALSA-2022:0307", "ALSA-2022:0825", "ALSA-2022:1860", "ALSA-2022:1861", "ALSA-2022:1891", "ALSA-2022:1988"]}, {"type": "alpinelinux", "idList": ["ALPINE:CVE-2022-0538"]}, {"type": "altlinux", "idList": ["33B973C56C0030C9F4AF5300FE764B5D"]}, {"type": "amazon", "idList": ["ALAS-2013-169", "ALAS-2014-410", "ALAS-2015-618", "ALAS-2016-764", "ALAS-2020-1462", "ALAS-2021-1461", "ALAS-2022-1561", "ALAS-2022-1563", "ALAS-2022-1571", "ALAS-2022-1572", "ALAS-2022-1631", "ALAS-2022-1633", "ALAS-2023-1688", "ALAS2-2020-1395", "ALAS2-2020-1519", "ALAS2-2020-1566", "ALAS2-2021-1593", "ALAS2-2021-1645", "ALAS2-2021-1685", "ALAS2-2021-1690", "ALAS2-2021-1698", "ALAS2-2021-1718", "ALAS2-2021-1726", "ALAS2-2021-1729", "ALAS2-2022-1749", "ALAS2-2022-1752", "ALAS2-2022-1753", "ALAS2-2022-1761", "ALAS2-2022-1821", "ALAS2-2022-1835", "ALAS2-2023-1946"]}, {"type": "archlinux", "idList": ["ASA-202011-10", "ASA-202107-43"]}, {"type": "atlassian", "idList": ["ATLASSIAN:CONFSERVER-65577", "ATLASSIAN:CONFSERVER-69322", "ATLASSIAN:CWD-4355", "ATLASSIAN:FE-7344", "ATLASSIAN:FE-7345", "ATLASSIAN:JRASERVER-72669", "BAM-21603", "CONFSERVER-65577", "CONFSERVER-69322", "CWD-4355", "FE-7344", "FE-7345", "JRASERVER-70993", "JRASERVER-72669", "JRASERVER-73223", "JRASERVER-73580", "JRASERVER-73739", "JRASERVER-74420"]}, {"type": "attackerkb", "idList": ["AKB:38474044-13DA-4165-A8D4-86867CA68D83", "AKB:71A48C9F-C37B-4C1A-AD30-456EF1B66CF9", "AKB:F05BE8C2-C144-45BE-BF46-5867A2CAAF15", "AKB:F4BF02AE-B090-4307-89AA-47E57C92EC8F"]}, {"type": "avleonov", "idList": ["AVLEONOV:D75470B5417CEFEE479C9D8FAE754F1C"]}, {"type": "broadcom", "idList": ["BSA-2022-1727", "BSA-2022-1728", "BSA-2022-1729", "BSA-2022-1730", "BSA-2022-1731", "BSA-2022-1732", "BSA-2022-1733", "BSA-2022-1734", "BSA-2022-1736", "BSA-2022-1980"]}, {"type": "canvas", "idList": ["JBOSS6_JMXINVOKERSERVLET_DESERIALIZE", "WEBLOGIC_T3_DESERIALIZATION"]}, {"type": "centos", "idList": ["CESA-2013:0270", "CESA-2014:0474", "CESA-2015:2521", "CESA-2015:2522", "CESA-2015:2671", "CESA-2017:2247", "CESA-2020:0194", "CESA-2020:3936", "CESA-2021:0162", "CESA-2021:1354", "CESA-2021:2683", "CESA-2021:3889", "CESA-2021:3892", "CESA-2022:0063", "CESA-2022:0204", "CESA-2022:0306", "CESA-2022:0620"]}, {"type": "cert", "idList": ["VU:576313", "VU:581311", "VU:970766"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2014-1480", "CPAI-2014-1535", "CPAI-2015-1313", "CPAI-2015-1321", "CPAI-2017-1224", "CPAI-2018-0520", "CPAI-2020-1285", "CPAI-2020-3338", "CPAI-2021-1341", "CPAI-2022-0104"]}, {"type": "checkpoint_security", "idList": ["CPS:SK178605"]}, {"type": "cisa", "idList": ["CISA:6CCB59AFE6C3747D79017EDD3CC21673"]}, {"type": "cisa_kev", "idList": ["CISA-KEV-CVE-2015-4852", "CISA-KEV-CVE-2022-22965"]}, {"type": "cisco", "idList": ["CISCO-SA-20151209-JAVA-DESERIALIZATION", "CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:82DF14FC7487619119F0BE4E5983B231", "CFOUNDRY:873D4C50CDC37566272A2CA3925ADB7A", "CFOUNDRY:9170AF39C296B9726CD7B93B3A36EC22", "CFOUNDRY:BD43D191F1913B0416A737C28EAC643D", "CFOUNDRY:C1D2F4D8A3F0384C89F6C8D93A4DCF97", "CFOUNDRY:D24EF96EB1845EA8878001F85C1C2C75", "CFOUNDRY:DA24B69807C52E879C56B9ABE4845D93", "CFOUNDRY:DBB07350F947C0F70F7FE502A4A24A35", "CFOUNDRY:E504C95A1FDEC99C8FA5C726FB6DEA76"]}, {"type": "cloudlinux", "idList": ["CLSA-2021:1632262269", "CLSA-2021:1632262296", "CLSA-2022:1650986488", "CLSA-2022:1650986589", "CLSA-2022:1661176564"]}, {"type": "cnvd", "idList": ["CNVD-2021-67817", "CNVD-2021-67818", "CNVD-2021-67819", "CNVD-2021-67820", "CNVD-2021-67821", "CNVD-2021-67822", "CNVD-2021-67823", "CNVD-2021-67824", "CNVD-2021-67825", "CNVD-2021-67826", "CNVD-2021-67827", "CNVD-2021-67828", "CNVD-2021-67829", "CNVD-2021-67830", "CNVD-2021-81804", "CNVD-2021-81812", "CNVD-2022-08354", "CNVD-2022-09799", "CNVD-2022-14709", "CNVD-2022-14712", "CNVD-2022-15474", "CNVD-2022-15475", "CNVD-2022-15476", "CNVD-2022-15477", "CNVD-2022-15480", "CNVD-2022-15481", "CNVD-2022-15484", "CNVD-2022-15488", "CNVD-2022-15489", "CNVD-2022-62077", "CNVD-2022-68570"]}, {"type": "cve", "idList": ["CVE-2012-2098", "CVE-2012-5783", "CVE-2012-6153", "CVE-2014-0114", "CVE-2014-3540", "CVE-2014-3604", "CVE-2014-3643", "CVE-2014-3893", "CVE-2015-1796", "CVE-2015-4852", "CVE-2015-6420", "CVE-2015-7501", "CVE-2016-1000027", "CVE-2016-10735", "CVE-2016-6796", "CVE-2017-15708", "CVE-2017-18640", "CVE-2018-10237", "CVE-2018-11771", "CVE-2018-1324", "CVE-2018-14040", "CVE-2018-14042", "CVE-2018-20676", "CVE-2018-20677", "CVE-2018-8009", "CVE-2019-10086", "CVE-2019-10202", "CVE-2019-12402", "CVE-2019-12415", "CVE-2019-13116", "CVE-2019-17359", "CVE-2019-3834", "CVE-2019-8331", "CVE-2020-10683", "CVE-2020-13936", "CVE-2020-13954", "CVE-2020-13956", "CVE-2020-15522", "CVE-2020-25704", "CVE-2020-26217", "CVE-2020-26258", "CVE-2020-26259", "CVE-2020-26939", "CVE-2020-28052", "CVE-2020-36322", "CVE-2020-5421", "CVE-2020-7746", "CVE-2020-8908", "CVE-2020-9492", "CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351", "CVE-2021-22060", "CVE-2021-22096", "CVE-2021-22118", "CVE-2021-22569", "CVE-2021-23222", "CVE-2021-27807", "CVE-2021-27906", "CVE-2021-28657", "CVE-2021-29425", "CVE-2021-29505", "CVE-2021-31811", "CVE-2021-31812", "CVE-2021-35515", "CVE-2021-35516", "CVE-2021-35517", "CVE-2021-35550", "CVE-2021-35603", "CVE-2021-3564", "CVE-2021-3573", "CVE-2021-36090", "CVE-2021-36373", "CVE-2021-3752", "CVE-2021-37714", "CVE-2021-38153", "CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154", "CVE-2021-40690", "CVE-2021-4155", "CVE-2021-43767", "CVE-2021-43859", "CVE-2022-0330", "CVE-2022-0538", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365", "CVE-2022-22950", "CVE-2022-22965", "CVE-2022-23181", "CVE-2022-23437", "CVE-2022-23596", "CVE-2022-27772"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1479-1:ABA01", "DEBIAN:DLA-1896-1:572E2", "DEBIAN:DLA-1896-1:853E6", "DEBIAN:DLA-2191-1:6C344", "DEBIAN:DLA-2191-1:AF8DE", "DEBIAN:DLA-222-1:38FAF", "DEBIAN:DLA-2405-1:2470B", "DEBIAN:DLA-2405-1:33C7A", "DEBIAN:DLA-2433-1:2158F", "DEBIAN:DLA-2433-1:E3C3B", "DEBIAN:DLA-2471-1:AFC93", "DEBIAN:DLA-2483-1:37DA1", "DEBIAN:DLA-2494-1:12C95", "DEBIAN:DLA-2507-1:18489", "DEBIAN:DLA-2595-1:23005", "DEBIAN:DLA-2595-1:62C40", "DEBIAN:DLA-2616-1:FAA87", "DEBIAN:DLA-2689-1:31A23", "DEBIAN:DLA-2690-1:EA198", "DEBIAN:DLA-2704-1:90273", "DEBIAN:DLA-2741-1:6E441", "DEBIAN:DLA-2767-1:B89E0", "DEBIAN:DLA-2769-1:123CF", "DEBIAN:DLA-2814-1:11F88", "DEBIAN:DLA-2817-1:BB858", "DEBIAN:DLA-2817-1:D35F5", "DEBIAN:DLA-2917-1:2B0FE", "DEBIAN:DLA-2924-1:0A9D0", "DEBIAN:DLA-2940-1:FB71D", "DEBIAN:DLA-2941-1:96084", "DEBIAN:DLA-3160-1:77FDA", "DEBIAN:DLA-57-1:29ABF", "DEBIAN:DLA-57-1:6DE0E", "DEBIAN:DLA-728-1:A9D65", "DEBIAN:DLA-728-1:ECD0E", "DEBIAN:DLA-729-1:1B0B9", "DEBIAN:DLA-729-1:E931B", "DEBIAN:DSA-2940-1:494C4", "DEBIAN:DSA-3720-1:0F2C1", "DEBIAN:DSA-3720-1:B5B38", "DEBIAN:DSA-3721-1:2B54A", "DEBIAN:DSA-3721-1:8336F", "DEBIAN:DSA-4772-1:DCCA8", "DEBIAN:DSA-4811-1:BEA23", "DEBIAN:DSA-4828-1:46220", "DEBIAN:DSA-5000-1:6CB68", "DEBIAN:DSA-5000-2:08205", "DEBIAN:DSA-5004-1:7D2F1", "DEBIAN:DSA-5004-1:912EF", "DEBIAN:DSA-5004-1:999C3", "DEBIAN:DSA-5006-1:C171A", "DEBIAN:DSA-5007-1:CBB51", "DEBIAN:DSA-5010-1:C30C9", "DEBIAN:DSA-5012-1:24591", "DEBIAN:DSA-5050-1:FB23B", "DEBIAN:DSA-5057-1:C2B8F", "DEBIAN:DSA-5058-1:18194", "DEBIAN:DSA-5092-1:463D4", "DEBIAN:DSA-5096-1:B47F5", "DEBIAN:DSA-5265-1:55805"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2012-2098", "DEBIANCVE:CVE-2012-5783", "DEBIANCVE:CVE-2012-6153", "DEBIANCVE:CVE-2014-0114", "DEBIANCVE:CVE-2014-3604", "DEBIANCVE:CVE-2015-7501", "DEBIANCVE:CVE-2016-1000027", "DEBIANCVE:CVE-2016-10735", "DEBIANCVE:CVE-2016-6796", "DEBIANCVE:CVE-2017-18640", "DEBIANCVE:CVE-2018-11771", "DEBIANCVE:CVE-2018-1324", "DEBIANCVE:CVE-2018-14040", "DEBIANCVE:CVE-2018-14042", "DEBIANCVE:CVE-2018-20676", "DEBIANCVE:CVE-2018-20677", "DEBIANCVE:CVE-2019-10086", "DEBIANCVE:CVE-2019-12402", "DEBIANCVE:CVE-2019-12415", "DEBIANCVE:CVE-2019-17359", "DEBIANCVE:CVE-2019-8331", "DEBIANCVE:CVE-2020-10683", "DEBIANCVE:CVE-2020-13936", "DEBIANCVE:CVE-2020-13956", "DEBIANCVE:CVE-2020-15522", "DEBIANCVE:CVE-2020-25704", "DEBIANCVE:CVE-2020-26217", "DEBIANCVE:CVE-2020-26258", "DEBIANCVE:CVE-2020-26259", "DEBIANCVE:CVE-2020-26939", "DEBIANCVE:CVE-2020-28052", "DEBIANCVE:CVE-2020-36322", "DEBIANCVE:CVE-2020-5421", "DEBIANCVE:CVE-2020-7746", "DEBIANCVE:CVE-2021-21341", "DEBIANCVE:CVE-2021-21342", "DEBIANCVE:CVE-2021-21343", "DEBIANCVE:CVE-2021-21344", "DEBIANCVE:CVE-2021-21345", "DEBIANCVE:CVE-2021-21346", "DEBIANCVE:CVE-2021-21347", "DEBIANCVE:CVE-2021-21348", "DEBIANCVE:CVE-2021-21349", "DEBIANCVE:CVE-2021-21350", "DEBIANCVE:CVE-2021-21351", "DEBIANCVE:CVE-2021-22060", "DEBIANCVE:CVE-2021-22096", "DEBIANCVE:CVE-2021-22118", "DEBIANCVE:CVE-2021-22569", "DEBIANCVE:CVE-2021-23222", "DEBIANCVE:CVE-2021-27807", "DEBIANCVE:CVE-2021-27906", "DEBIANCVE:CVE-2021-28657", "DEBIANCVE:CVE-2021-29425", "DEBIANCVE:CVE-2021-29505", "DEBIANCVE:CVE-2021-31811", "DEBIANCVE:CVE-2021-31812", "DEBIANCVE:CVE-2021-35515", "DEBIANCVE:CVE-2021-35516", "DEBIANCVE:CVE-2021-35517", "DEBIANCVE:CVE-2021-35550", "DEBIANCVE:CVE-2021-35603", "DEBIANCVE:CVE-2021-3564", "DEBIANCVE:CVE-2021-3573", "DEBIANCVE:CVE-2021-36090", "DEBIANCVE:CVE-2021-36373", "DEBIANCVE:CVE-2021-3752", "DEBIANCVE:CVE-2021-37714", "DEBIANCVE:CVE-2021-39139", "DEBIANCVE:CVE-2021-39140", "DEBIANCVE:CVE-2021-39141", "DEBIANCVE:CVE-2021-39144", "DEBIANCVE:CVE-2021-39145", "DEBIANCVE:CVE-2021-39146", "DEBIANCVE:CVE-2021-39147", "DEBIANCVE:CVE-2021-39148", "DEBIANCVE:CVE-2021-39149", "DEBIANCVE:CVE-2021-39150", "DEBIANCVE:CVE-2021-39151", "DEBIANCVE:CVE-2021-39152", "DEBIANCVE:CVE-2021-39153", "DEBIANCVE:CVE-2021-39154", "DEBIANCVE:CVE-2021-40690", "DEBIANCVE:CVE-2021-4155", "DEBIANCVE:CVE-2021-43859", "DEBIANCVE:CVE-2022-0330", "DEBIANCVE:CVE-2022-21248", "DEBIANCVE:CVE-2022-21291", "DEBIANCVE:CVE-2022-21293", "DEBIANCVE:CVE-2022-21294", "DEBIANCVE:CVE-2022-21305", "DEBIANCVE:CVE-2022-21340", "DEBIANCVE:CVE-2022-21341", "DEBIANCVE:CVE-2022-21349", "DEBIANCVE:CVE-2022-21360", "DEBIANCVE:CVE-2022-21365", "DEBIANCVE:CVE-2022-22942", "DEBIANCVE:CVE-2022-22950", "DEBIANCVE:CVE-2022-22965", "DEBIANCVE:CVE-2022-23181", "DEBIANCVE:CVE-2022-23437"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:028DB84C4840B8D96405811A4FA47345"]}, {"type": "f5", "idList": ["F5:K01311152", "F5:K02349370", "F5:K03179547", "F5:K04734219", "F5:K11510688", "F5:K15364328", "F5:K19785240", "F5:K24383845", "F5:K25511825", "F5:K28409053", "F5:K30518307", "F5:K30914425", "F5:K31833420", "F5:K40293611", "F5:K44270253", "F5:K44994972", "F5:K48382137", "F5:K62701550", "F5:K65230547", "F5:K67352212", "F5:K71080411", "F5:K73464925", "SOL15282", "SOL15364328", "SOL15741", "SOL30518307", "SOL65230547"]}, {"type": "fedora", "idList": ["FEDORA:0319E6092537", "FEDORA:07F6A31C0D06", "FEDORA:1213A222EF", "FEDORA:13FF82114D", "FEDORA:1472760748FE", "FEDORA:14C4B661EB02", "FEDORA:1614F602E7DC", "FEDORA:16B2E6344278", "FEDORA:19D9D311A4B9", "FEDORA:1DAB930BB4CA", "FEDORA:1F72830714BC", "FEDORA:1FED93150D92", "FEDORA:228E1302B0CD", "FEDORA:25F4A2151F", "FEDORA:26A3B606353E", "FEDORA:2C5E66075D89", "FEDORA:2C8BA30B7889", "FEDORA:2D5B630B4535", "FEDORA:2DF6530C5C1E", "FEDORA:38DE2220D8", "FEDORA:3C09731DC971", "FEDORA:3C62F312AD5B", "FEDORA:3FE7F605DF5B", "FEDORA:3FEEF3092824", "FEDORA:433C2304C446", "FEDORA:455E83148598", "FEDORA:45E8A60321BE", "FEDORA:4928D30A037F", "FEDORA:4E643311A4B9", "FEDORA:5021030569C0", "FEDORA:50818233B7", "FEDORA:51EFD3146619", "FEDORA:548D030A7CB6", "FEDORA:5AE8830D7C86", "FEDORA:5B904214E6", "FEDORA:5C0F530584FA", "FEDORA:5D10B2170F", "FEDORA:5FA506092704", "FEDORA:667B43096C8B", "FEDORA:69B8A30B8B4D", "FEDORA:704B2609E891", "FEDORA:787E821133", "FEDORA:7CFF660874FE", "FEDORA:7D1C4311D3E1", "FEDORA:7D962606E7C6", "FEDORA:9013E20C03", "FEDORA:903B224F09", "FEDORA:938863096E48", "FEDORA:9B10D60BE203", "FEDORA:A0FA730BAE5F", "FEDORA:A10B66020CCA", "FEDORA:B0EA8303563F", "FEDORA:B7EBC30957D8", "FEDORA:C337330A46EA", "FEDORA:C6B3F60776BE", "FEDORA:C7E243096C83", "FEDORA:CF851309C00C", "FEDORA:D343F309D6A7", "FEDORA:D3F3421FC4", "FEDORA:D3F4E61F0A04", "FEDORA:D5702210FC", "FEDORA:E0A096048FD8", "FEDORA:E0DE5304C34D", "FEDORA:E9B33209C0", "FEDORA:EE17520E26", "FEDORA:EF5B36120D8F", "FEDORA:F015D61278C8", "FEDORA:F270E3098BB4"]}, {"type": "fortinet", "idList": ["FG-IR-22-072"]}, {"type": "freebsd", "idList": ["0B0AD196-1EE8-4A98-89B1-4D5D82AF49A9", "20006B5F-A0BC-11EB-8AE6-FC4DD43E2B6A", "2CCD71BD-426B-11EC-87DB-6CC21735F730", "3AE106E2-D521-11E6-AE1B-002590263BF5", "70E71A24-0151-11EC-BF0C-080027EEDC6A", "81FCC2F9-E15A-11E9-ABBF-800DD28B22BD", "89D5BCA6-0150-11EC-BF0C-080027EEDC6A"]}, {"type": "gentoo", "idList": ["GLSA-201607-09", "GLSA-202107-37", "GLSA-202107-52", "GLSA-202209-05", "GLSA-202211-04"]}, {"type": "github", "idList": ["GHSA-2H3J-M7GR-25XJ", "GHSA-2MH8-GX2M-MR75", "GHSA-2P3X-QW9C-25HH", "GHSA-2Q8X-2P7F-574V", "GHSA-2X83-R56G-CV47", "GHSA-34WX-X2W9-VQM3", "GHSA-36P3-WJMG-H94X", "GHSA-3832-9276-X7GF", "GHSA-3CCQ-5VW3-2P6X", "GHSA-3J6G-HXX5-3Q26", "GHSA-3MGP-FX93-9XV5", "GHSA-3WQF-4X89-9G79", "GHSA-43GC-MJXG-GVRQ", "GHSA-4CCH-WXPW-8P28", "GHSA-4HRM-M67V-5CXR", "GHSA-4P24-VMCR-4GQJ", "GHSA-4WRC-F8PQ-FPQP", "GHSA-53X6-4X5P-RRVV", "GHSA-558X-2XJG-6232", "GHSA-567X-M4WM-87V8", "GHSA-56P8-3FH9-4CVQ", "GHSA-59J4-WJWP-MW9M", "GHSA-59JW-JQF4-3WQ3", "GHSA-5MG8-W23W-74H3", "GHSA-64X2-GQ24-75PV", "GHSA-64XX-CQ4Q-MF44", "GHSA-6FXM-66HQ-FC96", "GHSA-6GF2-PVQW-37PH", "GHSA-6HGM-866R-3CJV", "GHSA-6PHF-73Q6-GH87", "GHSA-6VQP-H455-42MR", "GHSA-6W62-HX7R-MW68", "GHSA-6WF9-JMG9-VXCC", "GHSA-6X48-J4X4-CQW3", "GHSA-6XX3-RG99-GC3P", "GHSA-72M5-FVVV-55M6", "GHSA-73XV-W5GP-FRXH", "GHSA-74CV-F58X-F9WF", "GHSA-78FQ-W796-Q537", "GHSA-7CHV-RRW6-W6FC", "GHSA-7GRW-6PJH-JPC9", "GHSA-7HFM-57QF-J43Q", "GHSA-7MVR-5X2G-WFC8", "GHSA-7R82-7XV7-XCPJ", "GHSA-8JRJ-525P-826V", "GHSA-9F3J-PM6F-9FM5", "GHSA-9JWC-Q6J3-8G9G", "GHSA-9V3M-8FP8-MJ99", "GHSA-C27H-MCMW-48HV", "GHSA-CM59-PR5Q-CW85", "GHSA-CMXJ-WX9V-52QR", "GHSA-CRV7-7245-F45F", "GHSA-CXFM-5M4G-X7XP", "GHSA-F6HM-88X3-MFJV", "GHSA-F8VC-WFC8-HXQH", "GHSA-FG3J-Q579-V8X4", "GHSA-FJH6-P566-WR6Q", "GHSA-FJQ5-5J5F-MVXH", "GHSA-FXWM-579Q-49QQ", "GHSA-G5W6-MRJ7-75H2", "GHSA-GFWJ-FWQJ-FP3V", "GHSA-GWRP-PVRQ-JMWV", "GHSA-H436-432X-8FVX", "GHSA-H65F-JVQW-M9FJ", "GHSA-H68Q-55JF-X68W", "GHSA-H7V4-7XG3-HXCC", "GHSA-HPH2-M3G5-XXV4", "GHSA-HRCP-8F3Q-4W2C", "GHSA-HRMR-F5M6-M9PQ", "GHSA-HVV8-336G-RX3M", "GHSA-HWJ3-M3P6-HJ38", "GHSA-HWPC-8XQV-JVJ4", "GHSA-HWVM-VFW8-93MW", "GHSA-J8WC-GXX9-82HX", "GHSA-J9H8-PHRW-H4FH", "GHSA-JFVX-7WRX-43FH", "GHSA-M6CJ-93V6-CVR5", "GHSA-M72M-MHQ2-9P6C", "GHSA-MC84-PJ99-Q6HH", "GHSA-MVR2-9PJ6-7W5J", "GHSA-MW36-7C6C-Q4Q2", "GHSA-P66X-2CV9-QQ3V", "GHSA-P694-23Q3-RVRC", "GHSA-P8PQ-R894-FM8F", "GHSA-PH58-4VRJ-W6HR", "GHSA-PJ7M-G53M-7638", "GHSA-Q5R4-CFPX-H6FH", "GHSA-QPFQ-PH7R-QV6F", "GHSA-QRX8-8545-4WG2", "GHSA-RFMP-97JJ-H8M6", "GHSA-RMR5-CPV2-VGJF", "GHSA-RV39-3QH7-9V7W", "GHSA-RVWF-54QP-4R6V", "GHSA-WH77-3X4M-4Q9G", "GHSA-WRVW-HG22-4M67", "GHSA-XQFJ-VM6H-2X34", "GHSA-XW4P-CRPJ-VJX2", "GHSA-XXX9-3XCR-GJJ3"]}, {"type": "githubexploit", "idList": ["0018F9FA-176E-52D1-B790-5C67C302BC74", "0126EBDA-4ED9-50FA-BDE5-873011FCD9B6", "0273F07C-E2F1-5454-85F6-6B58CCA854A3", "0DAD2A7F-FA26-53F7-AB9D-7850BD9C666E", "0E679B3E-C2C3-5C8B-94E1-FC6EDCBB08F0", "16067E19-368D-5FF5-895D-9BA9E14921CE", "17C63238-7AC4-5195-8FAC-88F0AB4E8F77", "18E406F3-7737-558F-9993-BD12421447B4", "1BB45592-4635-524E-8858-560611C42BC7", "1F4670D2-70D1-5F68-B5BB-2674FB754D26", "21FA1164-A4AD-57B4-8CFE-6B9B5EE9D199", "2A4F88C2-35A7-5185-ABC0-90D0A5396D8F", "328E8BFC-210D-5993-885E-7710FEE734CC", "36B8C1D8-41AC-5238-B870-2254AE996A4C", "38D4A58E-3B24-5D5E-AE07-5568C6A571C4", "397046C4-338E-5CCC-AD0A-687CA3551B7C", "3B4FEC21-04C2-5299-BFD8-3F9AA518E694", "3DB87825-2C58-5ABC-8BA3-E1CB80AFB11E", "402AA694-D65B-59F0-9CAC-8D4AA40893B4", "40B1BD3D-722E-5B72-A0D3-98A5729214D3", "4B89135F-AE08-56DB-B13E-DD5AF268E021", "52AD8D8E-65ED-5B49-A85D-202C43107E6B", "552E4AC2-693D-5E49-B56E-E5473F4241E9", "58CD2EEE-5826-5136-84D4-BCAC28741415", "5D705C67-17AA-5E5C-A72D-A1ED6F4DEDA7", "608612F7-69E9-5491-B453-5DE098B798CA", "60AF7761-B3AA-5F66-9E2C-B8FA2FDC58F6", "661FCFFE-E5C3-5CF9-9CD5-68869CEDED1E", "679F3E9E-1555-5391-86FF-CD3D67D80BDD", "69C8078C-1B8D-5B51-8951-4342A675A93D", "6A9484BA-BE10-5232-91F4-678892E7E6DD", "6E5C078B-B2FA-520B-964A-D7055FD4EB0A", "701F758F-BBA0-582C-AE23-AA3C515F6A9F", "72ACBBC1-E9FB-5A12-8614-06BEF5F96394", "75235F83-D7F4-570F-B966-72159CCBA5CB", "7883CC8E-9B35-5C0F-AE2E-271FAC17648B", "79D5BEFA-C5B9-56B6-B78E-4C663DB2A6C9", "79FADEDE-9F29-583A-908E-676A91E2F562", "81DFF6A6-4518-543A-B06C-E7A6466ACB88", "85BCA050-E6D6-55FF-A843-F49E52F30346", "866A8BD8-7D36-53DA-AA66-A0064438E2A5", "88781F74-2AD2-5F17-870A-6CB932998CA9", "89B78640-ACE2-5A00-845E-1CEFFFDD4A2E", "8AE63777-720A-5FEB-9A8B-B7A6577008DA", "915DAB75-3A6F-57CC-824E-106D6ACD652D", "91C0D03D-8468-59A7-B3B7-F6B118A62FFB", "9538B7BA-979F-523C-9913-4FE62CF77C5C", "968DBE0A-CC05-5F47-B348-E8E33AA33F6C", "9762BA59-813F-50C2-94CB-842DFAE750D5", "9D092BED-AC51-5759-B59E-E74D989AD5E5", "A0648F78-7165-5CA8-82DC-B34350E2DDC6", "A6262D7C-E486-57FA-BFE3-D7774CB085C9", "A8866ED4-A944-571F-8135-6138A2E9B568", "AE9F0F3B-00DE-5B73-87A1-BA592FA6E616", "AF11EF27-730D-5BA1-8B1D-7676A6FFCEAF", "B0E0C8DF-3D79-58BC-881A-52FFBFBDE3F8", "B0EA173F-FDE3-5401-BE03-BEF429622CF2", "B158F1AE-13DF-5F49-88D5-73B5B6183926", "B71645C4-F039-552B-A3E1-C7376EB2DF53", "BA9D322B-4694-5B07-BD2F-83E700A62DE8", "C4EB8052-6E91-5327-87BE-51E8490B0A4E", "C6653FFB-B7A6-54D8-83C9-300A13AC41F4", "CAD3F237-9F09-5818-ADE3-DF36E8350D41", "CB56CEFA-343E-5B20-9D5B-C076205FBF6F", "CD4FD272-6D04-59AF-9539-2E222F04BD16", "CFF7A226-3523-52E0-8A6C-0D0E6A7BEBD6", "D088978F-AFD3-56B5-A461-39DCB022A11E", "D09EAEC3-7B66-5E76-BF91-64C048C7D58D", "D30073F4-9BB7-54D9-A5F6-DCCA5A005D4D", "DECA1032-7ECB-50DB-AD42-D1080F9E6C79", "DF61600D-38EB-5DD1-862B-290A1B4D1019", "EA9501F7-CC4E-5C60-ACF3-F636E7F54C6F", "EAE84183-EEEC-5C93-AB4F-725AD31987F9", "EBD1ED76-3887-570C-86DD-EC9C7ADB1880", "EE4B4CDB-5690-556D-9581-E198CF03A9BE", "EF55EC2D-994E-5971-8941-B595536F5992", "F09161EA-B10D-5DBF-B548-6F9BE7EE20B2", "F0ED6FE9-BC03-5953-BF24-995A28292C17", "F9061858-90CD-55ED-9193-068E2E50FF77", "FF4B608A-EAF3-5EFC-921B-248F48F14720"]}, {"type": "gitlab", "idList": ["GITLAB-3E8801268238D4C87FC403133451AF66", "GITLAB-492C8DB93D8864DCE8E632C5786BA8CF", "GITLAB-71AA713AC610A231826D87082540BDBC", "GITLAB-9FA54FEA1F8F04808234808F9BD0065B", "GITLAB-BC05E1FE8806F74AAAA8D9C45FC1170F", "GITLAB-BDDC02CF1F134A78C5E70B135CEA58D1", "GITLAB-D03178D3A0CBB9D554B02F99A6139A65"]}, {"type": "hackerone", "idList": ["H1:1188643", "H1:1218173"]}, {"type": "hivepro", "idList": ["HIVEPRO:21EBEC4DE35422B57481E3DF94E6EA07", "HIVEPRO:41D5BC8D50B4CA10D9CCDA18E6528C27", "HIVEPRO:8D1D94F11C7163E6C0DF10B434A7BBDD", "HIVEPRO:C037186E3B2166871D34825A7A6719EE"]}, {"type": "hp", "idList": ["HPSBPI03824"]}, {"type": "ibm", "idList": ["003E808C317FB1CEF04F5EDBEB16A13E730C2707CF8E2423D4945D325E93E40E", "0066C9EC375123E63AE360D74EC62586671E78442045839C341498FBEEC24A1E", "006B840BADC68F9143BFB9DEB8F134915B185FD525BA7DAEF54E58E6E5CE5325", "0071D7109D190F08AF61415C42966955F5A2F20ACA252B48C89119BEDBFE4DE2", "007E1AC1E4228B8135E45C63FCEF82799BD02C157157F082CD8D3E0F0D61C361", "010FB61FF81B92C1441FA274C58C5C69C1D9195BD25294321424DF5ECDA64546", "017704F263DE498C81E38DCD35C1B649CAC8F2B6DA67887C1DC1F132F6BB1B85", "01CFF49A8E945385D7DAF195723AF2400A442375CCE77F93B4CF72774A757E1D", "02009B023F9C6B85EBD0182086808630DC2E18A3A4650077B888FB73C6C24F63", "021D73BA7F81AE9ECA981B8E5BCD2B83F967D63970C29E0AD98D46119BE5A6A3", "0241AD14444530836D909285432DE0EF409B9993A9D61A28514B61A052400B84", "026861C8F37CB442AEB06F08CB67784AB6226E1C2C5830E2D4227D71E9453C5B", "02AC3D75FB5E9A395164B03D2835B59279C245C81FF95300ED74B35ADE723D5F", "02B45A4F0737B5EA27ABCC5E6A85126998115FD2F957E97BE285E1497BC95E60", "0309A53D35EF827194465C9C10BC98B7D4795038C7221686EE2E7A4669562BD7", "031AB80137983FA206B8FD452A65FA0ADD155D250DA679ADC4DC628C2E106C7E", "037DC92C3964B9BE83FE00549FB0CE6C44ACB2D76406400ED57CA4D310EF3538", "03ABF1F2B2FD0953F8EB3B027A7B4518DE0EE743E4F242C3FB5BEC357F568F89", "03BBDC7050471C64169EF3EC23FC2B3C55CC822FFA0D98F53466C52354E175A2", "03BD9C6A634D56977256D0EB02550574DC21A677D8E08EEB57FD8C5F206D469F", "044101C95B0C48E3BC19043727BFD1A374DB61CF02776ABDBE38DDA287A46248", "0465751AC2B09E6749CD032D525B17660008B7BDE693E1A430E27B2E32A33438", "04BE26A411CCE1F3F556DF414F7D2C8874614E05244C216ACE61F06BEB339ACB", "0583650A9FFE2FCDB0F96965BF9EB71CA311C6F3BED486BAB7842BA8A7287306", "05B0D73EFF1926611B9AC08DAC2A173A6A2D7E47E96A50C08B5EF48B15FD7204", "05C269FD75BC7C24A326E5E6DE43E840168855B7B7039658D182C375AA61EAF0", "05EBC3EA4B66B19728BB66D5DC71F429C8B7233EC5AC3CB0DA401B57D74514F3", "06382F7117C919BEE538CB27C5808AB3EF587DB3B3EACA4D316E62D731F4DDC3", "0665925DF5F067ECF5E297BA3C90127DB89591002C77E6A2724DF5A757C0156C", "06FAEFED6C300CC60009B72B8EFCCE9D36AED7D4DA79CBFF20C5F460AC8FB0C1", "07988475CE9095B9471700FFB4FFB199A58AB32837E3178BE094D53E97B8461A", "07D3AB62DFA72D2D71CAA0C7C12F57DDFFDD03F36F449256AA46D57B94E6850C", "07E3016910D83A0C6D3B7A1BCB493BE57ED7751BDD0BA5282306A20694DFB939", "07FEC8A129A779FAB145D3092FB4D733884D03DF23AA13470BF539F0AAE36C84", "0805E7A2C6036D7FEBAF075EE767AB91B73C933992CD43256425DCE028EA66B7", "0873F460B0C56BEFFB7C20248A3B9104F79891FA48CE8B004739684341A51D1D", "08CA215DA4723C38799F9660F7D75091345A288B82A51DC0E9E4FD79547268EC", "08ECBCA670F0B3F435801B7A34A3A7C7EF6315794FDF864F61E57E02C2E3EFDD", "09286360A7690174E4DFEFC09F545266004EED4C6B44A59029FD7D8E3DA25CF0", "0976C176E97A39F9A89AE40E674AFB87A89A5DB439E2A1C90351D75E792A52BF", "09859535BBD73886942005381F7140B37F4079C86A8279AC944AB83F5FC012DB", "098A0B0BBDA18721083717F103FE7FB2B2BBE2394E33149D968FE7B59A7B2AD4", "0A2242182FF9C6E616AD12CDAF12C0AD6141133E4FF262F6CC0FA251C0F7DD9F", "0A9862E55A4980986351DCE6D6B2CA63C5BCEBD8E02D721B7488EA0A2BF2FCFB", "0AFBC1D7F97C5C9E0F0CC49EE02F2CC41F95432701D1E857EC1AF635A6E339A4", "0BC76EEB65523D395F4DA742FB52689780638A43870F5C4EC44A6261A2CCA67B", "0C4F91C9AA7E146EDA1AA877B92C4C590E445AC7D2AC0E60ECCE4BA77A47F0EB", "0CF13F8FB4FD77C6593C265FA8F397D0C4324FC1F07F86C436B4937E98B25DBF", "0D4B20C744466115DE835E52E37DD4A530EABD3932B1BB246AFC9B474D4C777D", "0D5D9C62E3772E12A0A361D23CC8D2FE21F9AD572A09912E906D408ED2270FAA", "0DAC789462728BA88DB7A7A1DDDC55DCFEC83DF5649BBA368BED3D75977B2DAE", "0E0E7B18D99C2EC8E29EE4877EE2BCDB492FE609EBADF3B5D9C1C38BABE89E03", "0E139C6B78E05C5FB31297130E7D8182F37C6EEE164FAB0E33CFAB3DCEE481D0", "0E436ABCB1C741BF7139A69EC882BC3B9CA8C0C827B7CDBB16713B784DEF116A", "0E9DE26424CAC2C8B7110B4332C230928EE7C869EABA707356CA55283B450653", "0EEEF8DEA83112CA8F05980CF97966A805C275EB2074F4D594FEC682F79F9571", "0F0ADA7F909621DD061EE2BACB396F33A92139A964193729FFFD9F1D601B17AD", "0F254BE920E96D803CA1A391E1B8A3B0C658E51C8C31B0AC0F95FEDD45279D52", "0F8C9B43069C04EF8D42F75FA8D42A5837D2A01F1B45F132DD6CE116C7562B83", "103EA163CE6BA94C3571086A36BDAD92915A4BF88B6551DD1CF420092CAEB0CD", "10FBEBB14A30BC73B75E0DF3E1AC14E07BC218A2AAE122217F23444AA2EEB55D", "116303B95D4B05625352F4B4983E591A174E56CE825865FBC6C2E50F189B1946", "11658B82943F87BF46821D82FF049F1A7AA8F106F757C115DA5FFA81528F34B4", "11DEF8012E28C5EDA3144B78EC3E85C89DD7ECD6EA08B7B7DBCE879455FB0241", "1216BEFCC877765223CE187EEB457AD44E77DE77B9A00DFE2C29DBD67EE87D6C", "126E1024546918D07264839DD88F2FF75D58789A0F611D0689966886112B533B", "131368AC1B19DD28F80DB3DD0117F4D8165D9BF517E635A924EE6AC38B4992C2", "133379EBF1506E0E356F58A2F882A938C12C601959C068582635E9DC9E997C82", "140E90DD98ED4CC1A8C413867579B2EF4F8885020D8C9B221D7DC0EFA3D20518", "14108283F9157C4F2A38313CFBD3F47CFDC207CBE84809E04B7E197DA546B8D3", "144E2FDA5818BEDF6E97DA8F56942108258B6778FA9472BE0FB6E286C871A08B", "14849B70FB8D1FD1B1485C3A35CC1AC4707F86D18C75B440EBA32375A28C39FA", "149236693C3EFB0834C33EFC100BF77DF7747461162DFC42AFAEDC312B6B7A36", "150C26A4B23CEB9D10D6B5FB3E82060606745E070EDD31CF3D53C5969B98B0BF", "152DBBBD89777F049F222CCBB92B4558AF83750C87593C90CA6D85B18A25D750", "161781947F78DC6E1DB98B69A6C967583378BE1CE149288586DE90571B7A6567", "16736BDC76D22C21547E48EFB8CDDC62FDD5AB41955327A05DD047CB18A3DEDC", "16BD53FF8D4AF4008A6B9480C8D62C5AECEF46E4F486EC150D2D9BBC2C7349FC", "17179127276D2C8BCC739D66B23A070D5DCF232A120A9E4EF31DA0C49E8077B9", "1722763F9494E5ABFD7D8A4F8AD4D4223CF2CA83C71F6F1FF12BBDCD66A6A4E1", "17BDF511CE76D216C5C50BFCBE5312ED54FC6F29640FF47112BEFE568B44B3A5", "18114071C39219F80111C17DB1672BE5A7A36C17C47E86ED7161AB53EE3A2916", "1841E92577ACD6AADDBB49C1995A398D151CBC9679F1BA2B9C77425F2E40A55C", "186B70A46AA8E0019EA1FA3AD7C84BE2123190D3E9ECBD8080B8E32748EE5D8E", "1884864549E9954D0DBBE2AC224F348D2E593A0CB7BB89635A0316AA5AAFB22E", "189C4B0F081DBEFAC83A3E27A6773F71FB385AE898B4395E96BB8F0C54035413", "19169A374C92B43619C97D7BD0A9ABAB34F53ADCC3126A79F38BBDB60D208414", "19663A6693672015D5E48ABEE9A76AB50A1C71EE9CF0548228C739933A353C88", "1A977E1D46AE4CB4B7068DB341125931FAD75C28D6703503973FFF9BE917887F", "1B99BE15EF0865EC7D6CAAD98E1510DF110D3FC32411F14658640A57804FCBB5", "1BD7E18706AF93ABDBD41BE83ECC89772037ADB25E520B27E955C6E42B0A6A6E", "1C1678518312F18585D48228E2C4D89CBF458CAF1277708839EA38E32D0F11E3", "1C64C60FF7E1CBFCD884E71E282165D5AEB9D101B67656191098837D1F4D170F", "1CAFF665F90440069C40AC6A9EBBDA118B3BD6E4405F1E5FE44083D74C290229", "1CBB3850C5774C7EF01617A98C0603053597EB9E84A0DF64C201094FAB392754", "1CBC70DD300A56840ED820E6947D8E18EA09656C3B5A10E23D070B9E10EC31BF", "1CC43C4A66365486759EFB8BF9ACE86934571B8459B6E66D63A5190659B18DB4", "1D1503F24E44E92641F6FD7110D0B238DC3DBD9F3785FDE9E47FC7D6409424D4", "1D427D778EBF5917AD345F691BBD1F4E1773EBB12E24157C63E59A2A70A0FDE4", "1D9D25BBD8211085F3D599904CE3F9FC7D97724E532B874F474D96EB34B802D8", "1DA3D6D706ECAAEAD6DA37D47F841CF74690B2BC39CF2D0F990E5E369E062074", "1E014E7185ECE2676B9171118053A4D1DDB9F759CD3863CCB79D1B3DBD175B95", "1E1D5459FA30D3861530E28D1E1AC437754A27CFED729D3827A64AC283710736", "1E8EB664DDC627C3309FB200921E9D61D835AF04A5F675805F93C64918337FD4", "1E8EBA51B59776E6F79AD15FD0FA09721A6208325346F0D816EDDE80DE225FB7", "1EA754AFF092ED1712E3DBFA763C4962C7EF40031818AB374A5E52A9E9586AAD", "1EB9F8573A9E928E14652E6C4EA6633663E35B33C744263304C0A5C14EC87569", "1EC9D814A44355A00FF42F8C8587C9E7C452415354E28A889935185CB4613BD7", "1F7A45CD4D73686FA6C9591207830D1B405EB9704E1C5F2BE5F439A0FE018D74", "1F85EE45F0658B3AD663A99445A58AEA14BB195722BCAA3E5A986FD171B8BAC7", "1FBFB483D7D03AB53D033CDE427171757B26454F31C7760688B7DA728CCA11BA", "2043A5155256050F160330C3A6F88A4EF47A0C2DE48EA69299E3599EEF5985A0", "204ADCCC258487D6D5F8C848C95DAB38413055F4AFD05DFCF56FD7435CBF7C69", "205D8E291F00D69928AE2777BC3A52CC5094D59B30AB5BF479F77703C17C0EBE", "20763F2B27C66C722124CBB23FF4ECBE76431735E0AC6E1F94E8999CB3A2CB25", "20CF2AD2EFF7DE6AD8F93586D48E59262F447700FFF48E5E610099B41CEE05B7", "21142DF71EAD09193DDED15561CD1A43227AFDD0E8979F78556DC466663B350D", "217BB6C17A6FD504F278CE0259F71540873D9ACBEC02EC2F580CED3F0A79FB4A", "226FFFCDF94FA8471AA279C7EA3B887FAA510E3463B5ABDBC303B7D6583EE6BE", "229A4B43FE77515F8665EB39BE40365AEA78A7E6905A77143AA0029AE91AE79C", "22A3084E2002F23895BAE53AE66469749F21716FF3B8CF15A58E6BBC0C953322", "22F3632F9800C8C7D12EDA0C85AC627F2AABCAA068D310065EEF12F9F4A345C4", "23258712AF0C6FF3D199FB0C84691351D550E3A4E86DEF3F1A107BF53AC16647", "2494FA18EBA69E49E0C9B21340A86FBCE7BF93F9CB851C89E87B389A942B8EB4", "251C423177798D75830F3F5802954088E3387B66B51C34FCEA1E4482B6FF4B3F", "254982B133AF87964C8EDFD23D188B5AC76FD0D3823194E367660BA1FDE55EFC", "257282661EC40294AA6CD7D16D142C7D834B7703E989C3E4C143A5B9AF27C918", "2577C6B2C3CA14375F88C090A6131204B50E6A837557E782C8F0899ADE13E13E", "25ACBC37BF847C07DB268F19D48DBF40D18FA806E20FFFCA0C1E2BFEA5CC5FA1", "2641B803CC5B6F698F27A4349942ABEEE0A931F1864DAEF1CB72FDFD279085E2", "269ED09DF8DEC59D6D5C76BBBEC1A3E9EB81FC2A6B977AF71E1341BCCE84CE32", "26EF104246EE173B8FE798F20C9B0F499B3C95857BDCBB8E535C30A87C5C61AB", "277AB899B314D74186E754815AF566FB51BD4C4F002CE06840E502A7867F360E", "288125FC88A56322D496898A42C13BEEFC69F7F08CFFB4141EE1D587C7FF4F0C", "2982812924383536764B05E9EE51D50713C760EEBC623C7B5C75FC9B18B6A0F7", "2A4176A3B28EE9EC15A83AB834DAEC50E7A8B3B5944AAC2F8D7F1992405CEBBD", "2ACC013E18B0D1D11CF82AC295C86814FE29F87FF231D4B91235A1A55453C76A", "2AFC5A8E16BC71AFE3703E0DDD6A01C2DEC758FA5CF41D9AFF831AA67E5A2468", "2B3C9C8FEB87062CB2249D828A603478C6CE6A6307CF7103B8825D9FE81CAD3A", "2B4BFF0D4D521D5012752D32EC9AED8D7B42C9CCDA58A0989CACAC0FE91E3799", "2B8ED03AFB64688F7C236312BC8155AB0C092B0BB10F225899EEE28BFC95B925", "2BE1B762E9F077419A696E0C1B88E2D3F236BE3549BFC2182468480E071BF032", "2BE2E2323CBFB9A35C2ADDB0BB882E631583CEAA05DEE44AE7C7ADC5A0CD774C", "2C7412E482349885BC031D8092C58A0522256DA1A334A7F460ABFBD30F40BDE0", "2C89CFD58F3D4EE971D17C1294FCDAF90987B18CD1793833204AB66E2BE29729", "2CFDD7EB79CABE9467808BE1954249E5CD7205BF76604F99B481825CD7F613DD", "2D1C0AA1418FBF47302662148F950E7C026FF064EF3B9F6614CBF0F8FA30BD0A", "2D92580DE164D28D0958EBF2E4E78F5982A821D6CF8C8476D1BDC99E41D4642F", "2DD5C6727E4EED0ED960C2D5700AB7EDDF488FF993374321E14841F44202416A", "2EA8A49404CFD9683B481781E68A2842B97D467988843743EA0F9F2763B4F649", "2EE903E19A7CD16A29F5CE603A6BE1444D228989B00F0695E0424CEFF2903C06", "2F2115F5724B651AC6B9F0B28265F93BC7C9AB2AC6ADC0181AFF86004B79A417", "2F6601CFF878D38C07C4F896C729FC94B86DF3A06510210BAF75BA2061BE577B", "2F810DF5129E61B7AECC07F3698A4E88FEDD4A1E7CA3A999FA93E04C4733C72C", "2FB703AAD3FC5C2BE7EED7EC7E69FEBE209E6C70177FEA76C552605DF83D85ED", "2FE97BC0DB8A3B1BCF85FF8F69828770D4396C7CC3ABD37202D8089D2CADF87B", "31C0AFB718E47F2565BB2125DFEA05544B924823108F7C7BE892843715FA5571", "3230B5C261EC75BE3334755D51C9AB2E3BF3C718B1D0EB81405BE610E871641B", "3282DBAF074AFA6C97A473357736E8D5E80D6E12F0EAC7051F513FBF50E6124E", "32B93E43E1C55C81657EE7907953E5A9D625B9880582E91319BEC424702F44FD", "332EB7C24BEDDB6A08EB1D2E56168DBF8FB7B8EE1E89939D477827DEB2BC62FA", "335243CD3E153CE71F83C1E35358A1A6961917FF347D3F9AE3F81167F8B8996A", "33D4121C24315EBC2149A61597C95EC5AA26609607D06600AA66FC2197320064", "33F2BE5B3163CCE6F404E0E0DC6BB6A2C755D0AF8F3D67F6910CECAD65EA3623", "3410E09FDCBC57E565C72083D3A630854D64B8490C9907FC7A07113F787F18CE", "341A93FC1A45E72ADD48241188A719F3789D0F8084730D93C2ACFB474C42ABB1", "3445126BF24CE561B95746154EC44C95D58A25DD49B46FC202442E6C59083AA5", "34554239639E7BE30D7E2FF3E60FCF35C97429B34CA07D7E3B7EDA735A843CF5", "349AB443AFC0F9A0DCBBC79503DAD80FA9D227155C9781FACDB7620738CF7EA8", "34E92615DEA7EEB534443A478FE7324FF1E532020BDA914F779701A3E0067CAB", "35279E005912C3AE0E9F33640BCFD5DF387D4DC519E263BF997D5A7713E37501", "3530DF8DA972875E9B1FD6F767CF9BCE12DD28AEEAAF4F127105D1281DCB6CC5", "353D1C6BCD631024A42E1D490141E816161A8A6A01F6D551CFADA25D97B22F33", "35774A12657731256610BEB1ACB2AE99C105060354AA560F82DED28AE65A8B24", "3582AA92271267A0985635BDFBC8FC9F24691B1A4D1B420CDED32DF204F71D26", "366CE799D9AEE4234CE4D38A22D774A769300127F0319D9238DAEC27C48436E1", "370CF55655D0DCE5B827E549AA74D877B1D4BA2D531AAEFFDF0A6CA27218326F", "373505685C2504F2E87D285F28BBBB2E73FE52DDBDB53C323BFA4E4CED76480B", "376BF79A42FDC2B79EA0ACE3299D7D2BC084C5F6732575256A96FE46F43D836F", "37A865B8A16F0A6EAC8B82722E64A2EAC9B4AB1D6FE4CBA00F40A43E0855F3B9", "37E84D76257762D12F144C420A6FA36A16C6055B49D7AE073144BE16FFF7F0A0", "3806864362596B8F499C9B331631D79EC751CD68B24068ED9B36CFB553A6D005", "384C2E2A2A7CE0D7C1ED343860F7A8372BBF28CD038D1B9802B3A13C761159CF", "3851D26A1B7DF88EA8BA11EEB80A7341FC47BF9EE9F99E03682D841ED55868A9", "389FF3B6A2E82A9E25B25BDC36D35080ACFCADCB6E9C2CBC82F68681AF48BCA2", "38FAB199DF9F4E39A65615F1E108853EF74C41252303325B3AE91FF543CD105A", "39C354245E58DEA5508935346917841B7B505E810D13B316B0E6615AD25C04D2", "39D4A3024CD82E0AB1412C8F0B7DE6C9C896CC59E99FBAB7A5A61175586A3211", "39FB3D1F38AC89BD19681FEACE87FB4DAA9E420720F8827CC4AA35F63756931E", "3A3862BB2F5CF16B0EC3A6E37BC6259A114093A112447E385C778F568E3A19E7", "3AAC421D0DF5831B3220FCCBA6EA78CC01A191BC68D1B4BF16F97C53C8358B64", "3AB9E06E0036C8F4205D0B9C799D43CE7751D6227E9C183F98AF145F9DCCCE6B", "3B456375FBA8F9576ECFA26B90D220A038E69342D34BD0A526291E4B82A5ADE7", "3B659ECA0A3490E43A993E28F17C28259C30674E3C1D43656C4A5B37F135FF29", "3C85B3C7443FFDE0DF64A3D0D4869686417DA52714135E90BD49D23E0331CD9E", "3C97F4FCDC49A94A4DB2B097951AF0FB96BAC70BFAB9E075648D73A9D641F9EF", "3CE0DEF06FC9CE41C148F15E374E35024D02AFF49A540400F0AD056CB1C2A1C4", "3D307C26AD38224FBB6887FA744256D8B485F2828F3491E37740B523C7D53134", "3D6FBFBC369AC87AFDC7A238763B9878A6A5A8883DAAD80409B753C2C6E4D4B5", "3D8540513E9389E52505EF4CCF99C1FC5DC8928BFA49128170D48087D1264725", "3E24178C007E709BA47FFA90778DD34D7B8EB78DA65A804C849ACB792DBEEBB8", "3E3AF8AC7BA63076BEE8FFB670B3A3F27E0903C83526E54496E50EB2DF74B875", "3E90D8B117724A689CF205EB148C972A5AC679705260655DC0A260183EE9C99E", "3ED9EC3F8407924DA03D3ABC905C0426524C3277480EB60950F0B1E4F641977E", "3F50B90AA067D7B221DE01833CF094A0A4B8DFCEFA2F20192B47FCC636918D02", "3F96A633CE7ED35C5DCB16407F6DA5B42A94D92B87D9F35134C90B90A6E664ED", "3FFCB8C857007F3C79B27E410D1A065BE955D22321B8DC1B4F06D58DF3CACFFC", "4011B6F36DEBD9C43CFA930BA646A07167A3C49E7B0C92A0732645741514CCE4", "401F21678376C80B276AF0614D770A3AD8E3D24723155CD0D9EBD1E19DB56B7D", "4060FEAE2D8470B62DDC84A48595D6C7603D47471C44652E3605D6624835C6E5", "40F7CBCFB58A3B19B3D79CA6DAD7B6DC2BDC641FF8B170D51B354FDEBE613E4B", "418A4C8D1E8F2E8A923DFE2C36570B4A5EF7B515E050C0F19513AF3DAE7D2628", "41BB6A57FAD3A6133AC798B9A434DFE0BA0E9AC64CD3258AAECCEAD5451AF287", "41CB9666A88AE67D4A0558674B8CFDA62F160B6DDCBA3C10576515447887CF12", "41CD314F34CC21D5DF000017FEA2274687041AD7C28B5D88AAAF2CE43C5EF417", "430959A1FFDDCF67CED9618F6D7D9D4AA3375ACDF3A78F328893A6F7C60F4F35", "4392547B785774FE9AE5A632B4118A241B21ACF551AB83B4051CA1A5B728E58F", "43D2B0D4C08D283A5A1AC580A4FBB9FBD53D3F9F84D3FDD4A3550314699C083D", "43DA4697F34CF5D5A6799540E74541895D58CA735AF6018C2189B56DA5C5FD59", "441A6459C1CBE843EDD7F5C4D862AA7C6F90584EA901F82EF1B6D31B418078EB", "44D4BE9C6B3A5CA2D7E393A0C6B1DE6752C9B6BDF8F6BC23CA690D4063D3152B", "45A5CEFDC4D7BAF7DD3A35BE14090A435BBD4BEEFCC6A8B34291DE21F9BE02CD", "45AB5E52C7049D43AF510E3D9B3484D6A8452798F85D470CA860CB100D7BE1ED", "45F290647D7A4EBF1F245A22873DA3258113639A5595D4F08D5206EB9D79EBCF", "45F3E79F778FF116B7E1BB62B97CC9ADC2834AB5E2280953B0DB7A3ACB3667BE", "4613F5FBE822E46EFBDE0BEFB9DFF932DFF57574FD8ADDAA8B5EB509A776A53B", "46FAA835435B75C9ACF0355A61E51FB1D066AB3F9C5269FB30BFFF04C2C7D336", "471BEEF44DE6C27461378C7D110744F38E295FB10C4A50D100750E5E0D7941A0", "4777AA656AFE2A7E99CB0D93F8BE73D4229AC1A8C767E59363E711B828FD7059", "4777F5C1553B23793B9C264645B77DC8564BD5ADDE40E26C0417DA938016C274", "47F2E96B209FBB6A2D2F949594CD1BDC9761597679B1D5EEF5979F79820561DE", "4836323F140F5C6D88883F2A098C5531EA1D0196B52BD5DA1D2D5BDAF8A68C4A", "488DB87E4D3C81B7E74DE606C38F39FCFF97474D4F2931354B52CC01006F867B", "48F32F0BE81F12977F3F77EC7A1B784BEEE2CB897C3A11E48967C396BAD27436", "495F28ABD6CB63A1B70FAD5FC4E6750499086493E87969EEAE95A843A0AE5D28", "4979AE00A6ED0C539B1400C19C9582B63BBE318402F26C5329EFDF836AF802D1", "49901ECEEAD43A7B78DB4958F32F55FA5CC90F26DA4A3A18C04B7A04C3B6FBA6", "49ED43DAA523C79B0D499D6AAAF1DB03BC188989246D9E4075BF6071BC1F62AD", "4AE85817FDF881B1EF788F57A79BBF7A045D535013663BA8613CCB5B6F1B061B", "4AF3DEB82989B4E6746A3E3F13D975DBE8BF4FDB968286C60FFA2743AA829CC4", "4B1A4A09D6ABB8D3DBABBBB15304AC93C628BB6C8917F6E379CBB7C2B74995D7", "4B7C6723D18E0DFA9F2B469E2F6D9E9E97BAC6728DDB3BA15F40ACE66F684EF5", "4B9FC07D99F76E8A079AEC1877622BAC575BCC2DD105CA72EB876D10E2DF7D8B", "4BDE70E43A19F50FF60A2F5CB6ED1C095A92727557F41F17F3F3059A4D00A95B", "4BEC8E9463E4B27C09D4E3ECF5C98A9E0D6D193C06E6EFC3DEDB9F41368D7DC0", "4C10A98BEE68D0B96F2823756EDF99AFABFD6558C7AACA794EB853BCFD69F5B6", "4C149E6F2A02DE48EF008D908A63161BF93C07DD6B16401AC765C3B64D274497", "4C2CEE47BB4506B08535833B7186031AAED3FEF21AFD49FB8F62EB022130C528", "4C523F746272EEEE1349A34BBBEBC52C302896AF08E7489E165CA54838013548", "4D266A154A3DA31DCA059F3C44F85045C1027D42EEAD68DA8098C2A3E0994AF2", "4D4083B3DCF76307CD159ABFA977289BFD623C088D7406C26A2EE54773F4845C", "4D6D1704A809185575E4F1197B188D9DD829739B0F7943FC8015D24673190648", "4D8657752335630DC0A9AA1B58DFDC68B415B530E63E94280262BCED6A83CDF3", "4EB2CBEB6EFDCE33B72A1C52E3D612F0A7D794A848AF0B29F041265587238420", "4EFA75F734C92FB0E8831F39A2E89AB1853E96D3FE2E59C7F86F1BDFBE8163EA", "4F83742D4D9E3F03A6481F27A21969D4333962D309ACFDC2D174BF09D63F0F8A", "4FD6558CB9A80538F78AE6DD5C078F6C7A28CACA8FA5FE27C5744C1328FD1254", "506E8C92E0B76D834A33E4AE02E5206A0ABF28570630F6E4A780D13A5238D647", "50DADFED837E47448CB5B40DF47667DA871BE72ACF4F092D3F3EB0D067E976D9", "50E6A01BD478DEED9D4635F64814BCBD9DE715353A82634EA217E4D53F3DC5D2", "5102E26F5F9D162F10D7A53504320571C340046D1DC087AD20DBEB386B11F545", "516C78282E257BAD924E6FC3088367963BA15FCD8305B1B9C4978CA225F03D64", "51AB1F7F50AE2546674F97D246115890E30F6672B86D6D523810D29C5BAE0D62", "51D76932A5074CEFE166544E71EEFE076AC2B628BC8BB22ADB147946546F595D", "5248B9256CAD1F8D158CE63A6D338882538AB4CB774063A0FD1F9D65202CEB84", "52616DCD3988A23E0F40BEC60E4795636ABCB5D9B4CE2ED0E05FAA2FFAE2CE8F", "526C85444ADA765B2729246BC9938033E42E5DE0B978396394EC75C1EC184980", "52BCF84201CEBA012FEF5D806CBEB019BE40DA44E167DE103878B677EE8CAFAB", "52F1AA440EAF2E0C6FDFA61BD566BC1EDE644CA8D2298715354061284841EC5E", "5303EB56B374789D2F25DD42CDE200B10A36458869D3BC5FB7882728637FFBF5", "534BE42CCFEBF334619AFF9C2FB1955CE0C058A0559E49A3D0C26AB6F743C73E", "537163AF6A43E9635AC6244334A6987334AAAED355BDEC033C662E7748C0C124", "539FD5A344951CB3146EC1C6256AC3A91344217924BD86DB5242BF2BD9D82C91", "53B532B87CEA78B57E2ED69FBCEA8B269DE8F2659CD1185FAB9174B1B7BD0971", "550D4F9FBD523E5545615EC0921C9C75656BC3C8C839BD55F357F98975FE0B6D", "55283B08D88C232381BB1E9484F194601EF856C8DCA2C424DC5AB95FB216AC5F", "55839214411417A2AFB018FDF4D19D29C2EC9218038EB311ABEF9AC0DC9B2637", "55BD84BAE8C7A14BA43B1D5F808B6528E4FBEF810015A85F798847837C477C2F", "567625FF8DF333D5C563E40EDFFF9516FF13EA40EAFE9A2E68635850284A1A44", "568E2B368CFD084DD70521225DC70F9B7FE2C3CFA4EC7D0BB5941865FBD96921", "56D177DAE57235B901582E7A9C8B02337D37FFFB7BC7EEC5F14CBE0A9A1900F1", "56F64AD3D3BE201E4EA426921144989C6499488637E69793792327C0985A13CC", "57B9CF39C18FB4A06D2E917933FA8D5E3C4A18F982A4708050D5715BD40B9C19", "57F776FF55271032943DDA94EDAE416CC0AC456F5B793EAFAE5C9E1DC182575D", "5863BD4578016A0A34321D843446F533334A923CB88F5E996D2ECA2DC42C03E3", "590A06A919DC69F53268690F4E73BE47E7E33DDE10C97A39EBE1DB58B07F977D", "5A2425933E89E2C50FE1F3B1903983FFF1089EEE55483682712FA0DB9D6A700B", "5B104C6C43CF78DC6BA7CEE91E1022F1E06EB323D77B672DC95C3AC7A5659B5F", "5B47275B66495017EC8BCD458FF8949B7FBE30E96158522A3DA6B3FED9F36A9E", "5B63337BED8D1831437D9E9CDA230341D96CD4E72BF44B64671DD96E2E83D164", "5B764D011AFC28077007033EDE6796277192929BDB57FDDB03D31274A2F5A9FF", "5BAEA8719A164C4764C5CF92756824F3925085DBA8F40E33625279389703186E", "5BF8A9DC926143E23508F6210FE0B532543FD24EDC5C7CD6C44B29877B6C8DDE", "5C481A34282BF5BFB15AD8A5575FB80CBFFC6C92FDC1CA5E744CFFAEA4644EE3", "5C84EE90836D63B05BD8D61CDE089A39BB0BF0FC1D82D10897E9D6EDC4884684", "5CEAD8C253F69D6A5CDC05C2332D71D82CE7470C0538049FA49907A4C9423F0E", "5D15E38E41948EBC404C08C90826441AA6EC959B45B5BFD2E68F1BC447FBD762", "5D1817A1FF5D3042658FA80C8C0734EE1DDFE73D33363FB66AD43769675B0908", "5D37D9894107E099AF55AB01810271292EA8713125D23C65AF66AC7E5D960981", "5D40105B665351C3C356B3A427EA58D3951C336D84BB1C037D670CCAE6EFC4B0", "5E6AC096D5F35D524923422195E5F8BE5ABD6E307943C5F7A48830343C060E96", "609EFFAACF6D4D4E3F051F3F223C8D65A6BA5C62F2A8CD13C34E4E67C76EDF93", "60DB7F5346C5B9A16FA72AD40E93F7504EC85787EA9E05A8A2B66219C25CEE88", "61080EC8A12879FF667AE005F8F9437CBD064979751806084BDB7C5D3EDEAC67", "61259BFC3E51FA408F6B65E0842C8C80C5875177AA7C5D5856E5F989956796F6", "615905D1396A1CBD269B1D48EBB13503BF40945AB42992171E0EC1378652CC1E", "615E4369D0B07E7BA358AF447BD05A3ACC0720A255109ADB57E2A2080DB3607A", "61FF6F10F0D76277F85A8A525D2C9989283AB04F3D830BEC0894CE78DF0624A3", "62E579C60F795D7F7C9A11D045B9ADF109D89FC917EDFF6B805E0C3D4DE7CF50", "6314721FCE7C49AB631E5F584461838B4B2B9C75884E7077B204317030678015", "63C0560C61FE9A9777F6402C4988E794A31F66C8118AFA944D2596065F5D0454", "63C0B2B3226E3E98449887AA89E81C9B35F422CFE5D67FF9577B4EC869D9F5EB", "63C3CDE8CDAF4F8F9A493FE055B82B2CE29E6880B7115737A7B3108BAA3DF141", "63E97EE79A6570DBA544550FC5DF8BE2C8A41E24FA160EBF78E0A0A573148655", "643278CE1BB636D8764FFFB99832A74E1EB43BC79E059A2AF6DA2A9DF4BB4FCB", "6440B3CEEF4AA572EDBCEC6666974E017AFAAA0983E4E7486BF1811FD9CBC173", "6473C7788923283F01B09B56E980E6BA387FEBB5AD805CB7A0466F8AB7CF3F52", "64ADFD088203597B59C398AB3DEF28DC4F72D37A4C48C7FA81C6531EDA6A9877", "64D6C06BC49235B68A230ED5369E2CDE0C7EFB46609B6E32524AFC13161E8406", "65575758CE6E879BDCFD17ADB708B2448CDF9C00E078AEFB1967358BF519C078", "65AC1B828E41A5505E1A8E4F6E7E2E7A2BE86DE58C539C97379A40C7ED8BBD9F", "661EF6C7BBF8AD251228707DD8EDA4B08D9235BFBAA6C9BCAC49A5F4CECDE3DD", "669DE071D490B09730EF44E681A0D897A38D6C6B5D240B811700C6BD0B24DB2D", "67BA75B2F60B75FF432F4A7CBDBC2D43DE52B633C04D3C54ADA035D39D2605F7", "68E7DB3D7E398B2706226213F9B1A94ACD374A065EE9538BCE2CF140B065CB08", "69A39D35FF9374902BEB26D9183E47ADA8A9F6E73B9981D10DC5E13E014BE244", "69C147CB642B39AA3250947FC1868ED542CC9C2C3BED4BA821CAD9BA0F178E84", "69C79DB7169CF870F6B1FDFFBCCD8DCEFED293B79862611C9A5D39778668A20A", "6A211412F2D10EF21E599E5E233A8338C185096623353D79DC919935D1D1ED5B", "6A8FB2890AF2EBFB497D7D6CCC198FF3FF0E22BD184AAB460E05F9B5E0B6A4DF", "6AE2991240BBD87BF68CEABEED89D92EAFFE166E674A2B223CD07D0020C2012F", "6B0A5599577E8CC081B38DC85FFC053A3E597118CD8108314778BA17EC91A265", "6BA96613CB9284A12C5C7BA5B1AF346C52C407C3784639F8A63CA5F6E90563C2", "6C0C64141920EE55899BAEC8A62C876633A02F40707156E9F4782FB71BDA3A8D", "6CA349AA072456CED96FDACC6DA185AAFABDC28DDFD60462317DFAE74C72ABD9", "6CAE2D44529EB3ACB88F1CD69BAC17D0CEAF1019A014DB789505665B46AF09B8", "6D0C6316636CD5C1C20D3618A6FC50B6D5B50DF90FF9082E343717C1B250444F", "6D4973EB1B76D6E8D1C879FA67E77298740E865E81F7639BB10C012532D364E8", "6D5D91620BF302DA5E3CBD00F8AE47E9657A3AB849EF71820A9FF0156C66535F", "6DFE02E47206439339CF69003DED7C6A339BE8A9FDA6611EA300ACF64BDB9DD1", "6EFEEAB84B850F3EFD6B7A1D299A9F8F1B42B1016DF5D4493B1C0ADA6A79EB29", "6F7048922D8A61251457955B080494180F71E1A62BD73A89D05AFA035062139D", "6FEE67038ED295324647308F3C611846F29F9073DA5F2D94C9C0754CE87A2A60", "70427712BA5BC5CC0FCAD9F41BE90E49714240938954BF076BBFB058FA595319", "704897FEF5CE3D4AA35FF51AE237FF23A83A38E10F9597332BAF89DF648929A5", "70556F2ED6FA93B91B467A9C1D8DF5829727A953B429514D231262823556D27C", "705D1AA8DC1EFC5A25852EAE8F70114AEDB618E07145B676E2B502DEDBEBA92D", "709080B19B32A09FECA9E18B353B575EF5D36ACEF6C76150C1F0BEDC5A1625D1", "7125D135DE8BB06FCDA0CD5DF10431CEA999A7141398B32EEC60E63D15F0938B", "7134AC524DE29E5B666EEA5D0B7677D60915F6239F7615EB7B311D6574EDC742", "71A0E260D835E4FB784163408D486ADEA9933D2BF29E0D594920C0DE72D440F2", "71A473993D401FAFDA20A063C958EB3785E06B0F2833BBEB5FA0B1E2E3123139", "71AE0D5024D39B08B24A7182D24ED9015A9DA203851A438D5EF30F80E1A05C50", "71F5E8A084745AB734B8FCCE61B83AB4D2A798A72CDA2AD70DFA1E43A457F4E5", "72AD5D71FF571D991FCA51BDAC7D0D303109A868FA89340C6F8CD492F9F038E3", "73A0E3B8972417A5C5268EE0E3803B9B8C2E0463C9659C6C828573AC1D00D1AB", "742165674E677DC9026C3F2D2245AFC118A59A752987D90E7AA7D17B911AC473", "7463232BD9391B70113F6779133DEEDF82C2F9FB5E2F9C9C4D0363B332E72184", "74767FAF408C31EF10FD36E87F8FF06644380251DEDF0B8DF0EAD56F9291B3E7", "75292E3923B26B0E2E5FF96584620DDCD8E3FA9B1B48381C5BCAA4B6590D82C7", "752DDB784CBC3847FB15605BACB859E282F27F5D35B885972A2C5CDE474CE53E", "757696CF6B25D861147516A0233F27AA8ED63CE44EC3D079E6265FF809DBCB35", "7577BCAD9072181E579BF3A80532F420C8424F287BE8B450E9A58DF0F61C21A9", "75EBAEF3802E5D231DDFEFE9E207A551984F9C800735545B1ECF45F84E8E9C99", "762B934E108817D7EC500735D49B8383A3D66B67FECEE7DB94420501348B7A66", "766578EB2C7BE8A81F504B4989C22C31CF802D03B94649D36D4712AB13F788F0", "7673ECA7C26C82F326589C66582D68F7F87357B4FB250AD73DE7E7F5EC924344", "777EB533D5BEA1C32E0486E7AE4845B84A52FBB7EBCDEB8E44BAF79F3C9EEAC6", "77A5CD46FD3C6940EFC34DE8C8AA831927106A12E0E3EAC862A5D46723F4092E", "77C6BF921A5EE4D83AAD3E81B0714C7F02AA72F5A80BC01802CC6F1440DE7948", "786A4DDE0028F9E1A249EEFBD707DEEB8725D4ED4823D6C82561F75EC024844B", "78A368F74CC70EBA28E0358935B663EF2233666D59C87E6FDE201BF381484677", "78AC818528F1ED5E96DF9765AA477784E752DB03E5EC0169C89AD690326E3F5F", "78D9C4BA0AC6C939F05FFA65988885F5B6562735B96655E51EE309206C6220A9", "78F585E499684A44D21982BB07C498E010C527FBE1866DD676965E7AAD25664A", "790AEE8158E5072311EE0B1D8C1CACC2CAE27CA8C7B75F39AD990B40790CFB8C", "7911EC80C28F7BE157F66EC6B3E35B2999E41F97F4299CD83723DE004A5C5CC2", "792B85A8DB94781D66D2F4C4B62AF0AB0D8345DE0EDC163D9DF3146450CB58F8", "792C36B0F9C06EC75DA2DDE62F88146C059686EBC4B055683582DB72AAAE7DCC", "79EAE7C5A7DA7DBE00A17ADBD6792438E4B1B128DF0096E2DF804D9C313CF08D", "7AABFFD7EDE8A56FF3E63014903A8533BF0F07389F0D81F452A4D9AFF5CEB90B", "7AE4383D619D418CABE7152FB7E807377BEB422FC2E2543F14B7926B017944EA", "7B59C3F5D5FA92648E2459764F2D1C138F6AF03B4310442DA92E75CA47564FA9", "7B86E15009D1EDF8F9B6096C616491A310C05F13A45280BF5FA058890221781F", "7BE38BC9D9063F34BE9B8AEC73F5518E1D7B0EC8F35109DB2E64EBA48061A6DB", "7C687A5C4DA5F147CCB651C24229AA31D311EBB13BB2DF3508D7A6085EF3DD7D", "7C734AED09F6D875E81F89761F193E2F80C9776C40D236D64CC85D7ED887CB18", "7CF405F3B27D94D69557645C8F0C3B55B3AC9AED50EFFD66F1265E467213394E", "7D46658778E442AD0D43B74E767B5638C73A3147A2AD662C6A1BAB31343A96D2", "7DCF72D6E3246D0157C1C561310F7C291C55A15827572A9E430830B46BB74CB5", "7E0744D5936EDC5F018B0850D801B665D388060D6A81B986BC7AD81C9A78C0EE", "7E120392C6B27EF023444674C7B2E2BB0AF1032844B5941C3D340385D2344B0E", "7E18B438D1C420D8FB4F0763D89974D25E4342FB6DD3A5ED861C0784B3F46C2C", "7E748FB7D2BF3C8C9A65B6AC1E01AE1CF23A69785B2DCE748AB18C63395DC19E", "7F074E985E9433293F83AAA7F6DAA1B51640BE0E9CE150599D1BBD7718BDB08F", "7F1C012CC641EF0CCDD9BC749B665F263D22200F5DA78D27932DB5F6F0D9433E", "7F589FF0A0A79B9CCDD49A773CD35D3879E86022BFBD62DDD1F854A44EC6AA69", "7FF67E7B52DAFF24211DBF2A070CA6F859E1B8F13FEC5BEDB6B3E4A7B2894505", "80099FB51D78602432AA15F571A0A2F5F5E374CAFCE222EC0E747A78475CB57E", "803F869501993CC6DA1FDD05D0FD3706704DE2FFA02175BB4352BC3DC0DB20FA", "80489411CAB04FBDC8043529670BEC2C45004C175864AC8845B7DAE26D981661", "806B11C18985E14C352AABC27B1F7697E3ABBED668EC91AB8DB0565F535048B9", "807F02BF5D04D1D709B1D383A56D073A3E2ABB5E058B819FF145C9C80E083AF4", "818B433278D5E2420F4213C71C6036E7BA5EA3C87CB6A3BC405627E0A3B9E898", "81A43B916CA46098F4B2D56E0CE7C4AB6087F5F34A8B3AB432E8CB42F62B814A", "81D5F6F41E5617EDA7FF694BBE43496FC48B7577BB4C9C238127ECCCB1D40118", "81F73DF562970E5239B639CE59B471B9D34E39C4A5BDD496165656D76C34B09B", "8275C3B123771E721297381D0F66E5CCB99C5D5EA14F12413C6DF109D950665B", "827A45EC614307E6B330A61725CAA7828F168F30C837A1B843CA1525E013ECB2", "838686EA8660AF45865AC08A8AAF01B25ECE89F900D760F085C235BD477978AE", "83949293D531C3BC38D05B8E11F73860AE63D675A7ACD0FBACD46879F7DFA117", "83BCD79CA2DA6E4D09DD2F427C463D4B4BD65176050EF7E295B09550287E5954", "83DE818C5932FD800E5449ABA82FA7FDCAC7A0E2B41C5C07CC9E5CC56A3B9296", "83E05CE18C742C690ED180ACFC4F429861709B1CB63288AA22A97B05C0C50289", "83FB543E615A9C8662A98035262ECF1D1F4689ADFAF69DF4FB232747683951CC", "8459314F4CDAD106D8D832AAAF0507C1DC8782E3A1B6DC0ADC92F0455FABC390", "8491CF1F3DD8116411BD720BFCBC2272BEB04446394152CADFC6BA73F4D21149", "858896131EA815FB74E9BDD335996EEADB31086755EBD223F4051866A0275C41", "85ECC5B4F4D2CFB8CC8BDC1839BA3D7C629960FDABEDB3CEA10162B45BEE0DD1", "85F4F9ABC26A141EA4CBD424EA8C33FAF00DCF970AA42D90F5EC572561A224B5", "85FA572B75387155192844050696C5048FB160F11FF6798D1D627FDD9AA478BD", "8629A4ADAFCB95D5120D30DB27A7FEE450956908C79505EDF721F7E19CC8A212", "8678E8D32C6BECD6F48A55544E2A3C0DDE7623A3E52E2505BAF48303D0AEDF99", "86BC382413D13FEC49BBCF5FC0129F8B83C058E0C0CDD0CFC599911E284C4FA7", "86C605E3543D3B83BA0A25B4F9686B938438FDAB955B33BD0721D21AA9B6A946", "872BD873063FFAF2EF7288B9566A9CA58451B802A0465ADE67F67B5E43921382", "879386F682CC1455246FD7C829CF91A2F25AB2793DBAA6F53BDE7DB2B8771BF9", "87DCB77CF764C7235B6473B289E603F21A1588D5812BC1D3022468CF1C8EF03A", "87E69918E25D6751D3DFF28B93E0E32012AA2DB7FA1D0F74175CA8BE7330EFB7", "887D6203E140486EF077185F8092AB2D6A08535AC570BC97942591622320BB37", "8880E040BC7CA42262CA55E9CCF7D72E7B4167D95BD935636659D2ACD4C1F320", "88E396C29AABC664ACC3D5B0A3797EDDA0587772D5D9F452A2E356E7CC5BCD5D", "891E5F0424A107621BE648D5F1576C607F7834B3BC114E0F945E5010BA70A9F3", "8A0DA0F94FA34FE9334A6F58F277F51D60D68F3B0D01D043559306679C8F8EC0", "8A242C548ADF3E615FE6BA32C7E6F5B2DB8B1FA250ABF2329DC20A0FB32D3700", "8A25414E8FED9B3A34B56F03DDCF0BE180EB8F7764BA550EFFBCC83D0E7E8154", "8AAACE4B8576E759E07E007A6C62A6C7EADF6433E09CA81BDF0E3614C86C7DF0", "8AEB61826548DDA949641863F93129FEE91E02DC3B949C9D6D3A111A2DF9A0BE", "8B0A6A21BA2668C6FF8B23BDBA894A0A5CF4333B21213D8B0B25FCFC976379D7", "8B0CCF03E1AB5E837B22F3F63A7EBF415DCECEEC04D69C3EE480A021B1ACEDA0", "8B9D8E3EE9C79ED8C79B79AC4993856CCAF65A3AFAFB705302582BD21B2CDA13", "8C5F9E00411BC48544E09C07DE0A9332CE9F2162272F1C9EE415D926FE3F077D", "8D1FFB0AFC90D6F732CB992E0BDEB82F435593D96A68A03F6DD265E83892C473", "8D3B55BC79F0B30687542D934A8572E811EA359E895A6EA6E760B9427B444F8B", "8D964A6D85AB92A093A54D98B52835DA52D646F29F4FB8F77B0F37827E6FEFB1", "8E1256F4D760B64395430790B1FFF7F6484E9B08EA17FCB3BA65F907AAD17C88", "8E4DBE94121ABE32EB52144CFDD57FDF0D6884516B0DEA8E9B75FEDC0CA31C5C", "8EA98A1ACD7FB64C20AF5E150C5876B7A376F3920E71B4315AC3EAC3F292126E", "8EFB8A654D3536DD4481500A7680D75E0B2A04D2F63C829CAE130B12A35D7ED3", "8F4CAEB4814182DEBFBE7DFCA9FC13E3577204C307181835FA0E1CA012CAD9E1", "8F7E9BC38CC1D5886DD8998C93E683C9367649830B463A9A5032011B60846A4C", "8FB323EC50EB5CCD3380176BF2571DDA8C7739DBF4BC558C9B57458B912FEEF7", "8FBFE3954A9345184C9C56BA71D87B643BE400E22551A9B009EAFD7D82E9BD57", "900B686502E0C61F1BAA043F9387495F4C4AF282D993D0971AFB618978232651", "9018EBBB2B02EE47F1D399A0C2BDB34D3337938CEAB3DDDABC830CFAB6427187", "9063463CAF2AE4BCC6359189CB4392BFAE2B04AD50A9C019E56C162ADC24BE22", "90C082277B7693D7D3EA0169825EBE4FFD04904F9C3D49FC9877041A980751F9", "90CF485116A952ADEC5B5A85E722DF33D1556D18AE9C7D1F5699712F4EB9F66A", "915C40C3847839BAFC1ADC3A4E386F48D7716C2F3DA53EC6BE7228D7003DDC0D", "91791263F482BE4327CB96A074DA5FD8EB133EF9DA47BE41713B960DCA5C33B4", "91930D0C0027256BDF6F6A683AA106FDB6E1126793DE782A7778B79E23204C51", "91A961EBB8F14EC5B247B015B7D5F803767C766BB73FFF429F090B7BE9768BFC", "91C2C4E11969518B70A8C8F53536E1FA71DEC6EC24848AC3C98F5843AFBFD45E", "91C68A3A81E7952C30AA3A075F77EB8ED22DFC3EBC76ED25A3AE5D91D1D3A332", "92627E627D103D4038024BCFD810986107E14AF89DB4426C430D1DE63EBADE27", "92F0D4CE4518417582FDBB4466704A664944EB0A92B29F392E7AF508F118957A", "9308099D073B8B4A5B875ABF63A2A8BA4F4ABCB691E71E14B89B4833B4ED12AD", "933F16C198EDF616BD60B2C55B4AE9B642F3BD83CA146DEBB0E52EC9050248AF", "939CF579A3478DA004C0DC63764E80A5A7E567E4CDC2FE8D1D3D9C5336892035", "9485C17C6737EACF77937D851901B067F4440B181E90652E1B22FC3F0E4AE5C0", "9530EB6ACBF40BF0B043F5EB44A8DF4581A4EF8F0AD4A4B066F908B8510CE360", "9539D349760C436C7C7DD837261536EA548010DD2305304375696FA545C8BF09", "9557F3D3B6CED6B6415B55131D4DF4805DECF313F0ECB47311E3C9AB8458127D", "9559CE1CF845BE27801B9A76018F0E7FFBD3159BCFFEE9D25526E6D24FA5F367", "9568E59FBC9F48E0CA633A74AB406265AC01F813ACFBBF2AC3F70CCAF62213C1", "95D8A687FB6698AB935F605A18A6534132FB012F636376A917BEF6191ACC4930", "968F76B061F639B6B747F38EA0B563E31C681273189E02F178403D72D7E18BAF", "96AA6E96C459B552487D37879C1210BD7926BC641E7FD69543382941733FFB5F", "96B854658FB25B1C41C7953D07DFA40702863F7DF3DA2149F3BC57ED6B4B5CAA", "96D305EAE4A7FD6D6FD4E199CDA3EF2579F2E48F6FBF657006C48D2421E7DFFE", "97A93ABDCC041937D1DC277DADDA794AC10D40CA6449DF96DFF674CF1159264D", "97D5F772EC68BDCD260FBB9DFB7A322AAAC657E9360305DF11F9C6A6A40D1B85", "98282A66297317DEAF932A4DB1AA0BC17518203117E741C6726C9EC569A0FA61", "982FF0509800B4036BDBA1003C6D91B9D9EF79D4AEC2A96F2747CDFB554D9620", "9881226D0C430B3D1A6167EC18E2DA00B1048D439BAB0713E00099F02830547C", "98E790BB04C04429A117CD716BBD2F338208EDD76B0775A28921DFAD56715A85", "98F791B1A21617E2B9CBC3F08A10068F769419FFEEDF044759AEDACCE498E275", "998E998A37AA40076F35ACE20C7E0016E44B1CC4EFB6AE26D0761C68B7C99657", "99961679791FD1881772CA4593AA07D8E7710659435A7A4C5AAB04CA91E3EB5F", "9A19B1A61B0A4ADFDBA9E428552BF21656703586B14AC314FFC9B663C7D9BDEB", "9A3C58591C936F5C2DADD29A151E053EE1F4DF40A9F92D94EA83F0D53AFC3F25", "9AD36464B7BFAA6C6A8004130473F7EBCFFB8197512C68559A7AF743D6FEEB09", "9BBB794BF1DCF8660F8460268754D1A7E827EF26EEF07D631316C9EF5FC3CBDD", "9C01855DE792DB516073FE7D57766225D3D1F4F50386D124FC6880AE615E0F6A", "9D474CFA28D8B0313A49C799D05622C172F9872EA0EAE8F12773DAC4E1DEF768", "9D7005B758961DB83E562429E679C1FF93E8A3CBFDA5A6EEC3C6B52C734D2869", "9D9A01E02514803E9E0E5DD88830752E1595E1F1CC50F35B26CA6DC44AE2E184", "9DDD0F190508F2E7A5678CB2D1EED7DBB6DDCF4E86557DF2759A163E2BE27792", "9E0785F08078A693830D9375FB362720BEF15FAEDDCF6AF11F7E847FC4F2B207", "9EED50A5725545E60FE319DE4F6AEDF02C01A56CA754A18F89ECF4B5BD5DAC8B", "A0036DBF564FC801A80402265A168507AE957132B4CFA8F0A86B9B91DFFA2C33", "A04FE2EEFC21C3A9305B1CF7463C731D28C17EB5521A8E54F5F564939C5E91E2", "A07C9B7C7D5952E2BBD4C0874BEC859D77892E662D993098C91BDFD5CD4FF6ED", "A09A6E30BE6B0D2FC9176062D676B3CB9411FB6EB7D63B758A21F85E2DC50E5E", "A0C17B7FA23DBF1DC4FACFA7A00FFB9DEE0554664F67073C8C966AAD62F6C865", "A10E7A45BAB7A017FB419F00D57064F9A2482F36ECDBC49D11E209F1CC8D8A4C", "A1EF9298714E6ED876FC447E879AE4AEF24B3BAE418A5BF1CCD587D6F1B0DF70", "A2EE5D7B50B89FE347A7396D60ABF30FBB21145CAB7DAD0BB56F2ECAB84611C4", "A333C696330E377ECC536E6289FC4F08CEA0BCA767F557B2607FE8AE6AE93E24", "A380C4CD3FFEF0D1AD28C9019320AF0085267A1FC55FD33D40E61A6A71DFDFF1", "A4546309800BAB5D9165D01BD2DE818A415744A283A8CAF26FF5FFFB7FAD3368", "A4789370408F9C24E02B7205DCFC6E8366E926811626A119FB3EA4676EE27F0E", "A49F8E92510CDD96D8127764BC310529CF44A60596DB14352FF329575652A707", "A5294D361F6BFFE22ED23CCCDC11EE2BBB271AD5E1D025A5B4C103A6655BC8C7", "A545DB1C220C2CED88336E81FF848EF91603811394EF649FEC94F4D2653CBD45", "A5ACA9D08DD29AB239109AF58FB6B994D318DCD5424F5180E2376E622C4AE6D3", "A5D66703DB49524BC0E6FF153597AE66CD2BEDC4A2F7CBC9286EC444D39E58E0", "A5F646FF4C83A4B1D2C8B47FCAC3D208DF17454D859B9AB5DD63F0E74300162C", "A654520C31D8C30F04EA4DF13D66906D11A4C16B55D50B50EB88F47415ABF80C", "A658826ACEFD8281700AA4C5F1D1D4C5E783F73C590631B873055789D4BF0CFD", "A67E3A7D088C9805748212563A7F413FB4500AFEC69F2D7F55C967A91BDB4EE6", "A740554B49FF2C28448E8B6CAEB6B5186A59385D0F06901909CFF1DCA81D60FC", "A871939B5F51CA69B0EDBC21D1816A26D5E84C73FB45D47DF354F899F5F6BB9B", "A87D3B01BEB3628C5A4865D02456C6AE700642AF49B89B34D8697869591CCEC7", "A8A1B567F944BADF2C3904883B086755440DF569158EEB6B0C8C2202276A6F6E", "A90DD52456233257713133653B224B6D7EF3C02BAF11AB1DD040C49EB074BDAB", "A97F6751F71164D0A07AD868814BD46D147EF591C7234360EA8F62B2317AA675", "A9B608450EE2B2505174F8F497D891A822A15EB84A1C302BA28DE13FA45B34D4", "A9D26D14AAC00764E11A3394CB89D6E0363D88AB9692EB7F10E0567011E1BDE6", "AA6548E6E305E2883E5A357C0C07CBBB180D872843C31FD3F2643F893164DB7B", "AA6F08F01A079565B77B09647282DFF85E99CF9A1905EAF67DAE8F9CCF81DB85", "AAFF9E87667B35D62A52D77B8E5C3A000AE2419974F7C14545C23704BDDC171B", "AB0FBE5DF32524F071A04133DEFB50E908DAC3778C05E6ACF27DEF9A9FBD1938", "AB1AC7E7CE95316265077790DC2D6CE23068401552650F2CE08BCFDA4CE41AA9", "AB8332BB49251697A40C4A181070CC821286458CE2114BD526688971705EBC0B", "ABBECC2CF1F809CE932B9130A6788B28E3F6228FC5599EA3FB4CD8372D7EA7C8", "ABE6D7E1715EC89D7D9B85B3E6F7AD550EF1882B24B2D50542407488158748B5", "AC5DE01326AFA37CBA7F799502684F57AF3D9271EC49734648DB7797522AF2E8", "ACDFCA5E93908C1CC35E54B4EF854ED57BCD6CD2641A3590CD2418E8BCA917EA", "AD19EAA1EB45FE2ED42C76CD384CD707CD4910D7CB4513C404405DA39B669438", "ADD0F839178755FA4DD912718C067188513D949DB4F98877C9A6309ED84FA4C9", "ADFAF2107632CB0C547A490DCE3B11E07BB13FA0FADACE5EB3103A8F9AECD63D", "AE25C4ECD22B474C66DD4F8D7D4B336D83A5935FCC2BFD3334DF4BA775BACB7B", "AE395445C7C7240CD17B06CE58A20D98731AA33DE1AAF047F3A02C424CBD3F87", "AEC0722767EA21CDE0F10129C001F976425E48E7F302D7C24108AFF251D12D6D", "AF3CBD718F3297D87FDA4616011F4CD425D9EBE3BB2880108811A5CAEF018EB6", "AF6ABB14A6D607E15C5B5E8D5407EEF7D810349AC6111648229782BB7B5A95B8", "AF7602FA31D6499CCEA0B90364F0341F1379DF87CD2AD96A05C2831AEA8BB671", "AFA0CC2FC2C055F26F871E9C21EE0AA3306230ACECF1CBD6D9CD834A07E53935", "AFF280B78615CE8DE30ABB9D56D6E9B807A4646603CE034B8B2F39DFFCF6575D", "B0639A1477DD788A0606084BA43F1623AB2FBFC72AAF52F2452C04CC5FF9DAE5", "B07B2DDB76A96BB8480E22188347E3C9EE42A03F24868518880519216E52F154", "B0914B57985F2C98962248985AAF8BEE0B2CFA3D695BFC0ADF576FF0BA1C0D60", "B0A86AE748A5FEB5B28098C199E3AE109F5F415CD018723CC5E174C68579E28F", "B0BB62A87437C3256A2423E650B594B0E1BEE577A0150CB73D7A025781EA09D0", "B0FF85DCDE8644B3484BD6CF258480DD40154E7BDFEEDF7A128BF747F3AC618F", "B18D5054E957B0BB509173B6EEF80BE1D72536719F9318C5AE254CED7BFF903B", "B1B57F5A330A0F8314D286E1359121BECD0D54E3472AB670AF8B995354F514E5", "B236D3400A0C6106EC62C77931DC3654EEBAB6EEA563B3344ECFF477FD634E81", "B26820DB27A2FAA1ACA38AC50789692CF5EFEEBC3CBAF202DB49324399109A51", "B2BBD24C894F8D84E7500B060A120D423E9243FFB79A39BCAB9B279001C33A01", "B2CF752DFF3B011601B92047B2385142C0B5BC43D63F524444B6D4A034DA8902", "B315A585CDBD4D516E60AAEBBA49CDD9274D016108F5F855F13CF2FE3AA0F562", "B32575F43F0C7C8A19D29087C1F5ED02C42CB3C9C07BA541EAE33916454EC4A7", "B32A9F847E997ED597890C99F269D7C3A7DF6F439286500BE56CB08A839D04C7", "B36D4D104A4F6AABE76B2FD840B292FAFEABCFA232BB38EEB768F68D12E9D548", "B3795437971BBFF553B6A4E1067F15162BCF6961507ED86899C33084B3A1A74C", "B3B45E83BF6B33A0EB69850F973CD378A00F86B0910DCAFB7B4D94EAA2CBF764", "B43C19A7C3830FE0BD2A0DC67EEA1A869FB4BCDC9E39048C7D25BAD77DC3AA41", "B50B9BE403018768D4C035B30989AFFD92205B6D2E2D02F04B45D6745CD79C4F", "B5260521EFDA5B0F9F73A78BD2E58D783A90882A6B4D2635A4A67BA60AFFB731", "B547E4473646186969A14DFF0C2EB7D3D14D2E03EBA009074D6083D7482CB50F", "B554CBF7F930D8FC7B1ACFF0862C97C211B3CCA7A2E2C47D1463133E3A5FFE90", "B5810DD31544DECD338CCD71F5C05C78B267068FE3FD01928B5545B05BEE5FA0", "B5B313A73D0B335F18892EC4196F2ABB099764E6FF53E09B6A30800B58EACAB5", "B5B6C4769983441433B811EF3AAED6CFC993849D42BC924ECF1CCA5E34838148", "B6106E458DA90556891A5D5F936829A56B60C359EF9C7C9DDA8164ED83BA97E0", "B62071204643E59AD31EF38C3F1DA735EF11A4D940DEE816C67BC98D03AE1325", "B62A0DF1BA325616E310706F59A3DD07DD7DC7356D343963E6F99C6D89411ED3", "B65E10799869808B38D96576AA4BC705E6DCC5744AAC77554C2319CB82A9DE27", "B6D98686FB4CE3794F12AA810C56116765161F3CB64E9212B301423AF70BBA48", "B71073B981502D67E838F2BF5F311C34732473D300B51D77E56F9409BA85EE51", "B71DBB5A8F7BD5AC86F2A784871250C0CD636ED31A030553D5D9A0B4D39CED79", "B737A154F7C863B72C62E86E920DEDA62521A380DFA3489AD636FCBF39353BF0", "B73E2AC64919358B53CBFE9E0576F144ECF05CB1E42E5E59DCDDEF0BD5FEF485", "B74EC3F35403B9ADC0316F455F8787FA3BBAEBAC6BB8D78BC7A2D2DF403D4C4F", "B7A13FB33FCF20165BBA366C8F6B69286BA3919797513F5D1D731C55600F3ADA", "B7B1A8DAB1A897FBFE8F37F46B5A9BAA67F914F715D69E265E2F4E7D8FBB16AF", "B83340B4529723EEA9F866A215AC99571C734651CFCBB6BF0FB4B67B92BC7108", "B8C124EE4E419DE7F41A9CB0246E9FF21300C4C9A2734EF999830B9906B65133", "B8CB582AD4C9B18B3C5CCBAB5234D749FD3D0D9E37A5EF38D599A964E5AE80A1", "B9F14FDA85553B1CFC437ADD80AE8D3308F5F7116C42963946938CBE5C5EA56F", "BA385C300E1AB69708D8E5042F5220F275493E2AE45A5E3A1DD992DE1DAB492E", "BA73E99117987AEC14D1D3A635BC7C75F6DFC518BA6CEB579DE35BAD282D17DF", "BAB2E0DC26F99740EBA55A5A6C04FF38CD3CEA55D1AB1CDE43FBBFF3CFE6E7FC", "BADBDDC1B57091B8599CC7962BF6E7379B13BB622E4729B571298EDA81699BA2", "BAF43585A5ABFAA551BDE0DDB4AD7ECB0C42E21551DBFD52E1607957FAE4176A", "BAFE1432B61D78F2B29438C3606D2D46643F4DA3DFC6DD0FB0C4962ECD44C150", "BB06E8BD028B2DF581C4E507E45CF66921EDD872018812A67B8FFD9CD3141ABF", "BB645F2F67DDEFCDF7381A9AF56F998628C445D508AA5CE8B9F1A085A16618A9", "BBD0BB9278125E79B44348E7A6E2FDFBBE0FF4AC9E9184823B714AE94FCDD740", "BC559CFD82AD8F6E1AA3E69C2A2B00BC9FB0E3C8FAF083302CBDB8C389180014", "BD3B63F33CC91118E461E2718F7C98B27F79D4BF4FE7BC717AB3D1F8712CD498", "BD7A73E455E66D5CFA96118AEA67D2D6AE0C4F71C2A687744EE2C74CF48473C8", "BE28B80282A36EB5AE12EA4346DFDEB6572CBBFD3F23A4A31E09F4406B8F71BD", "BF241965E218490C5786B115CB2639A8CA788DC4170BC648A82E9FCC5A5AEBA4", "BF61B777185C336C66524D30F391CB1EF51AF98CD2CDED7536FFE153FF510014", "BF7E9956CA903746481D563F067E30FB7B1862A4E2D3506329A28C290170965C", "BFAB1EF8D38F9A76515AD06B662674DF3610CBF2129EE9786EAC5DCA6A2ED028", "BFC19961F4B2A71B650F919D0D8075421D25957A36A4487C121AAA7C17E478AF", "BFED984C4AC90049E453C5EE4856DEFB99854BEF39536654DE2F7E660AE77F5E", "C0349AAABFD1576263D75DDFC8EBEDBDBF9CBE04C997B8F00EF826B9D7C1793B", "C05E2240517FFF2005A6BDA1F7DCA435EC299EE68AE959C3A226E36A16D1F79D", "C06037486063080DAF0903578E651F281F08105507F07A61B0292AD4FC96B7DB", "C082626CB575BFA934FE4196087B2CBB2EBE141BF14771DE5FE31BEFA0092682", "C08849A00434A559EE1C5504DAE1CDDB28E9D46EDC400E95B2136AC317DFE7A3", "C0904FD149C70D8A2835DB923B2BF04803388EF83CB969D07F28836C567C672B", "C0BDB67449527274F6BF935813A76F827DBFB1EAD61444E49DD24177F6B0ABE0", "C0C635C3D1BDFFF4279719843730FED33753DFD9A52C5B43AE4A48433A539739", "C1043F35FF1F630A47D32A8195A08331316B4A0E682E22CCC64ED3A8793D1A86", "C10D490EE41AAB482030C937FAEA08C17545E6CBD518D468E37982A71F7BF915", "C185420FEBDF1AFB656CA109C8C54C33EE1654591BCC485592FC080838F903E5", "C19E2A2371245C58D6916C1D1AECE66CB9A9280820BE210299DFBBF834E66EE9", "C1B996429E90D30B8202EB4AB0F7D6C80E6527D79B2A9C84948FC3276C3AB463", "C1F769D030FC2C40F30870B89602B6E37C63D9738974975088F5749826F8EED3", "C2172119C7EA3C8DAF5775654958C15FAD557D43BF30EBA7616F82FFB6EA31E2", "C22253825FA485019FC06565D7E7D6C4103E0C10B6510212859354833FAEB242", "C24FC0AC8D85EF5DC9F9B16E958B393199BAB944CF9D124F438B95363F2AD89D", "C2726BD130D23521C84D9D0D3073BE4F38EB8B6A111BE67BAC0236E43B2D7924", "C344063A24F26576F4AB9509690D8FA6045C2058C006D2714A7404C5DE446721", "C38AFDD82BC77228F8D7DDBD5DE927E97F8C97D1E6B1F76B6C890149323EE9E7", "C3B05CDEF184BFD293F7EDCB8C5A430A32B9D04DDF8336E289D0609D021B85C2", "C3B567818F0068A4E76BF412FA5CD0354D004804480FA49A2095407B12E1C65E", "C43D2CB156B7BD39FC113EAD22568306F95463D3E29CC3A697EB085F142533BB", "C44E07EA5086C9BEBD0E896839F7E52E6DE1B379F604FBD6F4A29FB1A0D32827", "C514CDE322C9C5DBF8DE6E1B910BA4CF4DC54E59EA4A83F18DEADE1E2DA59F97", "C53E4A17B59FE138EBACA71C399669AC512D80E0D95F4A2578B807A669FCED81", "C554610A45CFB59FC9170B2C6DC1F2A4D4CC84198B97CDEDD371BDC99D66F824", "C584062FF02196D3513361FBB98104F5FA7514B1ABD5ECCA55D19C8B859E090E", "C5BECC1FF633D3A61CC27E6C697004609D2D53037AA1A203924F83717DF01AC2", "C5C3A875E50DB700220E26BE110391D11F736F71096D75C525AE9DDA14ABD8F7", "C602AE40F6974D4EE4D596F81D007D4F74282F20DC8B4859AE08925E2CE79326", "C620E533FFA4572A8A147EB0AA52BF2066886CC78F0AFA9232BBBF4E21B81BEB", "C633E3F919C9BCD1EAFB625FB054DC01CA44ECB316E9D13E7A22A44BF1FFF391", "C71A5DBCF370F048EB817F4959165CFDC0441EDB671093F1047A96EEA8FB7126", "C71DDFC63060CAC9DB6117AB095CFA4A88D16B5941EC25773ADD896BB601E27C", "C815D5BA0527F8CF454767B7D16A6B819AF9B998FAC3AFC2A63E79F6A57AD83A", "C826F1176449BFF5FE343AA4934EC17535CEB1F851490DC6C1AF590BE9A199A5", "C880E056FA204218A84A61C31DFC839867B32C5A7A216BBFF825B8013A446E7F", "C9DF9C64EA1901A4A73100734E733E276B2C17AF4A3093D142E5F13C918BC741", "C9E850DB690B1A0293E08649CBF2B802B99534172961D7E98006F68C604B9757", "CA6E62CB32AA91296638D9DAB5072711CB69A35615F7FC69D8B55BD25BE71F67", "CAAED4B9D717A8660FB48F1966B7523F78E0ED961F92395D260A9CE3B3CBFFC1", "CB6124223B6F8216BA9E92EAD6DAFC187E51AC4BEC28594EAEF38B28FCD5792F", "CBB581AC5D80B638C7627B6A6973FE321320C79B550AC39125687D95CDB8F7BE", "CC243740CD3B53A01DF4E651121A1CF73F8EEFC3E281BC9547CFF72915213611", "CC3CA2E6A057BD0C432A1C280BCDA473EAA13F9A6EA2532C58C5E8FD129BF2B1", "CC8B5EAED9F16E46FA900651589C00B568FED80DA1BF6B1F0CD9487C5E056E7C", "CCE2284A1DEFC26817EC9BCCD38DA7A3854365480FF9426304A46C0C98F30195", "CD7804E242E0AC135E8D90C5503ED7943F6CFFA170D1356421C6E06CC0FF9B92", "CD8271F1E3A620207AA3EAC35F944E1453EFEBC4728A88B9C3D9D0DA7F511F56", "CD88F065D65E9B6A3E092E1D1EF87D6DFE2162F7A545D98C779410B67DFAD1C0", "CD8ECA477B472E220ABA29FB5C44E5E90FEA01ECE1DF9C4117266D72CB75EE6E", "CDDC441D27E108C0C02A93DB9A7C32A887C12C059B5D2279EA48BF038E8D5170", "CE1EA8BD930C36AD90F7CB9A4D45A1E00F086D40B88449DF5CAD4F426F6C3DF7", "CE2C32923110950C9D013D80A09482A5900EB5D3115492E814259A25A326B42D", "CE775945F289BD36F1D2084FEABB7571C4F15F7453E6FB8935C6504A39748020", "CE7EFA1A3E604C6F25678505CC8FABC5CB819C691C6747E68755DE6B7F031791", "CE9B7DAE68B959C5E4A5F965424DF5CB00879B1AB1296B115DB9CB1B8ACD054F", "CED533E4EB11598F9E6D0F093FDDE6803F469CE6A51DDFBBBD206BD56C2B37AD", "CEE16EDAFB404DDF033F95C90CAC7DC93AC2A4F7F086C619B9F25A120A2D62C1", "CEF23955780B797D3E4DFF7B2586F5C1F6FE284FDC236FD6F838681B4A03628B", "CF40E075F0CA8C41C3924D8CAD12B7A9304B4AB57BABA03002EF8225FEFC457E", "CF49D3C68973180FF18BD6C75A4B377A56810C21E28DDDFFBFD24EC340BB8DA8", "CFCC0798CDF713DF824D5A326207194D6B958FDE4555B27C773AACA218FEDFBF", "CFD032C6816AA09BC4BFE927259D2C7496159BC447A779769DEB0DECC4952A56", "D054D1FB915BA204B059103047AE248EE28845425BAC252BCE0F9CFD4D129929", "D069D767BFDDACAF36F8AD8149748B1FB801641BF7495317DD2896BA6B1D2E26", "D073E08AD140CB6620590BE3498F8D2736D636AB608813B1FECA6FBC21280451", "D0934964E9B56702CBED525517F4EA576FF2F33A8BA6C800C34ECA9B7FE90236", "D10B18EC28A032EFEE6049343ECB3633CC65AE8BDF915EC68181989AB9170F54", "D11AB976F85F6CB2A151F18E4C7DCD45359DDB99578FE739D459AA7C71585CEB", "D15F96A6A2133C2CD625057126D31B71488849CB6D471551AF6177AE83F15B0E", "D194FB7EF290D4E0F3E7AA25B85D4FFB028593F0810EFCFD787E442CD3585600", "D1F05C061D240AD8360B87EECAB950152D239C029B4B05C21B639EAD69EF0917", "D21E913C6ADECF8EF09DE3D9AEE7C0E5E9B0753FDE5C8D754FBFEF41B5821AD7", "D222C68A9F9279A22A6D872628487DC4677D4BD829C33171CED7B9CDFF159C1B", "D259E621EF9ECC71F1E5CA25BD5CC4DDE78CFECBB5FC21F2E4BCB16169E0B602", "D27D7A3FAB54F4252945DE24C1BCEB0239D87CB0DB7641EF3375DE0B604D151D", "D28059E3586B0D388C9730F39F465209B85837647BDD3C8A062B83B83D85440D", "D2E48469AB3A6F2B1FEAEFDF00F68B8BC2F210C7E3BBABA5556DFDE4C6DB7ECD", "D2F45C96EB49AFC2B652E7D45AA056C9A181453656E766BAD269586E7F2C3CFB", "D39F14FCDE1086FB7EBEA7A5A5A8C0F54AA152309166564A023715A28EF4D479", "D3ED00EF6FDB857A7DDB990044338D6699A0B7C70D288C7BC0B9459A58DDCF76", "D44FF07C4CEEF1D8111D18A8384E2F0954F7C773B38780A9490BBF0C62A95618", "D4AEBE67AC1DF3FA618300CC05C01C82711D74D1E8BF32135D30AC7E3A5F6A0B", "D4C1C0E6A5170ECC8C7B3DFFE304FF401A904E8D9E1A70A203081EBBCDBE568F", "D4E5C893A250FEAE3B156BCBD1DEEF2119A50FFC25619BC8C5AF90EB197582DB", "D4F9AE28EA501CF2A176391E0E920E7B7FC3A2D7D8CE5319FAE6CA44DF5B1E04", "D511C9D021B86BEFA8C830C2B52729718C7F823FB40C97B0965AF032F29F6EDD", "D5919B6CD8669E3C1244D77D154E9ED92A7E8BDD6C207C135B98CD381580BDEE", "D5953B5AA5D620CA09590EAFE9008DB4A5BD219E8F43809D51B746D7643FA0F7", "D5A2AAF6AAB21EACC2A6F0566C16684CB493777C1E7DBE59B892CAE7784E438F", "D5EEF1A3A01D4305C8F18109F15322DB602BCD0222A59D7079DD112AB5E42473", "D5FC186AFDC475BF1011609D51599D9F4054E10263C52218648C49E2D757DF13", "D5FC516E557685CDE38A1C2C470F73080C33F28187E749A00C04F0812AFB9842", "D63678498B94CE4636F5CEB8FAB7C8F6F571F578E6D0EF1B23F011C3A5778E9E", "D66B903250F05C7E6F628063E46BB788B758ACF5470BDBDCE9A7DDCF98ED3362", "D69CAB0B695FDB3F4A13D03095C9000050A31CA1EEA0F9ED3CBD01DC6FA43F1A", "D6A278AD53F24F8C2A141B0CE86714271C028E265EA5E488D59254EE85EA8F0B", "D6F03E0612A845167F666CCA1A7409D6B9CBC3342DE65CEA3FBEC5E9C8EB6C09", "D73990C83DCEFEEFD942F2A50AF426AACD4F1D1610F51C8A150202D7B9EF03C6", "D755592724D4D2D085C0F8C6603BF802C8BF652DA20950835B7F98F62B82CB52", "D77134C81C99E57B976FD13B327D499D7859624EF6E1B9534595C21A83A1761B", "D783A7F4DFFB9905E79E357ACA80CE9623FFC55147AEC4BAF71DFFC0CC45C9F3", "D79603F84EDB3AB16673609548F6198DB4F8B1962AAC725B192C589BD03A1543", "D7F515C734A193A8414CDA4F549F64E410D1A829FDED3D62DB6397CA8582A6EE", "D82E9A8E624D2D7ED091F72D21B86BD1E1D17D89E3AEC4046D4D7622DEFAD2DC", "D866C66B6D8CD08D68CCBEE835296E1B00F1750F755972C9B9CD596BF7B8EC14", "D90AF9B69A6CEED389F4870575376E085360D40BED56E0CD22BBFF9EE7DF766D", "D9172969D61CF2C2B1320CAD15CAF5A2806FCA9580D5A6E5A2E2C98FF12E2386", "D92ADA90B46EC7B09898EB31D2D008827097E27BEC48AE4B2D1B9121A6F37C05", "D9D5040D7845BC6BA508A3B5BA57533835B6E213079001A65EC14663AE4836F8", "D9E06E5C382B357DD50008C0D277DB7D1B6D088C158C56C3D022303F1DFC00A4", "DA39104C275021EF88649293DFAF282637E8219443A30527A58A6E25E7ABA491", "DA78D22BE98AAE3FAE7595498C22303F728B4F1A787F6AA2950D1A2B51579024", "DAB438F8D94AE5409ECCFE0017FBD3CFD8AFE846AD46FE9CDA5B70E1A0536F43", "DAB88099018B311F83DAFDB9431625A326A00FF72BE126856DCECA1262D7C308", "DAD6E642502813DE6B9563D13D4513415BAE90E68BEF31D45DE8D7346CF0EF4B", "DB21F6160E03B6122C498B14479D8591179C3DBE218BCD893BF4F64F3154AC0A", "DB53C7C295FC394865150CA5853523B1FA54709666A98F3C90B7B2FA4539EF15", "DB54943495A8FD7FCEDD2A129EC7C679825DC7A6C44B3C3F07D955D60504D9B9", "DB866DC8DC23646847AE5E9E25C02B2DF2A195A414B2734DCAA102E637957BAF", "DC0307C89ADC9BDECEC60787C47BEC8B9B8EE78D2B6C0A47849682B1DA27D02F", "DC05F94C20E54530B22A0F7C5D47B16BEB79F796391043B6D8D2F3934DA6C247", "DC6227B5FADC6BCD577F4D87652F816B3EBA9EC54A04943E6907CA0B82BECA66", "DC81F676ADC49DC60232C3F5EE3AF5346FBE2B3367F097005D6FFBE810AE737D", "DD34B9BC3B107A1DC572E91FE164C11C4D3B050CFD5A53884C66DA680566DEB4", "DD464CE379B2EA45DB8FD5C1271CBEF5EA4164AAAFA4FB13859BABF4DFF16C6B", "DD5BF5116E5741EB672335643731F4B54ACDBD92F34C019A128C14DD0EF87E44", "DD71E3BE311976CFF7FE89F0916C7047300E0A1E779B1D8D85CA991081F0FBC3", "DDAE44367545E909F1C5E82BA6B48DEA1D51F717CEAE6CED7805AFEA883D85F1", "DE1F157EBE7E7F006D558032FBBEC2DAE20F24883C6F27F6FD7F815DB04E6D19", "DEAFA2DB54593AA80919E191E6F6089E8FC07DD6414224DF7420DF6F55DF4BC8", "DED899C681C4F01F658F5349E77058BDF8C51E88FADBC17AC63AAD856B4CADE5", "DF10251E3781DB89E977C04275F005CA31E770A1B5E3D3C3549F931A61FC1418", "DF191538C8CFADC9C4FBA779294B9A47AEEFD56EB05A6B7BA858EC03DB26B960", "DF4E8F31FE043E3CFA77E41A2F0CE2691BCEBF5ACB3B2A8B13BD91911951419D", "DF989094B08F10BFBA2DA2F5ED5CF27B371F00C6520140A5C25FA34A1EEA15E3", "DFA87ADFC0B6769943BB8C84BEB8FB12CB73A712711F9801958CCE3461EC87F4", "DFB2B8A17991C21AA572BC3D0FE7E4D2908FC84F553760CE8368AAFCE6C462AE", "DFB4A89370117A0C76AEBA610891449C199F7498B60521F9612F1A48A7736A6B", "DFEB027D63B2C15191EC1FDE8836EE3B8F24CFA4B42FE77E7E1820B6BBD77AC9", "E01E5A9EEAA961C6342F940CEB3A3C922598EBB771E6363B3C7DD8D9E7EB00FD", "E04842499BA6DBF5423B1C2D99E7E204D6DCA991703C7EF467D56949F4429941", "E0AC0F2CEF0686FD5D35D040E442195982E92EF98BDFD841F5F62D37D0337B68", "E19B380C2BF0F26DFDCBADD37C1B7D4A13ED463E7B4B4ECE7EEEC8895D5690CB", "E2269D81D607742C5A692E0D3385E0A29AEB1965018855BE83E715AB78A81A07", "E23E5E368C5384B3BD0EA1D29DE09B49CF49A5F44632E304B0A1EEC8896477FE", "E298AFAE6C10545EEFE2EDCB1E58ACEB81769C82FC173BB89206A046496B5501", "E31CD1CAA68AD6659A7C459337F50C896A6D30B1CC25BEF6FC361000F2ACE0D4", "E34369A48BDB40E3444EB1830AC8F91409460E39F5F36FFA5CED77D91880982A", "E390E6B49196DEE321C5FABB8A7629C142A3ADD51827A348DA8419915300DF61", "E3BE0799DEA3F58D624C8CDEDF6F8FEAB5E3D201D5834664B2CDCDDDB9696560", "E4141DD78AFBC22DDE732910F84CF4E67B4F57A1062C9D9AFC473A5AF4412618", "E4D093275B3398CF07F3141B553D072C5304E4F560EE4AEFD306FE5B5472E00B", "E55EB8027358DE1AD27E7050230C732BE83AEBE03071BD5119C4B597942CDB65", "E578CE4DAF2FBE99C4203EB828B722486AEC821D6455FE4F5421835E95A445E3", "E5BBCEF719E615994F1B258C759E10E101CC12EE74BBCBA1AFE726D5AFF29509", "E5F1D0335A0CBFDCB55C95D92928BF6FEC81AF498C0E92164C16CDE5E6175077", "E6075AA4421CDE4C93FB6FE776168FD888F3E662A7F0CD9B705035929B13694E", "E612F4D7E27D104E13DB1695ACEF1D5E49776CB4EEEF0FCFEBD6BD442F495DB8", "E652AD074D4537242E4F6F6865F5497FE3BCB4D68389AAE0D3EB706D9D1DD1ED", "E6BA604B1492E7F6EFDCD94835E66ECB288BCEDD1AA05178EE98F747118F067E", "E71D0560548030863DA0DA724D6C8D4AAF30E38869306D24B1FF9B5D29D4E879", "E741937E3B5774C60F53A6CA045ED9E4F22D4FF1BD6E4E553A2D0AEA6515F89B", "E7653A5862D76B5A32167F623532FE5567AFABF9A426F06C2CBA21BE4039657F", "E775C68CA18D51E91E688F1880BD5AF1955B5F4DF7397FA28CC721E37DAFB99A", "E77EC6F45B7D6E8BB278E220AB25F28DDD520313254120E5AA95ABE42DD9D030", "E7BF30E90642EA099BF91A02E679050FF4C2AFB516872D8D23F86F6D2BCEB123", "E80F93F1830733DC6AA9D050B812EB189DD5055F672DBCC2C388BCB26B8DFD3B", "E87F3414A66297B713460B2B1BDA99ECBFBDDC6C2F300994A235330AA2DCD160", "E8E3D041384B3A1C50DFC8E8DD6B7415911290515C88A2C292DAF367F018B0E7", "E8F51881DAE14FCDADA936B8D5D5F92A4EF77D876EFC3AA37A50B86D7AD4FB8C", "E9402FC09A28106AF2485DB38FE701AD9E89189CD8A1924DECD9BC2BFC341007", "E9B9B7401FFA2BAC5C90BAD2AC170F1256E360690435FBAD5A0DE8BF0C4F51E7", "E9F0B13DD28C1AFA3EA944A83A0281284C2444069758D5085ED5787CB960A8C5", "E9F3A90DA9806F4EB921B9D3B1386D06CBF6A6FC448F63739B13ABCC86AF0725", "EA52924E34BCC16950981552A3FA767720FFB0ABD2C4348121C16E9BA6BD4C80", "EA9BBDE42F62D694DFAC30E0A60158FD3093956B4C5DBB254A88FA4BA46B08D0", "EAC404329213DF471FF757B7F009DD8A087FC2C57793182718799AB73514DB48", "EB1E3BAAA3790C5434DD407DE16DF4DB1506F248646DC2F5660AF269CE6B6224", "EB3BC6E5AA9C35A0BC3BB5355A0D8D77754F14DB2BACD83BD7E0E154789DC4D0", "EB488D986A623E81C07D5F38DFFA754649938084B72DDAA698DEA6B41BB73C49", "EB58ABDFAA1D2A9C4F164D6FC9FD899843DF1F1028ECDA035A0F0C34CD298FAD", "EBCC12197854D7C444B518B80A223576FCB219A088A0CC929C19FF2993DC431A", "EC044A02B0E22A7ED1DD2C720609594A00EB70394CDCBBA50C26D4638B96FC53", "EC30ECD33C1F811F3DDDCB1144A3CDC460FF7F28E2EA9EEEF97940C06B1081DB", "EC68A07B2C3DAE1C815890F259C28E42A77D5A3444423C6A6324A3D881B16265", "ECEED5B9B0AC37EFF59F062DB93D98926977432CCFE14862CCF14B8AA65EE864", "ED11CF0606100E816592CB9CC87F176EF4BB64094BA5B7978B3810737572EBA4", "ED1E746B4A444761DF86B7BD074E2911879CE51C4CFBB278424F2A23E63071FA", "ED670677BEE7F824FAA4922AD08CFBF43478203FCCB636E589E6854737336228", "EDAF5143E634E5EF55D5C0186ECF166CE8CE37DFE44681979D15F0D7CA2DAFAD", "EDDFD9C9F69E868D387588CC82824ECFBEC0DB66320D5ABC990AA6EC8E61831B", "EDFA9D5968081EDE399774767050C178F730BD070533CFA73DE5F24F7E8E7A52", "EEA62F1E22625DD94DCCB0589595568778E3741F59D9567E915C46B8DCDFA74B", "EEE380D4251EC8087F70E591F9649F8F72DC3CEE1BB76652685094DC3531CA8D", "EF19812C84470AEB6A0CF3BBC9556CCFD28E143AA068E0296EE6333C41FEAE51", "EF2166DB5EE8BD87E1440D3823C327B8BCA46A3FD349720520FD40C591911F30", "EFD4687D2DC8ADFBEC960932263D6DA222DDFA92899BC72A9B9D62B4331178A6", "EFEF2244E948829C5D18D7E375890D878EF65279FF91004B2295614B4406FAED", "F000446708B91A19B1F61CA99B1AF67BFEB9C3B680087EEAA89007C8D02D6447", "F009B229BA58179FC3CB8F633C40E30BDC72B91C95C8FC1634F3C8FD8DBB7689", "F06557E676BEE33840ABDCBC8B63800AEF257D21E96813D19608264A0DF5ED04", "F06887354DDD94FE99CB5726F22BA14A5150601047429290A863F8F70CF6B6E5", "F0757274DB5D8329D95D7A6D4A3997DE0A00111E7975DD730038A4C7F5615F5B", "F0AFFAB5446BEF6A6B346CA7237A1583252E55B1EA002352E7DFDFFB5796363C", "F10B278BFBFA868C361722B3DE18CDFFBEA415174A88751DEB4AB93FA4D5705C", "F10FA6D57A7E8D9E7ABDCE22CFDA45519C923BEFD2EBE417EB91AA4039224559", "F15BA9EC0C1FC4624C7DDC90D046A7A3558B86CF13B121A8778B5BA8562491DC", "F20EBA7A0689DB668B37FACA282E3FE7571F9F27F133762737D368D5896FE46F", "F243281320AFD7E2710EDC7B3D2DE73901C6546A063CD6DB1074893EA50F7F8E", "F254C3744F2E067FA83481339C1DFF72F1FBE3805639579A8FD6B10E718E25D6", "F26EE38CBA6B93A0B0967DD4DF0B628E7EDCBF41134B0358C7BD18C0EBEC7F60", "F28901CFE45D1D428C63CC881FFA753E9073E21717B6E26FF45848C3370F2142", "F297EC4F54E9A52D87C421C1133596F830176F30E25F5BB642247122806285D8", "F3B0263B2CEB2CD2C7EC6BAC445071D5028F9C2CFB6E00675AFC9760F694A09E", "F41D64245E9C69CD04E556172E2468B18DD4D4D9EE33BE17C7EF278459123D5D", "F426BDEEA0109CBE44C73C53461CE7144BDD04ADCF7EC044CE76723EAE672095", "F43AC4AD74C202F4FEB76EA0BC3429642A773A92CA519668F55C67ABFA59AEB0", "F479B1D4D6CE6F94562BE83AEBC7D30E6633A6727AB24138B99039D7EB3AB70F", "F4ABE31B697DC0DAB590475AF9A100CB37651AB509405E419E8BB770A610D340", "F4AD67856A898B69A096AB9AB6B4F338381B13CD38018277B12F1DD7EEB59C84", "F4CE45326C2C511AAF8B1B3310EED8A2012F75D8C6BF2B84AB88A5C9BE1FD5F9", "F5CDE8C22C4BBC6BB7CBF97A440438D883CD649212412738F8629A2D4E07BCFD", "F5EB55E6DBF388E7CB6C76AFCD8A50A86C1FE6B41E6933749DC88EF56B7E408E", "F626B1C8DFCF6E27BABB7D9FEC40C88828FE8F0BBE4A01EE9B80C86023455567", "F65F1D96E364841337F0770420AA39E180E57CF181628F15C7259D9D9A9E8BDD", "F6BC10354A07CCD87F52BAC1053D9E1403CC47698D49BA1AAD057CE5C0DE00EB", "F7232359E6413A274B62C22CB7BF1EF8C428ADFBF22EF7B9B913D63D087BCACB", "F77ECBE728239B27998335805016034242537AEADE19138FD401815CAFC7269A", "F89D3081DA6B5CB2F4FF097D956A1B15C95A11155B2977DE948E9FE8ECD15A28", "F9733852E74294E6BF91BFC8E0D7790521726ED7E5FD3358C473AA92D450B69F", "F976E6D48149579C30755509014967F1B6A7163FEAAB9453EBE9572696C3DDDD", "F9ED99C3F4B2D868A3826BA34135EFCC7EF1978329C535488F23E6CF98DA913D", "FA35B92A299B675BEA0342A01E6C1F59FDC7A8D103D38B27A3E27A0758B36DC2", "FA430F75A8B2C54C0E67D5F1AB238F635A8361AED026C1C4932328820DB37999", "FA89B6D44984FD8BF5B85A9115F56D64823298A03FE2C6B955B0E10722A3D08A", "FA959A305942D2787EE3CC85907D22033D069840862DAABCDA48CD65E868084A", "FAD5EEE9FD5547B3BC0F26582580EC66DC6193FFFF5B317ECA1DEDB5F001336A", "FAFC46208E4120C5495519C990D13E107A71BC4A81E084F46909044B9A718F91", "FB0927F46BBC7E60E6230A2B01B6ED8A9E50C9E8B793A4DA7E11D6414BA796AC", "FBE12BC29F3A3EADBB97E99B4E5988968C5B939E5B4AB7F4DFF9DA89F73BBA04", "FC2BEDDC9B0A20E14CE30F6B90D14256565AADCC69A534CA0557D8F35594D108", "FC61ACAE0AB22E97FD911A75A9094C7517F5B67482635EEE91A119E450FC843D", "FCEDD547799AE384A4D749F6F180AE8594D14E825F787E185F25A3AC75A35F08", "FD0E85A6790A7A5E9E4ED07F7E069BEFCDF351251124844206CB202EC5DE5168", "FD769070DC8BB2EB714E9469886683E0B5018E711B2D3783310FE26D53451411", "FDA97DD243269D8176D4598B89F04D28DF3C51AA39B222AF75B2387650313DA7", "FDE1BF635D60EE0CA8051E326BCA1EFB7C7E659B969B5B079432E17D2860391E", "FE252D131D8F7560832F857A2E94C6660B4590940855E6B811C5BA4036C7A5C4", "FE290C07593DDFF4F7931CAAF905B7070C33FC48DAEC98D949841899598B4732", "FE6A60EA653FEE6F655EBB8429BCB70E7D54726EC0055ECB440856BF66B419CA", "FE6D95CEEFE9596CD6D6134F8326AB13E3C97D550B3E62F57DECDBDBC51C329A", "FE7DE370E3A053AC4CAFE02AD4DAD2A6486962E6E2E5C5CE8D6573A3EF4738DA", "FEA72A089D1755DA76737B39FD3BC90F9FC3011626C35A4FAFB48AD0A4D10189", "FED518F1BE68A68CF01E2CE3888B85890D717B12247E4C447108C458E733EDFA", "FED8F524B9C595CB0D81C78AF8662D74D0C7960F6749FC6424484CB55637033C", "FF4840FA7F2317CBB6130A281376F7290C3227EB77D653FDB8C95433F1FE2137", "FFBC52576800C9FC3197C8FA47DF866E69E5F102E05EC1AE0270835076990ED9", "FFBD74E0F454FF6A49CA3F34C7271269653B26F1B1272560F1EA3CC07A2021C8", "FFD6D3D41D634B5D48D3199200577D42176E711BC0D7D8AAC343534A1D33B0E6", "FFE6013EEC4286D4AB79EEEA772C3EE00D79F6B9C4BDBEBC75F053D02930A647"]}, {"type": "ics", "idList": ["ICSA-22-055-02", "ICSMA-20-184-01"]}, {"type": "impervablog", "idList": ["IMPERVABLOG:45FA8B88D226614CA46C4FD925A08C8B", "IMPERVABLOG:4F187FDBA230373382F26BA12E00F8E7"]}, {"type": "jvn", "idList": ["JVN:06527859", "JVN:19118282", "JVN:30962312", "JVN:42883072"]}, {"type": "kaspersky", "idList": ["KLA12436"]}, {"type": "kitploit", "idList": ["KITPLOIT:3050371869908791295", "KITPLOIT:5052987141331551837", "KITPLOIT:5420210148456420402", "KITPLOIT:6278364996548285306"]}, {"type": "mageia", "idList": ["MGASA-2013-0199", "MGASA-2014-0056", "MGASA-2014-0219", "MGASA-2014-0551", "MGASA-2016-0012", "MGASA-2016-0367", "MGASA-2019-0001", "MGASA-2019-0399", "MGASA-2020-0001", "MGASA-2021-0021", "MGASA-2021-0030", "MGASA-2021-0031", "MGASA-2021-0034", "MGASA-2021-0183", "MGASA-2021-0184", "MGASA-2021-0224", "MGASA-2021-0257", "MGASA-2021-0258", "MGASA-2021-0314", "MGASA-2021-0370", "MGASA-2021-0378", "MGASA-2021-0474", "MGASA-2021-0523", "MGASA-2021-0542", "MGASA-2022-0009", "MGASA-2022-0021", "MGASA-2022-0022", "MGASA-2022-0041", "MGASA-2022-0042"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:30F9B0094E0BC177A7D657BF67D87E39"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT-LINUX-HTTP-VMWARE_NSXMGR_XSTREAM_RCE_CVE_2021_39144-", "MSF:EXPLOIT-LINUX-LOCAL-VMWGFX_FD_PRIV_ESC-", "MSF:EXPLOIT-MULTI-HTTP-SPRING_FRAMEWORK_RCE_SPRING4SHELL-"]}, {"type": "mmpc", "idList": ["MMPC:07417E2EE012BAE0350B156AD2AE30B3", "MMPC:0FBB61490D4A94C83AEE14DDEE722297"]}, {"type": "msrc", "idList": ["MSRC:4016FF02733260CBC5200B5091666FD4", "MSRC:68FA6D02FA64FF61F41A7B1A8E364197", "MSRC:A49EE2D875C0E490BD326B3CDDB7399F"]}, {"type": "mssecure", "idList": ["MSSECURE:07417E2EE012BAE0350B156AD2AE30B3", "MSSECURE:0FBB61490D4A94C83AEE14DDEE722297"]}, {"type": "myhack58", "idList": ["MYHACK58:62201784367"]}, {"type": "nessus", "idList": ["9699.PRM", "9721.PASL", "9723.PASL", "ACTIVEMQ_5_15_5.NASL", "AL2022_ALAS2022-2022-037.NASL", "AL2022_ALAS2022-2022-044.NASL", "AL2022_ALAS2022-2022-047.NASL", "AL2022_ALAS2022-2022-233.NASL", "AL2_ALAS-2020-1395.NASL", "AL2_ALAS-2020-1519.NASL", "AL2_ALAS-2020-1566.NASL", "AL2_ALAS-2021-1593.NASL", "AL2_ALAS-2021-1645.NASL", "AL2_ALAS-2021-1685.NASL", "AL2_ALAS-2021-1690.NASL", "AL2_ALAS-2021-1698.NASL", "AL2_ALAS-2021-1718.NASL", "AL2_ALAS-2021-1726.NASL", "AL2_ALAS-2021-1729.NASL", "AL2_ALAS-2022-1749.NASL", "AL2_ALAS-2022-1752.NASL", "AL2_ALAS-2022-1753.NASL", "AL2_ALAS-2022-1761.NASL", "AL2_ALAS-2022-1821.NASL", "AL2_ALAS-2022-1835.NASL", "AL2_ALAS-2023-1946.NASL", "AL2_ALASJAVA-OPENJDK11-2023-003.NASL", "AL2_ALASKERNEL-5_10-2022-002.NASL", "AL2_ALASKERNEL-5_10-2022-009.NASL", "AL2_ALASKERNEL-5_10-2022-010.NASL", "AL2_ALASKERNEL-5_4-2022-004.NASL", "AL2_ALASKERNEL-5_4-2022-018.NASL", "AL2_ALASKERNEL-5_4-2022-021.NASL", "AL2_ALASKERNEL-5_4-2022-022.NASL", "ALA_ALAS-2013-169.NASL", "ALA_ALAS-2014-410.NASL", "ALA_ALAS-2015-618.NASL", "ALA_ALAS-2016-764.NASL", "ALA_ALAS-2020-1462.NASL", "ALA_ALAS-2021-1461.NASL", "ALA_ALAS-2022-1561.NASL", "ALA_ALAS-2022-1563.NASL", "ALA_ALAS-2022-1571.NASL", "ALA_ALAS-2022-1572.NASL", "ALA_ALAS-2022-1631.NASL", "ALA_ALAS-2022-1633.NASL", "ALA_ALAS-2023-1688.NASL", "ALMA_LINUX_ALSA-2020-4807.NASL", "ALMA_LINUX_ALSA-2021-1578.NASL", "ALMA_LINUX_ALSA-2021-3891.NASL", "ALMA_LINUX_ALSA-2021-3893.NASL", "ALMA_LINUX_ALSA-2021-4135.NASL", "ALMA_LINUX_ALSA-2021-4356.NASL", "ALMA_LINUX_ALSA-2022-0161.NASL", "ALMA_LINUX_ALSA-2022-0185.NASL", "ALMA_LINUX_ALSA-2022-0188.NASL", "ALMA_LINUX_ALSA-2022-0307.NASL", "ALMA_LINUX_ALSA-2022-1860.NASL", "ALMA_LINUX_ALSA-2022-1861.NASL", "ALMA_LINUX_ALSA-2022-1891.NASL", "ALMA_LINUX_ALSA-2022-1988.NASL", "AMAZON_CORRETTO_11_0_13_8_1.NASL", "AMAZON_CORRETTO_11_0_14_9_1.NASL", "AMAZON_CORRETTO_17_0_1_12_1.NASL", "AMAZON_CORRETTO_17_0_2_8_1.NASL", "AMAZON_CORRETTO_8_312_07_1.NASL", "AMAZON_CORRETTO_8_322_06_1.NASL", "AZUL_ZULU_17_30_16.NASL", "AZUL_ZULU_17_32_14.NASL", "CENTOS8_RHSA-2020-4670.NASL", "CENTOS8_RHSA-2020-4807.NASL", "CENTOS8_RHSA-2020-4847.NASL", "CENTOS8_RHSA-2021-1578.NASL", "CENTOS8_RHSA-2021-3891.NASL", "CENTOS8_RHSA-2021-3893.NASL", "CENTOS8_RHSA-2021-4135.NASL", "CENTOS8_RHSA-2021-4140.NASL", "CENTOS8_RHSA-2021-4356.NASL", "CENTOS8_RHSA-2022-0185.NASL", "CENTOS8_RHSA-2022-0307.NASL", "CENTOS8_RHSA-2022-0825.NASL", "CENTOS8_RHSA-2022-1860.NASL", "CENTOS8_RHSA-2022-1861.NASL", "CENTOS8_RHSA-2022-1891.NASL", "CENTOS_RHSA-2013-0270.NASL", "CENTOS_RHSA-2014-0474.NASL", "CENTOS_RHSA-2015-2521.NASL", "CENTOS_RHSA-2015-2522.NASL", "CENTOS_RHSA-2015-2671.NASL", "CENTOS_RHSA-2017-2247.NASL", "CENTOS_RHSA-2020-0194.NASL", "CENTOS_RHSA-2020-3936.NASL", "CENTOS_RHSA-2021-0162.NASL", "CENTOS_RHSA-2021-1354.NASL", "CENTOS_RHSA-2021-2683.NASL", "CENTOS_RHSA-2021-3889.NASL", "CENTOS_RHSA-2021-3892.NASL", "CENTOS_RHSA-2022-0063.NASL", "CENTOS_RHSA-2022-0204.NASL", "CENTOS_RHSA-2022-0620.NASL", "CISCO_CUCM_CSCUX34835.NASL", "CISCO_PRIME_LMS_JAVA_DESER.NASL", "CISCO_SECURITY_JAVA_DESER.NASL", "CLOUDBEES-SECURITY-ADVISORY-2021-12-01.NASL", "CLOUDBEES-SECURITY-ADVISORY-2022-02-09.NASL", "DEBIAN_DLA-1479.NASL", "DEBIAN_DLA-1896.NASL", "DEBIAN_DLA-2191.NASL", "DEBIAN_DLA-222.NASL", "DEBIAN_DLA-2405.NASL", "DEBIAN_DLA-2433.NASL", "DEBIAN_DLA-2471.NASL", "DEBIAN_DLA-2483.NASL", "DEBIAN_DLA-2494.NASL", "DEBIAN_DLA-2507.NASL", "DEBIAN_DLA-2595.NASL", "DEBIAN_DLA-2616.NASL", "DEBIAN_DLA-2689.NASL", "DEBIAN_DLA-2690.NASL", "DEBIAN_DLA-2704.NASL", "DEBIAN_DLA-2741.NASL", "DEBIAN_DLA-2767.NASL", "DEBIAN_DLA-2769.NASL", "DEBIAN_DLA-2814.NASL", "DEBIAN_DLA-2817.NASL", "DEBIAN_DLA-2917.NASL", "DEBIAN_DLA-2924.NASL", "DEBIAN_DLA-3160.NASL", "DEBIAN_DLA-57.NASL", "DEBIAN_DLA-728.NASL", "DEBIAN_DLA-729.NASL", "DEBIAN_DSA-2940.NASL", "DEBIAN_DSA-3720.NASL", "DEBIAN_DSA-3721.NASL", "DEBIAN_DSA-4772.NASL", "DEBIAN_DSA-4811.NASL", "DEBIAN_DSA-4828.NASL", "DEBIAN_DSA-5000.NASL", "DEBIAN_DSA-5004.NASL", "DEBIAN_DSA-5006.NASL", "DEBIAN_DSA-5010.NASL", "DEBIAN_DSA-5050.NASL", "DEBIAN_DSA-5057.NASL", "DEBIAN_DSA-5058.NASL", "DEBIAN_DSA-5092.NASL", "DEBIAN_DSA-5096.NASL", "DEBIAN_DSA-5265.NASL", "DELL_WYSE_MANAGEMENT_SUITE_DSA-2022-098.NASL", "EMC_NETWORKER_DSA-2022-350.NASL", "EULEROS_SA-2017-1191.NASL", "EULEROS_SA-2017-1192.NASL", "EULEROS_SA-2020-1596.NASL", "EULEROS_SA-2020-1677.NASL", "EULEROS_SA-2020-1799.NASL", "EULEROS_SA-2020-2102.NASL", "EULEROS_SA-2020-2485.NASL", "EULEROS_SA-2020-2498.NASL", "EULEROS_SA-2020-2514.NASL", "EULEROS_SA-2021-1039.NASL", "EULEROS_SA-2021-1604.NASL", "EULEROS_SA-2021-1642.NASL", "EULEROS_SA-2021-1684.NASL", "EULEROS_SA-2021-1858.NASL", "EULEROS_SA-2021-1967.NASL", "EULEROS_SA-2021-1971.NASL", "EULEROS_SA-2021-1983.NASL", "EULEROS_SA-2021-1990.NASL", "EULEROS_SA-2021-2040.NASL", "EULEROS_SA-2021-2051.NASL", "EULEROS_SA-2021-2062.NASL", "EULEROS_SA-2021-2075.NASL", "EULEROS_SA-2021-2140.NASL", "EULEROS_SA-2021-2233.NASL", "EULEROS_SA-2021-2336.NASL", "EULEROS_SA-2021-2392.NASL", "EULEROS_SA-2021-2437.NASL", "EULEROS_SA-2021-2453.NASL", "EULEROS_SA-2021-2502.NASL", "EULEROS_SA-2021-2530.NASL", "EULEROS_SA-2021-2588.NASL", "EULEROS_SA-2021-2651.NASL", "EULEROS_SA-2022-1010.NASL", "EULEROS_SA-2022-1169.NASL", "EULEROS_SA-2022-1171.NASL", "EULEROS_SA-2022-1197.NASL", "EULEROS_SA-2022-1208.NASL", "EULEROS_SA-2022-1281.NASL", "EULEROS_SA-2022-1376.NASL", "EULEROS_SA-2022-1429.NASL", "EULEROS_SA-2022-1450.NASL", "EULEROS_SA-2022-1489.NASL", "EULEROS_SA-2022-1508.NASL", "EULEROS_SA-2022-1523.NASL", "EULEROS_SA-2022-1537.NASL", "EULEROS_SA-2022-1555.NASL", "EULEROS_SA-2022-1571.NASL", "EULEROS_SA-2022-1592.NASL", "EULEROS_SA-2022-1607.NASL", "EULEROS_SA-2022-1630.NASL", "EULEROS_SA-2022-1647.NASL", "EULEROS_SA-2022-1661.NASL", "EULEROS_SA-2022-1703.NASL", "EULEROS_SA-2022-1732.NASL", "EULEROS_SA-2022-1733.NASL", "EULEROS_SA-2022-1735.NASL", "EULEROS_SA-2022-1756.NASL", "EULEROS_SA-2022-1772.NASL", "EULEROS_SA-2022-2026.NASL", "EULEROS_SA-2022-2054.NASL", "EULEROS_SA-2022-2528.NASL", "EULEROS_SA-2023-1081.NASL", "EULEROS_SA-2023-1346.NASL", "F5_BIGIP_SOL19785240.NASL", "F5_BIGIP_SOL24383845.NASL", "F5_BIGIP_SOL30518307.NASL", "F5_BIGIP_SOL44994972.NASL", "F5_BIGIP_SOL48382137.NASL", "FEDORA_2012-8428.NASL", "FEDORA_2012-8465.NASL", "FEDORA_2013-1189.NASL", "FEDORA_2013-1203.NASL", "FEDORA_2013-1289.NASL", "FEDORA_2013-5530.NASL", "FEDORA_2013-5546.NASL", "FEDORA_2013-5548.NASL", "FEDORA_2014-10691.NASL", "FEDORA_2014-10729.NASL", "FEDORA_2014-10746.NASL", "FEDORA_2014-9380.NASL", "FEDORA_2014-9539.NASL", "FEDORA_2014-9581.NASL", "FEDORA_2016-38E5B05260.NASL", "FEDORA_2016-4094BD4AD6.NASL", "FEDORA_2016-C1B01B9278.NASL", "FEDORA_2018-0C2141FCBC.NASL", "FEDORA_2018-1B7B0AD759.NASL", "FEDORA_2018-54A5BCC7E4.NASL", "FEDORA_2018-BF292E6CDF.NASL", "FEDORA_2018-CF918D73CC.NASL", "FEDORA_2018-D29BE920DC.NASL", "FEDORA_2018-DB8F322BB0.NASL", "FEDORA_2018-E4C2507720.NASL", "FEDORA_2018-E5A8B72D0D.NASL", "FEDORA_2019-79B5790566.NASL", "FEDORA_2019-BCAD44B5D6.NASL", "FEDORA_2019-C96A8D12B0.NASL", "FEDORA_2019-DA0EAC1EB6.NASL", "FEDORA_2020-23012FAFBC.NASL", "FEDORA_2021-8B17A2725E.NASL", "FEDORA_2021-DC83AE690A.NASL", "FREEBSD_PKG_0B0AD1961EE84A9889B14D5D82AF49A9.NASL", "FREEBSD_PKG_20006B5FA0BC11EB8AE6FC4DD43E2B6A.NASL", "FREEBSD_PKG_3AE106E2D52111E6AE1B002590263BF5.NASL", "FREEBSD_PKG_70E71A24015111ECBF0C080027EEDC6A.NASL", "FREEBSD_PKG_81FCC2F9E15A11E9ABBF800DD28B22BD.NASL", "FREEBSD_PKG_89D5BCA6015011ECBF0C080027EEDC6A.NASL", "GENTOO_GLSA-201607-09.NASL", "GENTOO_GLSA-202107-37.NASL", "GENTOO_GLSA-202107-52.NASL", "GENTOO_GLSA-202209-05.NASL", "GENTOO_GLSA-202211-04.NASL", "IBM_COGNOS_6828527.NASL", "IBM_JAVA_2022_01_18.NASL", "IBM_WEBSPHERE_XS_6598349.NASL", "JBOSS_JAVA_SERIALIZE.NASL", "JENKINS_2_334.NASL", "JFROG_ARTIFACTORY_6_23_0.NASL", "JFROG_ARTIFACTORY_6_23_1.NASL", "JFROG_ARTIFACTORY_7_10_1.NASL", "JFROG_ARTIFACTORY_7_10_5.NASL", "JIRA_8_18_0_JRASERVER-72669.NASL", "JUNIPER_SPACE_JSA_10838.NASL", "MANDRIVA_MDVSA-2014-095.NASL", "MANDRIVA_MDVSA-2015-141.NASL", "MYSQL_ENTERPRISE_MONITOR_3_1_6_7959.NASL", "MYSQL_ENTERPRISE_MONITOR_3_2_2_1075.NASL", "MYSQL_ENTERPRISE_MONITOR_8_0_23.NASL", "MYSQL_ENTERPRISE_MONITOR_8_0_27.NASL", "MYSQL_ENTERPRISE_MONITOR_8_0_30.NASL", "NEWSTART_CGSL_NS-SA-2020-0100_APACHE-COMMONS-BEANUTILS.NASL", "NEWSTART_CGSL_NS-SA-2021-0045_IPA.NASL", "NEWSTART_CGSL_NS-SA-2021-0095_XSTREAM.NASL", "NEWSTART_CGSL_NS-SA-2021-0108_XSTREAM.NASL", "NEWSTART_CGSL_NS-SA-2021-0171_IPA.NASL", "NEWSTART_CGSL_NS-SA-2021-0179_XSTREAM.NASL", "NEWSTART_CGSL_NS-SA-2022-0007_XSTREAM.NASL", "NEWSTART_CGSL_NS-SA-2022-0033_XSTREAM.NASL", "NEWSTART_CGSL_NS-SA-2022-0045_XSTREAM.NASL", "NEWSTART_CGSL_NS-SA-2022-0059_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2022-0080_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2022-0089_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2023-0001_KERNEL.NASL", "NEWSTART_CGSL_NS-SA-2023-0005_KERNEL.NASL", "NUTANIX_NXSA-AOS-5_20_3.NASL", "NUTANIX_NXSA-AOS-5_20_3_5.NASL", "NUTANIX_NXSA-AOS-5_20_3_6.NASL", "NUTANIX_NXSA-AOS-5_20_4.NASL", "NUTANIX_NXSA-AOS-5_20_5.NASL", "NUTANIX_NXSA-AOS-6_0_2_5.NASL", "NUTANIX_NXSA-AOS-6_0_2_6.NASL", "NUTANIX_NXSA-AOS-6_1.NASL", "NUTANIX_NXSA-AOS-6_1_1.NASL", "OPENJDK_2021-10-19.NASL", "OPENJDK_2022-01-18.NASL", "OPENSUSE-2013-161.NASL", "OPENSUSE-2013-304.NASL", "OPENSUSE-2013-305.NASL", "OPENSUSE-2016-1455.NASL", "OPENSUSE-2016-1456.NASL", "OPENSUSE-2019-2058.NASL", "OPENSUSE-2020-1906.NASL", "OPENSUSE-2020-2034.NASL", "OPENSUSE-2020-2112.NASL", "OPENSUSE-2020-2260.NASL", "OPENSUSE-2020-719.NASL", "OPENSUSE-2021-1115.NASL", "OPENSUSE-2021-1130.NASL", "OPENSUSE-2021-1357.NASL", "OPENSUSE-2021-1365.NASL", "OPENSUSE-2021-140.NASL", "OPENSUSE-2021-1401.NASL", "OPENSUSE-2021-1455.NASL", "OPENSUSE-2021-1480.NASL", "OPENSUSE-2021-1584.NASL", "OPENSUSE-2021-1840.NASL", "OPENSUSE-2021-1876.NASL", "OPENSUSE-2021-1975.NASL", "OPENSUSE-2021-1977.NASL", "OPENSUSE-2021-1995.NASL", "OPENSUSE-2021-2163.NASL", "OPENSUSE-2021-2305.NASL", "OPENSUSE-2021-2352.NASL", "OPENSUSE-2021-242.NASL", "OPENSUSE-2021-2575.NASL", "OPENSUSE-2021-2612.NASL", "OPENSUSE-2021-2637.NASL", "OPENSUSE-2021-2795.NASL", "OPENSUSE-2021-3338.NASL", "OPENSUSE-2021-3387.NASL", "OPENSUSE-2021-3447.NASL", "OPENSUSE-2021-3476.NASL", "OPENSUSE-2021-3615.NASL", "OPENSUSE-2021-3671.NASL", "OPENSUSE-2021-3758.NASL", "OPENSUSE-2021-3759.NASL", "OPENSUSE-2021-3762.NASL", "OPENSUSE-2021-3770.NASL", "OPENSUSE-2021-3876.NASL", "OPENSUSE-2021-4058.NASL", "OPENSUSE-2021-447.NASL", "OPENSUSE-2021-579.NASL", "OPENSUSE-2021-605.NASL", "OPENSUSE-2021-832.NASL", "OPENSUSE-2021-855.NASL", "OPENSUSE-2021-911.NASL", "OPENSUSE-2021-940.NASL", "OPENSUSE-2022-0363-1.NASL", "OPENSUSE-2022-0366-1.NASL", "OPENSUSE-2022-0370-1.NASL", "OPENSUSE-2022-0500-1.NASL", "OPENSUSE-2022-0503-1.NASL", "OPENSUSE-2022-0816-1.NASL", "OPENSUSE-2022-0817-1.NASL", "OPENSUSE-2022-0818-1.NASL", "OPENSUSE-2022-0870-1.NASL", "OPENSUSE-2022-0873-1.NASL", "OPENSUSE-2022-1027-1.NASL", "ORACLELINUX_ELSA-2013-0270.NASL", "ORACLELINUX_ELSA-2014-0474.NASL", "ORACLELINUX_ELSA-2015-2521.NASL", "ORACLELINUX_ELSA-2015-2522.NASL", "ORACLELINUX_ELSA-2015-2671.NASL", "ORACLELINUX_ELSA-2017-2247.NASL", "ORACLELINUX_ELSA-2020-0194.NASL", "ORACLELINUX_ELSA-2020-4807.NASL", "ORACLELINUX_ELSA-2020-5995.NASL", "ORACLELINUX_ELSA-2020-5996.NASL", "ORACLELINUX_ELSA-2021-0162.NASL", "ORACLELINUX_ELSA-2021-1354.NASL", "ORACLELINUX_ELSA-2021-1578.NASL", "ORACLELINUX_ELSA-2021-2683.NASL", "ORACLELINUX_ELSA-2021-3889.NASL", "ORACLELINUX_ELSA-2021-3891.NASL", "ORACLELINUX_ELSA-2021-3892.NASL", "ORACLELINUX_ELSA-2021-3893.NASL", "ORACLELINUX_ELSA-2021-3956.NASL", "ORACLELINUX_ELSA-2021-4135.NASL", "ORACLELINUX_ELSA-2021-4356.NASL", "ORACLELINUX_ELSA-2021-9404.NASL", "ORACLELINUX_ELSA-2021-9406.NASL", "ORACLELINUX_ELSA-2021-9450.NASL", "ORACLELINUX_ELSA-2021-9451.NASL", "ORACLELINUX_ELSA-2021-9458.NASL", "ORACLELINUX_ELSA-2021-9460.NASL", "ORACLELINUX_ELSA-2021-9485.NASL", "ORACLELINUX_ELSA-2021-9488.NASL", "ORACLELINUX_ELSA-2021-9534.NASL", "ORACLELINUX_ELSA-2022-0063.NASL", "ORACLELINUX_ELSA-2022-0161.NASL", "ORACLELINUX_ELSA-2022-0185.NASL", "ORACLELINUX_ELSA-2022-0188.NASL", "ORACLELINUX_ELSA-2022-0204.NASL", "ORACLELINUX_ELSA-2022-0306.NASL", "ORACLELINUX_ELSA-2022-0307.NASL", "ORACLELINUX_ELSA-2022-0620.NASL", "ORACLELINUX_ELSA-2022-0825.NASL", "ORACLELINUX_ELSA-2022-1860.NASL", "ORACLELINUX_ELSA-2022-1861.NASL", "ORACLELINUX_ELSA-2022-1891.NASL", "ORACLELINUX_ELSA-2022-1988.NASL", "ORACLELINUX_ELSA-2022-9010.NASL", "ORACLELINUX_ELSA-2022-9011.NASL", "ORACLELINUX_ELSA-2022-9012.NASL", "ORACLELINUX_ELSA-2022-9013.NASL", "ORACLELINUX_ELSA-2022-9014.NASL", "ORACLELINUX_ELSA-2022-9088.NASL", "ORACLELINUX_ELSA-2022-9141.NASL", "ORACLELINUX_ELSA-2022-9142.NASL", "ORACLELINUX_ELSA-2022-9147.NASL", "ORACLELINUX_ELSA-2022-9148.NASL", "ORACLELINUX_ELSA-2022-9179.NASL", "ORACLELINUX_ELSA-2022-9180.NASL", "ORACLELINUX_ELSA-2022-9244.NASL", "ORACLELINUX_ELSA-2022-9245.NASL", "ORACLELINUX_ELSA-2022-9260.NASL", "ORACLELINUX_ELSA-2022-9273.NASL", "ORACLELINUX_ELSA-2022-9274.NASL", "ORACLELINUX_ELSA-2022-9313.NASL", "ORACLELINUX_ELSA-2022-9314.NASL", "ORACLELINUX_ELSA-2022-9348.NASL", "ORACLELINUX_ELSA-2022-9781.NASL", "ORACLEVM_OVMSA-2021-0036.NASL", "ORACLEVM_OVMSA-2022-0005.NASL", "ORACLEVM_OVMSA-2022-0007.NASL", "ORACLEVM_OVMSA-2022-0011.NASL", "ORACLEVM_OVMSA-2022-0014.NASL", "ORACLE_BI_PUBLISHER_APR_2018_CPU.NASL", "ORACLE_BI_PUBLISHER_OAS_5_9_CPU_OCT_2022.NASL", "ORACLE_BI_PUBLISHER_OAS_CPU_JUL_2022.NASL", "ORACLE_BPM_CPU_APR_2022.NASL", "ORACLE_BPM_CPU_JAN_2021.NASL", "ORACLE_BPM_CPU_JAN_2022.NASL", "ORACLE_E-BUSINESS_CPU_APR_2021.NASL", "ORACLE_E-BUSINESS_CPU_JAN_2022.NASL", "ORACLE_E-BUSINESS_CPU_OCT_2022.NASL", "ORACLE_EDQ_OCT_2014_CPU.NASL", "ORACLE_ENTERPRISE_MANAGER_CPU_APR_2021.NASL", "ORACLE_ENTERPRISE_MANAGER_CPU_JUL_2021.NASL", "ORACLE_ENTERPRISE_MANAGER_JUL_2020_CPU.NASL", "ORACLE_ENTERPRISE_MANAGER_OPS_CENTER_CPU_OCT_2021_UI.NASL", "ORACLE_GOLDENGATE_CPU_OCT_2021.NASL", "ORACLE_GOLDENGATE_CPU_OCT_2022.NASL", "ORACLE_HTTP_SERVER_CPU_JAN_2018.NASL", "ORACLE_IDENTITY_MANAGEMENT_CPU_JAN_2018.NASL", "ORACLE_IDENTITY_MANAGEMENT_CPU_OCT_2014.NASL", "ORACLE_JAVA_CPU_JAN_2022.NASL", "ORACLE_JAVA_CPU_JAN_2022_UNIX.NASL", "ORACLE_JAVA_CPU_OCT_2021.NASL", "ORACLE_JAVA_CPU_OCT_2021_UNIX.NASL", "ORACLE_JDEVELOPER_CPU_JUL_2021.NASL", "ORACLE_NOSQL_CPU_APR_2021.NASL", "ORACLE_OAAM_CPU_OCT_2014.NASL", "ORACLE_OATS_CPU_APR_2016.NASL", "ORACLE_OATS_CPU_JAN_2020.NASL", "ORACLE_OATS_CPU_JAN_2021.NASL", "ORACLE_OATS_CPU_JUL_2021.NASL", "ORACLE_PRIMAVERA_GATEWAY_CPU_APR_2020.NASL", "ORACLE_PRIMAVERA_GATEWAY_CPU_JAN_2020.NASL", "ORACLE_PRIMAVERA_GATEWAY_CPU_JAN_2021.NASL", "ORACLE_PRIMAVERA_GATEWAY_CPU_JUL_2022.NASL", "ORACLE_PRIMAVERA_GATEWAY_CPU_OCT_2021.NASL", "ORACLE_PRIMAVERA_P6_EPPM_CPU_JAN_2021.NASL", "ORACLE_PRIMAVERA_P6_EPPM_CPU_JUL_2020.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_APR_2021.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_JAN_2020.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_JAN_2021.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_JAN_2022.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_JUL_2021.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_JUL_2022.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_OCT_2021.NASL", "ORACLE_PRIMAVERA_UNIFIER_CPU_OCT_2022.NASL", "ORACLE_RDBMS_CPU_APR_2022.NASL", "ORACLE_RDBMS_CPU_JUL_2020.NASL", "ORACLE_RDBMS_CPU_JUL_2021.NASL", "ORACLE_RDBMS_CPU_OCT_2021.NASL", "ORACLE_RDBMS_CPU_OCT_2022.NASL", "ORACLE_SECURE_GLOBAL_DESKTOP_APR_2017_CPU.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_APR_2020.NBIN", "ORACLE_WEBCENTER_PORTAL_CPU_APR_2021.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_APR_2022.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_JAN_2021.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_JUL_2020.NBIN", "ORACLE_WEBCENTER_PORTAL_CPU_JUL_2021.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_JUL_2022.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_OCT_2020.NBIN", "ORACLE_WEBCENTER_PORTAL_CPU_OCT_2021.NASL", "ORACLE_WEBCENTER_PORTAL_CPU_OCT_2022.NASL", "ORACLE_WEBCENTER_SITES_APR_2017_CPU.NASL", "ORACLE_WEBCENTER_SITES_CPU_APR_2022.NASL", "ORACLE_WEBCENTER_SITES_CPU_JAN_2023.NASL", "ORACLE_WEBCENTER_SITES_CPU_OCT_2022.NASL", "ORACLE_WEBCENTER_SITES_OCT_2021_CPU.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_APR_2020.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_APR_2021.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_APR_2022.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_JAN_2016.NBIN", "ORACLE_WEBLOGIC_SERVER_CPU_JAN_2020.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_JAN_2021.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_JAN_2022.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_JUL_2022.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_OCT_2014.NBIN", "ORACLE_WEBLOGIC_SERVER_CPU_OCT_2016.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_OCT_2021.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_OCT_2022.NASL", "ORACLE_WEBLOGIC_SERVER_CPU_OCT_2022_V14.NASL", "ORACLE_WEBLOGIC_SERVER_CVE_2015_4852.NBIN", "PHOTONOS_PHSA-2020-2_0-0295_LINUX.NASL", "PHOTONOS_PHSA-2020-3_0-0141_COMMONS.NASL", "PHOTONOS_PHSA-2020-3_0-0163_LINUX.NASL", "PHOTONOS_PHSA-2021-1_0-0418_APACHE.NASL", "PHOTONOS_PHSA-2021-2_0-0374_APACHE.NASL", "PHOTONOS_PHSA-2021-3_0-0243_LINUX.NASL", "PHOTONOS_PHSA-2021-3_0-0251_LINUX.NASL", "PHOTONOS_PHSA-2021-3_0-0274_APACHE.NASL", "PHOTONOS_PHSA-2021-3_0-0324_KAFKA.NASL", "PHOTONOS_PHSA-2021-4_0-0032_LINUX.NASL", "PHOTONOS_PHSA-2021-4_0-0041_LINUX.NASL", "PHOTONOS_PHSA-2021-4_0-0073_APACHE.NASL", "REDHAT-RHSA-2013-0270.NASL", "REDHAT-RHSA-2013-0680.NASL", "REDHAT-RHSA-2014-0224.NASL", "REDHAT-RHSA-2014-0474.NASL", "REDHAT-RHSA-2014-0500.NASL", "REDHAT-RHSA-2014-1162.NASL", "REDHAT-RHSA-2014-1320.NASL", "REDHAT-RHSA-2014-1321.NASL", "REDHAT-RHSA-2015-2500.NASL", "REDHAT-RHSA-2015-2521.NASL", "REDHAT-RHSA-2015-2522.NASL", "REDHAT-RHSA-2015-2535.NASL", "REDHAT-RHSA-2015-2536.NASL", "REDHAT-RHSA-2015-2538.NASL", "REDHAT-RHSA-2015-2539.NASL", "REDHAT-RHSA-2015-2540.NASL", "REDHAT-RHSA-2015-2542.NASL", "REDHAT-RHSA-2015-2671.NASL", "REDHAT-RHSA-2016-1773.NASL", "REDHAT-RHSA-2017-0455.NASL", "REDHAT-RHSA-2017-0456.NASL", "REDHAT-RHSA-2017-1548.NASL", "REDHAT-RHSA-2017-1549.NASL", "REDHAT-RHSA-2017-1550.NASL", "REDHAT-RHSA-2017-1552.NASL", "REDHAT-RHSA-2017-2247.NASL", "REDHAT-RHSA-2018-2423.NASL", "REDHAT-RHSA-2018-2424.NASL", "REDHAT-RHSA-2018-2643.NASL", "REDHAT-RHSA-2018-2741.NASL", "REDHAT-RHSA-2018-2743.NASL", "REDHAT-RHSA-2018-2927.NASL", "REDHAT-RHSA-2019-2935.NASL", "REDHAT-RHSA-2019-2936.NASL", "REDHAT-RHSA-2019-2937.NASL", "REDHAT-RHSA-2019-3023.NASL", "REDHAT-RHSA-2019-3024.NASL", "REDHAT-RHSA-2020-0057.NASL", "REDHAT-RHSA-2020-0194.NASL", "REDHAT-RHSA-2020-0804.NASL", "REDHAT-RHSA-2020-0805.NASL", "REDHAT-RHSA-2020-0806.NASL", "REDHAT-RHSA-2020-1308.NASL", "REDHAT-RHSA-2020-1454.NASL", "REDHAT-RHSA-2020-2740.NASL", "REDHAT-RHSA-2020-3461.NASL", "REDHAT-RHSA-2020-3462.NASL", "REDHAT-RHSA-2020-3463.NASL", "REDHAT-RHSA-2020-3637.NASL", "REDHAT-RHSA-2020-3638.NASL", "REDHAT-RHSA-2020-3639.NASL", "REDHAT-RHSA-2020-3936.NASL", "REDHAT-RHSA-2020-4274.NASL", "REDHAT-RHSA-2020-4670.NASL", "REDHAT-RHSA-2020-4807.NASL", "REDHAT-RHSA-2020-4847.NASL", "REDHAT-RHSA-2020-5571.NASL", "REDHAT-RHSA-2021-0162.NASL", "REDHAT-RHSA-2021-0246.NASL", "REDHAT-RHSA-2021-0247.NASL", "REDHAT-RHSA-2021-0248.NASL", "REDHAT-RHSA-2021-0872.NASL", "REDHAT-RHSA-2021-0873.NASL", "REDHAT-RHSA-2021-0874.NASL", "REDHAT-RHSA-2021-1354.NASL", "REDHAT-RHSA-2021-1578.NASL", "REDHAT-RHSA-2021-1739.NASL", "REDHAT-RHSA-2021-2046.NASL", "REDHAT-RHSA-2021-2047.NASL", "REDHAT-RHSA-2021-2048.NASL", "REDHAT-RHSA-2021-2683.NASL", "REDHAT-RHSA-2021-2718.NASL", "REDHAT-RHSA-2021-2719.NASL", "REDHAT-RHSA-2021-3466.NASL", "REDHAT-RHSA-2021-3467.NASL", "REDHAT-RHSA-2021-3468.NASL", "REDHAT-RHSA-2021-3656.NASL", "REDHAT-RHSA-2021-3658.NASL", "REDHAT-RHSA-2021-3884.NASL", "REDHAT-RHSA-2021-3885.NASL", "REDHAT-RHSA-2021-3886.NASL", "REDHAT-RHSA-2021-3887.NASL", "REDHAT-RHSA-2021-3889.NASL", "REDHAT-RHSA-2021-3891.NASL", "REDHAT-RHSA-2021-3892.NASL", "REDHAT-RHSA-2021-3893.NASL", "REDHAT-RHSA-2021-3956.NASL", "REDHAT-RHSA-2021-4135.NASL", "REDHAT-RHSA-2021-4140.NASL", "REDHAT-RHSA-2021-4356.NASL", "REDHAT-RHSA-2021-4676.NASL", "REDHAT-RHSA-2021-4677.NASL", "REDHAT-RHSA-2021-4702.NASL", "REDHAT-RHSA-2021-5149.NASL", "REDHAT-RHSA-2021-5150.NASL", "REDHAT-RHSA-2021-5151.NASL", "REDHAT-RHSA-2021-5179.NASL", "REDHAT-RHSA-2021-5197.NASL", "REDHAT-RHSA-2022-0063.NASL", "REDHAT-RHSA-2022-0065.NASL", "REDHAT-RHSA-2022-0072.NASL", "REDHAT-RHSA-2022-0078.NASL", "REDHAT-RHSA-2022-0151.NASL", "REDHAT-RHSA-2022-0152.NASL", "REDHAT-RHSA-2022-0161.NASL", "REDHAT-RHSA-2022-0176.NASL", "REDHAT-RHSA-2022-0185.NASL", "REDHAT-RHSA-2022-0186.NASL", "REDHAT-RHSA-2022-0187.NASL", "REDHAT-RHSA-2022-0188.NASL", "REDHAT-RHSA-2022-0204.NASL", "REDHAT-RHSA-2022-0209.NASL", "REDHAT-RHSA-2022-0211.NASL", "REDHAT-RHSA-2022-0231.NASL", "REDHAT-RHSA-2022-0232.NASL", "REDHAT-RHSA-2022-0233.NASL", "REDHAT-RHSA-2022-0304.NASL", "REDHAT-RHSA-2022-0305.NASL", "REDHAT-RHSA-2022-0306.NASL", "REDHAT-RHSA-2022-0307.NASL", "REDHAT-RHSA-2022-0312.NASL", "REDHAT-RHSA-2022-0335.NASL", "REDHAT-RHSA-2022-0344.NASL", "REDHAT-RHSA-2022-0529.NASL", "REDHAT-RHSA-2022-0530.NASL", "REDHAT-RHSA-2022-0531.NASL", "REDHAT-RHSA-2022-0533.NASL", "REDHAT-RHSA-2022-0540.NASL", "REDHAT-RHSA-2022-0590.NASL", "REDHAT-RHSA-2022-0592.NASL", "REDHAT-RHSA-2022-0620.NASL", "REDHAT-RHSA-2022-0622.NASL", "REDHAT-RHSA-2022-0629.NASL", "REDHAT-RHSA-2022-0636.NASL", "REDHAT-RHSA-2022-0712.NASL", "REDHAT-RHSA-2022-0718.NASL", "REDHAT-RHSA-2022-0722.NASL", "REDHAT-RHSA-2022-0771.NASL", "REDHAT-RHSA-2022-0772.NASL", "REDHAT-RHSA-2022-0777.NASL", "REDHAT-RHSA-2022-0819.NASL", "REDHAT-RHSA-2022-0820.NASL", "REDHAT-RHSA-2022-0821.NASL", "REDHAT-RHSA-2022-0823.NASL", "REDHAT-RHSA-2022-0825.NASL", "REDHAT-RHSA-2022-0841.NASL", "REDHAT-RHSA-2022-0849.NASL", "REDHAT-RHSA-2022-0851.NASL", "REDHAT-RHSA-2022-0925.NASL", "REDHAT-RHSA-2022-0958.NASL", "REDHAT-RHSA-2022-0968.NASL", "REDHAT-RHSA-2022-0969.NASL", "REDHAT-RHSA-2022-0970.NASL", "REDHAT-RHSA-2022-1103.NASL", "REDHAT-RHSA-2022-1104.NASL", "REDHAT-RHSA-2022-1106.NASL", "REDHAT-RHSA-2022-1107.NASL", "REDHAT-RHSA-2022-1263.NASL", "REDHAT-RHSA-2022-1324.NASL", "REDHAT-RHSA-2022-1373.NASL", "REDHAT-RHSA-2022-1417.NASL", "REDHAT-RHSA-2022-1420.NASL", "REDHAT-RHSA-2022-1860.NASL", "REDHAT-RHSA-2022-1861.NASL", "REDHAT-RHSA-2022-1891.NASL", "REDHAT-RHSA-2022-1975.NASL", "REDHAT-RHSA-2022-1988.NASL", "REDHAT-RHSA-2022-4918.NASL", "REDHAT-RHSA-2022-4919.NASL", "REDHAT-RHSA-2022-5555.NASL", "REDHAT-RHSA-2022-6393.NASL", "REDHAT-RHSA-2022-7272.NASL", "REDHAT-RHSA-2022-8848.NASL", "REDHAT-RHSA-2023-0552.NASL", "REDHAT-RHSA-2023-0553.NASL", "REDHAT-RHSA-2023-0554.NASL", "ROCKY_LINUX_RLSA-2021-4140.NASL", "ROCKY_LINUX_RLSA-2021-4356.NASL", "ROCKY_LINUX_RLSA-2022-161.NASL", "ROCKY_LINUX_RLSA-2022-176.NASL", "ROCKY_LINUX_RLSA-2022-185.NASL", "ROCKY_LINUX_RLSA-2022-188.NASL", "ROCKY_LINUX_RLSA-2022-1975.NASL", "ROCKY_LINUX_RLSA-2022-1988.NASL", "ROCKY_LINUX_RLSA-2022-307.NASL", "ROCKY_LINUX_RLSA-2022-819.NASL", "ROCKY_LINUX_RLSA-2022-825.NASL", "SECURITYCENTER_5_19_0_TNS_2021_08_XSS.NASL", "SECURITYCENTER_5_19_0_TNS_2021_14.NASL", "SLACKWARE_SSA_2021-202-01.NASL", "SLACKWARE_SSA_2022-031-01.NASL", "SL_20130219_JAKARTA_COMMONS_HTTPCLIENT_ON_SL5_X.NASL", "SL_20140507_STRUTS_ON_SL5_X.NASL", "SL_20151130_APACHE_COMMONS_COLLECTIONS_ON_SL7_X.NASL", "SL_20151130_JAKARTA_COMMONS_COLLECTIONS_ON_SL6_X.NASL", "SL_20151221_JAKARTA_COMMONS_COLLECTIONS_ON_SL5_X.NASL", "SL_20170802_TOMCAT_ON_SL7_X.NASL", "SL_20200121_APACHE_COMMONS_BEANUTILS_ON_SL7_X.NASL", "SL_20201001_IPA_ON_SL7_X.NASL", "SL_20210119_XSTREAM_ON_SL7_X.NASL", "SL_20210712_XSTREAM_ON_SL7_X.NASL", "SL_20211020_JAVA_11_OPENJDK_ON_SL7_X.NASL", "SL_20211020_JAVA_1_8_0_OPENJDK_ON_SL7_X.NASL", "SL_20211025_XSTREAM_ON_SL7_X.NASL", "SL_20220114_KERNEL_ON_SL7_X.NASL", "SL_20220124_JAVA_11_OPENJDK_ON_SL7_X.NASL", "SL_20220127_JAVA_1_8_0_OPENJDK_ON_SL7_X.NASL", "SL_20220223_KERNEL_ON_SL7_X.NASL", "SOLARIS11_ANT_20130430.NASL", "SPRING4SHELL.NBIN", "SPRING_CVE-2022-22950.NASL", "SPRING_CVE-2022-22965_LOCAL.NASL", "STRUTS_CLASSLOADER_MANIPULATION.NASL", "SUN_JAVA_WEB_SERVER_7_0_27.NASL", "SUSE_SU-2020-3507-1.NASL", "SUSE_SU-2020-3513-1.NASL", "SUSE_SU-2020-3522-1.NASL", "SUSE_SU-2020-3532-1.NASL", "SUSE_SU-2020-3544-1.NASL", "SUSE_SU-2020-3715-1.NASL", "SUSE_SU-2020-3717-1.NASL", "SUSE_SU-2020-3748-1.NASL", "SUSE_SU-2021-1238-1.NASL", "SUSE_SU-2021-14724-1.NASL", "SUSE_SU-2021-1572-1.NASL", "SUSE_SU-2021-1573-1.NASL", "SUSE_SU-2021-1595-1.NASL", "SUSE_SU-2021-1596-1.NASL", "SUSE_SU-2021-1617-1.NASL", "SUSE_SU-2021-1623-1.NASL", "SUSE_SU-2021-1624-1.NASL", "SUSE_SU-2021-1865-1.NASL", "SUSE_SU-2021-1870-1.NASL", "SUSE_SU-2021-1876-1.NASL", "SUSE_SU-2021-1975-1.NASL", "SUSE_SU-2021-1977-1.NASL", "SUSE_SU-2021-1995-1.NASL", "SUSE_SU-2021-2163-1.NASL", "SUSE_SU-2021-2198-1.NASL", "SUSE_SU-2021-2303-1.NASL", "SUSE_SU-2021-2305-1.NASL", "SUSE_SU-2021-2325-1.NASL", "SUSE_SU-2021-2352-1.NASL", "SUSE_SU-2021-2426-1.NASL", "SUSE_SU-2021-2564-1.NASL", "SUSE_SU-2021-2577-1.NASL", "SUSE_SU-2021-2612-1.NASL", "SUSE_SU-2021-2636-1.NASL", "SUSE_SU-2021-2637-1.NASL", "SUSE_SU-2021-2638-1.NASL", "SUSE_SU-2021-2795-1.NASL", "SUSE_SU-2021-3337-1.NASL", "SUSE_SU-2021-3338-1.NASL", "SUSE_SU-2021-3339-1.NASL", "SUSE_SU-2021-3360-1.NASL", "SUSE_SU-2021-3361-1.NASL", "SUSE_SU-2021-3371-1.NASL", "SUSE_SU-2021-3374-1.NASL", "SUSE_SU-2021-3386-1.NASL", "SUSE_SU-2021-3387-1.NASL", "SUSE_SU-2021-3388-1.NASL", "SUSE_SU-2021-3389-1.NASL", "SUSE_SU-2021-3401-1.NASL", "SUSE_SU-2021-3415-1.NASL", "SUSE_SU-2021-3440-1.NASL", "SUSE_SU-2021-3443-1.NASL", "SUSE_SU-2021-3447-1.NASL", "SUSE_SU-2021-3459-1.NASL", "SUSE_SU-2021-3476-1.NASL", "SUSE_SU-2021-3528-1.NASL", "SUSE_SU-2021-3671-1.NASL", "SUSE_SU-2021-3684-1.NASL", "SUSE_SU-2021-3710-1.NASL", "SUSE_SU-2021-3735-1.NASL", "SUSE_SU-2021-3737-1.NASL", "SUSE_SU-2021-3738-1.NASL", "SUSE_SU-2021-3751-1.NASL", "SUSE_SU-2021-3755-1.NASL", "SUSE_SU-2021-3757-1.NASL", "SUSE_SU-2021-3758-1.NASL", "SUSE_SU-2021-3759-1.NASL", "SUSE_SU-2021-3760-1.NASL", "SUSE_SU-2021-3761-1.NASL", "SUSE_SU-2021-3762-1.NASL", "SUSE_SU-2021-3770-1.NASL", "SUSE_SU-2021-3771-1.NASL", "SUSE_SU-2021-3876-1.NASL", "SUSE_SU-2021-3929-1.NASL", "SUSE_SU-2021-3935-1.NASL", "SUSE_SU-2021-3969-1.NASL", "SUSE_SU-2021-3972-1.NASL", "SUSE_SU-2021-4058-1.NASL", "SUSE_SU-2022-0362-1.NASL", "SUSE_SU-2022-0363-1.NASL", "SUSE_SU-2022-0364-1.NASL", "SUSE_SU-2022-0365-1.NASL", "SUSE_SU-2022-0366-1.NASL", "SUSE_SU-2022-0367-1.NASL", "SUSE_SU-2022-0370-1.NASL", "SUSE_SU-2022-0371-1.NASL", "SUSE_SU-2022-0372-1.NASL", "SUSE_SU-2022-0477-1.NASL", "SUSE_SU-2022-0500-1.NASL", "SUSE_SU-2022-0503-1.NASL", "SUSE_SU-2022-0542-1.NASL", "SUSE_SU-2022-0543-1.NASL", "SUSE_SU-2022-0544-1.NASL", "SUSE_SU-2022-0555-1.NASL", "SUSE_SU-2022-0694-1.NASL", "SUSE_SU-2022-0695-1.NASL", "SUSE_SU-2022-0730-1.NASL", "SUSE_SU-2022-0784-1.NASL", "SUSE_SU-2022-0816-1.NASL", "SUSE_SU-2022-0817-1.NASL", "SUSE_SU-2022-0818-1.NASL", "SUSE_SU-2022-0871-1.NASL", "SUSE_SU-2022-0873-1.NASL", "SUSE_SU-2022-1025-1.NASL", "SUSE_SU-2022-1026-1.NASL", "SUSE_SU-2022-1027-1.NASL", "SUSE_SU-2022-1172-1.NASL", "SUSE_SU-2022-1189-1.NASL", "SUSE_SU-2022-1193-1.NASL", "SUSE_SU-2022-1194-1.NASL", "SUSE_SU-2022-1212-1.NASL", "SUSE_SU-2022-1223-1.NASL", "SUSE_SU-2022-1242-1.NASL", "SUSE_SU-2022-1246-1.NASL", "SUSE_SU-2022-1265-1.NASL", "SUSE_SU-2022-1278-1.NASL", "SUSE_SU-2022-1417-1.NASL", "SUSE_SU-2022-1418-1.NASL", "SUSE_SU-2022-14889-1.NASL", "SUSE_SU-2022-14905-1.NASL", "SUSE_SU-2022-14927-1.NASL", "SUSE_SU-2022-1569-1.NASL", "SUSE_SU-2022-1575-1.NASL", "SUSE_SU-2022-1580-1.NASL", "SUSE_SU-2022-1589-1.NASL", "SUSE_SU-2022-1591-1.NASL", "SUSE_SU-2022-1593-1.NASL", "SUSE_SU-2022-1605-1.NASL", "SUSE_SU-2022-1637-1.NASL", "SUSE_SU-2022-1640-1.NASL", "SUSE_SU-2022-2111-1.NASL", "SUSE_SU-2022-2893-1.NASL", "SUSE_SU-2022-2958-1.NASL", "SUSE_SU-2022-3264-1.NASL", "SUSE_SU-2022-3397-1.NASL", "SUSE_SU-2022-3450-1.NASL", "SUSE_SU-2022-3609-1.NASL", "SUSE_SU-2022-3809-1.NASL", "SUSE_SU-2022-3922-1.NASL", "SYNAPSE_3_0_0.NASL", "TOMCAT_10_0_16.NASL", "TOMCAT_10_0_20.NASL", "TOMCAT_10_1_0_M10.NASL", "TOMCAT_8_5_5.NASL", "TOMCAT_8_5_75.NASL", "TOMCAT_8_5_78.NASL", "TOMCAT_9_0_58.NASL", "TOMCAT_9_0_62.NASL", "UBUNTU_USN-2769-1.NASL", "UBUNTU_USN-3177-1.NASL", "UBUNTU_USN-3177-2.NASL", "UBUNTU_USN-4557-1.NASL", "UBUNTU_USN-4575-1.NASL", "UBUNTU_USN-4679-1.NASL", "UBUNTU_USN-4710-1.NASL", "UBUNTU_USN-4711-1.NASL", "UBUNTU_USN-4714-1.NASL", "UBUNTU_USN-4751-1.NASL", "UBUNTU_USN-4752-1.NASL", "UBUNTU_USN-4943-1.NASL", "UBUNTU_USN-5015-1.NASL", "UBUNTU_USN-5044-1.NASL", "UBUNTU_USN-5045-1.NASL", "UBUNTU_USN-5046-1.NASL", "UBUNTU_USN-5050-1.NASL", "UBUNTU_USN-5095-1.NASL", "UBUNTU_USN-5136-1.NASL", "UBUNTU_USN-5145-1.NASL", "UBUNTU_USN-5202-1.NASL", "UBUNTU_USN-5265-1.NASL", "UBUNTU_USN-5267-1.NASL", "UBUNTU_USN-5267-3.NASL", "UBUNTU_USN-5268-1.NASL", "UBUNTU_USN-5278-1.NASL", "UBUNTU_USN-5294-1.NASL", "UBUNTU_USN-5294-2.NASL", "UBUNTU_USN-5295-1.NASL", "UBUNTU_USN-5295-2.NASL", "UBUNTU_USN-5297-1.NASL", "UBUNTU_USN-5298-1.NASL", "UBUNTU_USN-5299-1.NASL", "UBUNTU_USN-5313-1.NASL", "UBUNTU_USN-5343-1.NASL", "UBUNTU_USN-5362-1.NASL", "UBUNTU_USN-5505-1.NASL", "UBUNTU_USN-5525-1.NASL", "UBUNTU_USN-5765-1.NASL", "UBUNTU_USN-5884-1.NASL", "VMWARE_MULTIPLE_VMSA_2008_0008.NASL", "VMWARE_NSX_FOR_VSPHERE_6_4_14.NASL", "VMWARE_VCENTER_VMSA-2014-0008.NASL", "VMWARE_VMSA-2014-0008.NASL", "WEBLOGIC_2015_4852.NASL", "WEBSPHERE_1115085.NASL", "WEBSPHERE_6453091.NASL", "WEBSPHERE_6_1_0_47.NASL", "WEBSPHERE_711865.NASL", "WEBSPHERE_711867.NASL", "WEBSPHERE_7_0_0_31.NASL", "WEBSPHERE_7_0_0_33.NASL", "WEBSPHERE_8_0_0_7.NASL", "WEBSPHERE_8_5_5_1.NASL", "WEBSPHERE_PORTAL_7_0_0_2_CF29.NASL", "WEBSPHERE_PORTAL_8_5_0_0_CF02.NASL", "WEBSPHERE_PORTAL_CVE-2014-0114.NASL", "WEB_APPLICATION_SCANNING_112374", "WEB_APPLICATION_SCANNING_112375", "WEB_APPLICATION_SCANNING_112376", "WEB_APPLICATION_SCANNING_113129", "WEB_APPLICATION_SCANNING_113130", "WEB_APPLICATION_SCANNING_113131", "WEB_APPLICATION_SCANNING_113132", "WEB_APPLICATION_SCANNING_113217"]}, {"type": "nodejs", "idList": ["NODEJS:1704", "NODEJS:891"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310105086", "OPENVAS:1361412562310105087", "OPENVAS:1361412562310105088", "OPENVAS:1361412562310105828", "OPENVAS:1361412562310105829", "OPENVAS:1361412562310108067", "OPENVAS:1361412562310112430", "OPENVAS:1361412562310120079", "OPENVAS:1361412562310120384", "OPENVAS:1361412562310120608", "OPENVAS:1361412562310122791", "OPENVAS:1361412562310122792", "OPENVAS:1361412562310123417", "OPENVAS:1361412562310123724", "OPENVAS:1361412562310131177", "OPENVAS:1361412562310143881", "OPENVAS:1361412562310702940", "OPENVAS:1361412562310703720", "OPENVAS:1361412562310703721", "OPENVAS:1361412562310806622", "OPENVAS:1361412562310807351", "OPENVAS:1361412562310809053", "OPENVAS:1361412562310810182", "OPENVAS:1361412562310810184", "OPENVAS:1361412562310811298", "OPENVAS:1361412562310811703", "OPENVAS:1361412562310842488", "OPENVAS:1361412562310843024", "OPENVAS:1361412562310843035", "OPENVAS:1361412562310851455", "OPENVAS:1361412562310851503", "OPENVAS:1361412562310852686", "OPENVAS:1361412562310853182", "OPENVAS:1361412562310864280", "OPENVAS:1361412562310864383", "OPENVAS:1361412562310865277", "OPENVAS:1361412562310865280", "OPENVAS:1361412562310865298", "OPENVAS:1361412562310865608", "OPENVAS:1361412562310865612", "OPENVAS:1361412562310868112", "OPENVAS:1361412562310868129", "OPENVAS:1361412562310868132", "OPENVAS:1361412562310868200", "OPENVAS:1361412562310868202", "OPENVAS:1361412562310870917", "OPENVAS:1361412562310871164", "OPENVAS:1361412562310871511", "OPENVAS:1361412562310871512", "OPENVAS:1361412562310871529", "OPENVAS:1361412562310871857", "OPENVAS:1361412562310871971", "OPENVAS:1361412562310874286", "OPENVAS:1361412562310874295", "OPENVAS:1361412562310874441", "OPENVAS:1361412562310874463", "OPENVAS:1361412562310874538", "OPENVAS:1361412562310874589", "OPENVAS:1361412562310874800", "OPENVAS:1361412562310875213", "OPENVAS:1361412562310875357", "OPENVAS:1361412562310876160", "OPENVAS:1361412562310876940", "OPENVAS:1361412562310876994", "OPENVAS:1361412562310877152", "OPENVAS:1361412562310877192", "OPENVAS:1361412562310877752", "OPENVAS:1361412562310877761", "OPENVAS:1361412562310881604", "OPENVAS:1361412562310881933", "OPENVAS:1361412562310882333", "OPENVAS:1361412562310883171", "OPENVAS:1361412562310891479", "OPENVAS:1361412562310891896", "OPENVAS:1361412562310892191", "OPENVAS:1361412562311220171191", "OPENVAS:1361412562311220171192", "OPENVAS:1361412562311220201596", "OPENVAS:1361412562311220201677", "OPENVAS:702940", "OPENVAS:703720", "OPENVAS:703721", "OPENVAS:864280", "OPENVAS:864383", "OPENVAS:865277", "OPENVAS:865280", "OPENVAS:865298", "OPENVAS:865608", "OPENVAS:865612", "OPENVAS:870917", "OPENVAS:871164", "OPENVAS:881604", "OPENVAS:881933"]}, {"type": "oracle", "idList": ["ORACLE:CPUAPR2016V3", "ORACLE:CPUAPR2017", "ORACLE:CPUAPR2018", "ORACLE:CPUAPR2019", "ORACLE:CPUAPR2020", "ORACLE:CPUAPR2021", "ORACLE:CPUAPR2022", "ORACLE:CPUJAN2015", "ORACLE:CPUJAN2016", "ORACLE:CPUJAN2017", "ORACLE:CPUJAN2018", "ORACLE:CPUJAN2019", "ORACLE:CPUJAN2020", "ORACLE:CPUJAN2021", "ORACLE:CPUJAN2022", "ORACLE:CPUJAN2023", "ORACLE:CPUJUL2014-1972956", "ORACLE:CPUJUL2016", "ORACLE:CPUJUL2017", "ORACLE:CPUJUL2018", "ORACLE:CPUJUL2019", "ORACLE:CPUJUL2020", "ORACLE:CPUJUL2021", "ORACLE:CPUJUL2022", "ORACLE:CPUOCT2014-1972960", "ORACLE:CPUOCT2016", "ORACLE:CPUOCT2017", "ORACLE:CPUOCT2018", "ORACLE:CPUOCT2020", "ORACLE:CPUOCT2021", "ORACLE:CPUOCT2022"]}, {"type": "oraclelinux", "idList": ["ELSA-2013-0270", "ELSA-2014-0474", "ELSA-2015-2521", "ELSA-2015-2522", "ELSA-2015-2671", "ELSA-2017-2247", "ELSA-2020-0194", "ELSA-2020-3936", "ELSA-2020-4670", "ELSA-2020-4807", "ELSA-2020-4847", "ELSA-2020-5995", "ELSA-2020-5996", "ELSA-2021-0162", "ELSA-2021-1354", "ELSA-2021-1578", "ELSA-2021-2683", "ELSA-2021-3889", "ELSA-2021-3891", "ELSA-2021-3892", "ELSA-2021-3893", "ELSA-2021-3956", "ELSA-2021-4135", "ELSA-2021-4356", "ELSA-2021-9007", "ELSA-2021-9008", "ELSA-2021-9052", "ELSA-2021-9404", "ELSA-2021-9406", "ELSA-2021-9450", "ELSA-2021-9451", "ELSA-2021-9458", "ELSA-2021-9460", "ELSA-2021-9485", "ELSA-2021-9488", "ELSA-2021-9534", "ELSA-2022-0063", "ELSA-2022-0161", "ELSA-2022-0185", "ELSA-2022-0188", "ELSA-2022-0204", "ELSA-2022-0306", "ELSA-2022-0307", "ELSA-2022-0620", "ELSA-2022-0825", "ELSA-2022-1860", "ELSA-2022-1861", "ELSA-2022-1891", "ELSA-2022-1988", "ELSA-2022-9010", "ELSA-2022-9011", "ELSA-2022-9012", "ELSA-2022-9013", "ELSA-2022-9014", "ELSA-2022-9088", "ELSA-2022-9147", "ELSA-2022-9148", "ELSA-2022-9244", "ELSA-2022-9245", "ELSA-2022-9260", "ELSA-2022-9273", "ELSA-2022-9274", "ELSA-2022-9313", "ELSA-2022-9314", "ELSA-2022-9348", "ELSA-2022-9781"]}, {"type": "osv", "idList": ["OSV:CVE-2021-23222", "OSV:DLA-1479-1", "OSV:DLA-1896-1", "OSV:DLA-2191-1", "OSV:DLA-222-1", "OSV:DLA-2405-1", "OSV:DLA-2433-1", "OSV:DLA-2471-1", "OSV:DLA-2483-1", "OSV:DLA-2494-1", "OSV:DLA-2507-1", "OSV:DLA-2595-1", "OSV:DLA-2616-1", "OSV:DLA-2689-1", "OSV:DLA-2690-1", "OSV:DLA-2704-1", "OSV:DLA-2741-1", "OSV:DLA-2767-1", "OSV:DLA-2769-1", "OSV:DLA-2814-1", "OSV:DLA-2817-1", "OSV:DLA-2917-1", "OSV:DLA-2924-1", "OSV:DLA-2940-1", "OSV:DLA-2941-1", "OSV:DLA-3160-1", "OSV:DLA-57-1", "OSV:DLA-728-1", "OSV:DLA-729-1", "OSV:DSA-2940-1", "OSV:DSA-3720-1", "OSV:DSA-3721-1", "OSV:DSA-4772-1", "OSV:DSA-4811-1", "OSV:DSA-4828-1", "OSV:DSA-5000-1", "OSV:DSA-5000-2", "OSV:DSA-5004-1", "OSV:DSA-5006-1", "OSV:DSA-5007-1", "OSV:DSA-5010-1", "OSV:DSA-5012-1", "OSV:DSA-5050-1", "OSV:DSA-5057-1", "OSV:DSA-5058-1", "OSV:DSA-5092-1", "OSV:DSA-5096-1", "OSV:DSA-5265-1", "OSV:GHSA-2H3J-M7GR-25XJ", "OSV:GHSA-2MH8-GX2M-MR75", "OSV:GHSA-2P3X-QW9C-25HH", "OSV:GHSA-2Q8X-2P7F-574V", "OSV:GHSA-2X83-R56G-CV47", "OSV:GHSA-34WX-X2W9-VQM3", "OSV:GHSA-36P3-WJMG-H94X", "OSV:GHSA-3832-9276-X7GF", "OSV:GHSA-3CCQ-5VW3-2P6X", "OSV:GHSA-3J6G-HXX5-3Q26", "OSV:GHSA-3MGP-FX93-9XV5", "OSV:GHSA-3WQF-4X89-9G79", "OSV:GHSA-43GC-MJXG-GVRQ", "OSV:GHSA-4CCH-WXPW-8P28", "OSV:GHSA-4HRM-M67V-5CXR", "OSV:GHSA-4P24-VMCR-4GQJ", "OSV:GHSA-4WRC-F8PQ-FPQP", "OSV:GHSA-53X6-4X5P-RRVV", "OSV:GHSA-558X-2XJG-6232", "OSV:GHSA-567X-M4WM-87V8", "OSV:GHSA-56P8-3FH9-4CVQ", "OSV:GHSA-59J4-WJWP-MW9M", "OSV:GHSA-59JW-JQF4-3WQ3", "OSV:GHSA-5MG8-W23W-74H3", "OSV:GHSA-64X2-GQ24-75PV", "OSV:GHSA-64XX-CQ4Q-MF44", "OSV:GHSA-6FXM-66HQ-FC96", "OSV:GHSA-6GF2-PVQW-37PH", "OSV:GHSA-6HGM-866R-3CJV", "OSV:GHSA-6PHF-73Q6-GH87", "OSV:GHSA-6VQP-H455-42MR", "OSV:GHSA-6W62-HX7R-MW68", "OSV:GHSA-6WF9-JMG9-VXCC", "OSV:GHSA-6X48-J4X4-CQW3", "OSV:GHSA-6XX3-RG99-GC3P", "OSV:GHSA-72M5-FVVV-55M6", "OSV:GHSA-73XV-W5GP-FRXH", "OSV:GHSA-74CV-F58X-F9WF", "OSV:GHSA-78FQ-W796-Q537", "OSV:GHSA-7CHV-RRW6-W6FC", "OSV:GHSA-7GRW-6PJH-JPC9", "OSV:GHSA-7HFM-57QF-J43Q", "OSV:GHSA-7MVR-5X2G-WFC8", "OSV:GHSA-7R82-7XV7-XCPJ", "OSV:GHSA-8JRJ-525P-826V", "OSV:GHSA-9F3J-PM6F-9FM5", "OSV:GHSA-9JWC-Q6J3-8G9G", "OSV:GHSA-9V3M-8FP8-MJ99", "OSV:GHSA-C27H-MCMW-48HV", "OSV:GHSA-CM59-PR5Q-CW85", "OSV:GHSA-CMXJ-WX9V-52QR", "OSV:GHSA-CRV7-7245-F45F", "OSV:GHSA-CXFM-5M4G-X7XP", "OSV:GHSA-F6HM-88X3-MFJV", "OSV:GHSA-F8VC-WFC8-HXQH", "OSV:GHSA-FG3J-Q579-V8X4", "OSV:GHSA-FJH6-P566-WR6Q", "OSV:GHSA-FJQ5-5J5F-MVXH", "OSV:GHSA-G5W6-MRJ7-75H2", "OSV:GHSA-GFWJ-FWQJ-FP3V", "OSV:GHSA-GWRP-PVRQ-JMWV", "OSV:GHSA-H436-432X-8FVX", "OSV:GHSA-H65F-JVQW-M9FJ", "OSV:GHSA-H68Q-55JF-X68W", "OSV:GHSA-H7V4-7XG3-HXCC", "OSV:GHSA-HPH2-M3G5-XXV4", "OSV:GHSA-HRCP-8F3Q-4W2C", "OSV:GHSA-HRMR-F5M6-M9PQ", "OSV:GHSA-HVV8-336G-RX3M", "OSV:GHSA-HWJ3-M3P6-HJ38", "OSV:GHSA-HWPC-8XQV-JVJ4", "OSV:GHSA-HWVM-VFW8-93MW", "OSV:GHSA-J8WC-GXX9-82HX", "OSV:GHSA-J9H8-PHRW-H4FH", "OSV:GHSA-JFVX-7WRX-43FH", "OSV:GHSA-M6CJ-93V6-CVR5", "OSV:GHSA-M72M-MHQ2-9P6C", "OSV:GHSA-MC84-PJ99-Q6HH", "OSV:GHSA-MVR2-9PJ6-7W5J", "OSV:GHSA-MW36-7C6C-Q4Q2", "OSV:GHSA-P66X-2CV9-QQ3V", "OSV:GHSA-P694-23Q3-RVRC", "OSV:GHSA-P8PQ-R894-FM8F", "OSV:GHSA-PH58-4VRJ-W6HR", "OSV:GHSA-PJ7M-G53M-7638", "OSV:GHSA-Q5R4-CFPX-H6FH", "OSV:GHSA-QPFQ-PH7R-QV6F", "OSV:GHSA-QRX8-8545-4WG2", "OSV:GHSA-RFMP-97JJ-H8M6", "OSV:GHSA-RMR5-CPV2-VGJF", "OSV:GHSA-RV39-3QH7-9V7W", "OSV:GHSA-RVWF-54QP-4R6V", "OSV:GHSA-WRVW-HG22-4M67", "OSV:GHSA-XQFJ-VM6H-2X34", "OSV:GHSA-XW4P-CRPJ-VJX2", "OSV:GHSA-XXX9-3XCR-GJJ3"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:144405", "PACKETSTORM:149050", "PACKETSTORM:152268", "PACKETSTORM:167011", "PACKETSTORM:169859", "PACKETSTORM:170833"]}, {"type": "paloalto", "idList": ["PA-CVE-2022-22963"]}, {"type": "pentestit", "idList": ["PENTESTIT:30AA332D5D04A4C69FDE4D187314152E"]}, {"type": "photon", "idList": ["PHSA-2020-0141", "PHSA-2020-0163", "PHSA-2020-0295", "PHSA-2020-2.0-0295", "PHSA-2020-3.0-0141", "PHSA-2020-3.0-0163", "PHSA-2021-0032", "PHSA-2021-0041", "PHSA-2021-0073", "PHSA-2021-0130", "PHSA-2021-0243", "PHSA-2021-0251", "PHSA-2021-0274", "PHSA-2021-0324", "PHSA-2021-0366", "PHSA-2021-0374", "PHSA-2021-0415", "PHSA-2021-0449", "PHSA-2021-0461", "PHSA-2021-1.0-0418", "PHSA-2021-1.0-0448", "PHSA-2021-2.0-0374", "PHSA-2021-3.0-0243", "PHSA-2021-3.0-0251", "PHSA-2021-3.0-0274", "PHSA-2021-3.0-0324", "PHSA-2021-3.0-0325", "PHSA-2021-3.0-0341", "PHSA-2021-4.0-0032", "PHSA-2021-4.0-0041", "PHSA-2021-4.0-0073", "PHSA-2021-4.0-0130", "PHSA-2022-0145", "PHSA-2022-0148", "PHSA-2022-0351", "PHSA-2022-0356", "PHSA-2022-0361", "PHSA-2022-0429", "PHSA-2022-0433", "PHSA-2022-0440", "PHSA-2022-3.0-0351", "PHSA-2022-3.0-0356", "PHSA-2022-3.0-0361", "PHSA-2022-4.0-0145", "PHSA-2022-4.0-0148", "PHSA-2022-4.0-0154"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:0082A77BD8EFFF48B406D107FEFD0DD3", "QUALYSBLOG:0EAB7251347951045CAC549194E33673", "QUALYSBLOG:3F273F13C86516B494271DB7BE04A954", "QUALYSBLOG:5FAC1C82A388DBB84ECD7CD43450B624", "QUALYSBLOG:6DE7FC733B2FD13EE70756266FF191D0", "QUALYSBLOG:A0F20902D80081B44813D92C6DCCDAAF", "QUALYSBLOG:DE1FEC2B9B661D42DAA0BA398DBFD24E"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:0576BE6110654A3F9BF7B9DE1118A10A", "RAPID7BLOG:07CA09B4E3B3835E096AA56546C43E8E", "RAPID7BLOG:07EA4EC150B77E4EB3557E1B1BA39725", "RAPID7BLOG:1C4EBCEAFC7E54954F827CAEDB3291DA", "RAPID7BLOG:3CB617802DB281BCA8BA6057AE3A98E0", "RAPID7BLOG:46F0D57262DABE81708D657F2733AA5D", "RAPID7BLOG:66B9F80A5ED88EFA9D054CBCE8AA19A5", "RAPID7BLOG:80C2CFBF70B3668FC60A8C97D27CA478", "RAPID7BLOG:B1D4F0D015EADEF37B64DFDBD7A05342", "RAPID7BLOG:CB5AE4C9C1DC52B0AA46E0F184E87A6D", "RAPID7BLOG:D185BF677E20E357AFE422CFB80809A5", "RAPID7BLOG:F14526C6852230A4E4CF44ADE151DF49", "RAPID7BLOG:F35E0080B6D8ADFC130595780153F61A", "RAPID7BLOG:F708A09CA1EFFC0565CA94D5DBC414D5"]}, {"type": "redhat", "idList": ["RHSA-2013:0270", "RHSA-2013:0679", "RHSA-2013:0680", "RHSA-2013:0682", "RHSA-2013:1006", "RHSA-2013:1853", "RHSA-2014:0224", "RHSA-2014:0474", "RHSA-2014:0497", "RHSA-2014:0498", "RHSA-2014:0500", "RHSA-2014:0511", "RHSA-2014:1162", "RHSA-2014:1320", "RHSA-2014:1321", "RHSA-2014:1904", "RHSA-2015:0234", "RHSA-2015:0235", "RHSA-2015:0675", "RHSA-2015:0720", "RHSA-2015:0765", "RHSA-2015:0850", "RHSA-2015:0851", "RHSA-2015:1176", "RHSA-2015:1177", "RHSA-2015:1888", "RHSA-2015:2500", "RHSA-2015:2501", "RHSA-2015:2502", "RHSA-2015:2514", "RHSA-2015:2516", "RHSA-2015:2517", "RHSA-2015:2521", "RHSA-2015:2522", "RHSA-2015:2523", "RHSA-2015:2524", "RHSA-2015:2534", "RHSA-2015:2535", "RHSA-2015:2536", "RHSA-2015:2537", "RHSA-2015:2538", "RHSA-2015:2539", "RHSA-2015:2540", "RHSA-2015:2542", "RHSA-2015:2547", "RHSA-2015:2556", "RHSA-2015:2557", "RHSA-2015:2559", "RHSA-2015:2560", "RHSA-2015:2578", "RHSA-2015:2579", "RHSA-2015:2670", "RHSA-2015:2671", "RHSA-2016:0040", "RHSA-2016:0118", "RHSA-2016:1773", "RHSA-2017:0455", "RHSA-2017:0456", "RHSA-2017:0457", "RHSA-2017:0868", "RHSA-2017:1548", "RHSA-2017:1549", "RHSA-2017:1550", "RHSA-2017:1551", "RHSA-2017:1552", "RHSA-2017:2247", "RHSA-2018:2423", "RHSA-2018:2424", "RHSA-2018:2425", "RHSA-2018:2428", "RHSA-2018:2598", "RHSA-2018:2643", "RHSA-2018:2669", "RHSA-2018:2740", "RHSA-2018:2741", "RHSA-2018:2742", "RHSA-2018:2743", "RHSA-2018:2927", "RHSA-2019:1456", "RHSA-2019:2858", "RHSA-2019:2935", "RHSA-2019:2936", "RHSA-2019:2937", "RHSA-2019:2938", "RHSA-2019:2995", "RHSA-2019:3023", "RHSA-2019:3024", "RHSA-2019:3149", "RHSA-2019:3892", "RHSA-2019:4317", "RHSA-2020:0057", "RHSA-2020:0132", "RHSA-2020:0133", "RHSA-2020:0194", "RHSA-2020:0804", "RHSA-2020:0805", "RHSA-2020:0806", "RHSA-2020:0811", "RHSA-2020:0899", "RHSA-2020:0951", "RHSA-2020:0983", "RHSA-2020:1308", "RHSA-2020:1454", "RHSA-2020:2067", "RHSA-2020:2321", "RHSA-2020:2333", "RHSA-2020:2562", "RHSA-2020:2603", "RHSA-2020:2619", "RHSA-2020:2740", "RHSA-2020:3192", "RHSA-2020:3197", "RHSA-2020:3247", "RHSA-2020:3461", "RHSA-2020:3462", "RHSA-2020:3463", "RHSA-2020:3464", "RHSA-2020:3501", "RHSA-2020:3585", "RHSA-2020:3587", "RHSA-2020:3637", "RHSA-2020:3638", "RHSA-2020:3639", "RHSA-2020:3642", "RHSA-2020:3936", "RHSA-2020:4274", "RHSA-2020:4670", "RHSA-2020:4807", "RHSA-2020:4847", "RHSA-2020:4960", "RHSA-2020:4961", "RHSA-2020:5568", "RHSA-2020:5571", "RHSA-2021:0084", "RHSA-2021:0105", "RHSA-2021:0106", "RHSA-2021:0162", "RHSA-2021:0246", "RHSA-2021:0247", "RHSA-2021:0248", "RHSA-2021:0250", "RHSA-2021:0327", "RHSA-2021:0384", "RHSA-2021:0417", "RHSA-2021:0433", "RHSA-2021:0603", "RHSA-2021:0811", "RHSA-2021:0872", "RHSA-2021:0873", "RHSA-2021:0874", "RHSA-2021:0885", "RHSA-2021:0974", "RHSA-2021:1044", "RHSA-2021:1354", "RHSA-2021:1401", "RHSA-2021:1578", "RHSA-2021:1739", "RHSA-2021:2046", "RHSA-2021:2047", "RHSA-2021:2048", "RHSA-2021:2051", "RHSA-2021:2121", "RHSA-2021:2136", "RHSA-2021:2139", "RHSA-2021:2210", "RHSA-2021:2465", "RHSA-2021:2475", "RHSA-2021:2476", "RHSA-2021:2683", "RHSA-2021:2718", "RHSA-2021:2719", "RHSA-2021:2755", "RHSA-2021:3140", "RHSA-2021:3205", "RHSA-2021:3225", "RHSA-2021:3466", "RHSA-2021:3467", "RHSA-2021:3468", "RHSA-2021:3471", "RHSA-2021:3516", "RHSA-2021:3534", "RHSA-2021:3656", "RHSA-2021:3658", "RHSA-2021:3660", "RHSA-2021:3700", "RHSA-2021:3884", "RHSA-2021:3885", "RHSA-2021:3886", "RHSA-2021:3887", "RHSA-2021:3889", "RHSA-2021:3891", "RHSA-2021:3892", "RHSA-2021:3893", "RHSA-2021:3956", "RHSA-2021:3960", "RHSA-2021:3961", "RHSA-2021:3967", "RHSA-2021:3968", "RHSA-2021:4100", "RHSA-2021:4135", "RHSA-2021:4140", "RHSA-2021:4356", "RHSA-2021:4531", "RHSA-2021:4532", "RHSA-2021:4627", "RHSA-2021:4676", "RHSA-2021:4677", "RHSA-2021:4679", "RHSA-2021:4702", "RHSA-2021:4767", "RHSA-2021:4918", "RHSA-2021:5134", "RHSA-2021:5137", "RHSA-2021:5149", "RHSA-2021:5150", "RHSA-2021:5151", "RHSA-2021:5154", "RHSA-2021:5170", "RHSA-2021:5179", "RHSA-2021:5197", "RHSA-2022:0063", "RHSA-2022:0065", "RHSA-2022:0072", "RHSA-2022:0078", "RHSA-2022:0138", "RHSA-2022:0146", "RHSA-2022:0151", "RHSA-2022:0152", "RHSA-2022:0155", "RHSA-2022:0161", "RHSA-2022:0164", "RHSA-2022:0165", "RHSA-2022:0166", "RHSA-2022:0176", "RHSA-2022:0181", "RHSA-2022:0185", "RHSA-2022:0186", "RHSA-2022:0187", "RHSA-2022:0188", "RHSA-2022:0204", "RHSA-2022:0209", "RHSA-2022:0211", "RHSA-2022:0219", "RHSA-2022:0228", "RHSA-2022:0229", "RHSA-2022:0231", "RHSA-2022:0232", "RHSA-2022:0233", "RHSA-2022:0236", "RHSA-2022:0283", "RHSA-2022:0296", "RHSA-2022:0297", "RHSA-2022:0304", "RHSA-2022:0305", "RHSA-2022:0306", "RHSA-2022:0307", "RHSA-2022:0312", "RHSA-2022:0317", "RHSA-2022:0321", "RHSA-2022:0335", "RHSA-2022:0344", "RHSA-2022:0409", "RHSA-2022:0415", "RHSA-2022:0444", "RHSA-2022:0445", "RHSA-2022:0485", "RHSA-2022:0492", "RHSA-2022:0493", "RHSA-2022:0501", "RHSA-2022:0520", "RHSA-2022:0529", "RHSA-2022:0530", "RHSA-2022:0531", "RHSA-2022:0533", "RHSA-2022:0540", "RHSA-2022:0589", "RHSA-2022:0590", "RHSA-2022:0592", "RHSA-2022:0595", "RHSA-2022:0620", "RHSA-2022:0622", "RHSA-2022:0629", "RHSA-2022:0636", "RHSA-2022:0712", "RHSA-2022:0718", "RHSA-2022:0722", "RHSA-2022:0735", "RHSA-2022:0737", "RHSA-2022:0771", "RHSA-2022:0772", "RHSA-2022:0777", "RHSA-2022:0819", "RHSA-2022:0820", "RHSA-2022:0821", "RHSA-2022:0823", "RHSA-2022:0825", "RHSA-2022:0841", "RHSA-2022:0849", "RHSA-2022:0851", "RHSA-2022:0856", "RHSA-2022:0925", "RHSA-2022:0958", "RHSA-2022:0968", "RHSA-2022:0969", "RHSA-2022:0970", "RHSA-2022:1013", "RHSA-2022:1029", "RHSA-2022:1051", "RHSA-2022:1083", "RHSA-2022:1103", "RHSA-2022:1104", "RHSA-2022:1106", "RHSA-2022:1107", "RHSA-2022:1108", "RHSA-2022:1110", "RHSA-2022:1263", "RHSA-2022:1306", "RHSA-2022:1324", "RHSA-2022:1333", "RHSA-2022:1360", "RHSA-2022:1373", "RHSA-2022:1378", "RHSA-2022:1379", "RHSA-2022:1396", "RHSA-2022:1417", "RHSA-2022:1420", "RHSA-2022:1476", "RHSA-2022:1626", "RHSA-2022:1627", "RHSA-2022:1860", "RHSA-2022:1861", "RHSA-2022:1891", "RHSA-2022:1975", "RHSA-2022:1988", "RHSA-2022:2232", "RHSA-2022:4623", "RHSA-2022:4814", "RHSA-2022:4880", "RHSA-2022:4918", "RHSA-2022:4919", "RHSA-2022:4922", "RHSA-2022:4956", "RHSA-2022:5132", "RHSA-2022:5188", "RHSA-2022:5201", "RHSA-2022:5392", "RHSA-2022:5483", "RHSA-2022:5532", "RHSA-2022:5555", "RHSA-2022:5606", "RHSA-2022:5903", "RHSA-2022:6393", "RHSA-2022:6407", "RHSA-2022:6813", "RHSA-2022:6835", "RHSA-2022:7272", "RHSA-2022:7273", "RHSA-2022:7896", "RHSA-2022:8652", "RHSA-2022:8761", "RHSA-2022:8848", "RHSA-2022:8865", "RHSA-2023:0272", "RHSA-2023:0554", "RHSA-2023:0556"]}, {"type": "redhatcve", "idList": ["RH:CVE-2016-1000027", "RH:CVE-2017-18640", "RH:CVE-2018-10237", "RH:CVE-2018-11771", "RH:CVE-2018-1324", "RH:CVE-2018-14040", "RH:CVE-2018-14042", "RH:CVE-2018-20676", "RH:CVE-2018-20677", "RH:CVE-2018-8009", "RH:CVE-2019-10086", "RH:CVE-2019-10202", "RH:CVE-2019-12402", "RH:CVE-2019-12415", "RH:CVE-2019-3834", "RH:CVE-2019-8331", "RH:CVE-2020-10683", "RH:CVE-2020-13936", "RH:CVE-2020-13954", "RH:CVE-2020-13956", "RH:CVE-2020-15522", "RH:CVE-2020-25704", "RH:CVE-2020-26217", "RH:CVE-2020-26258", "RH:CVE-2020-26259", "RH:CVE-2020-28052", "RH:CVE-2020-36322", "RH:CVE-2020-5421", "RH:CVE-2020-7746", "RH:CVE-2020-8908", "RH:CVE-2020-9492", "RH:CVE-2021-21341", "RH:CVE-2021-21342", "RH:CVE-2021-21343", "RH:CVE-2021-21344", "RH:CVE-2021-21345", "RH:CVE-2021-21346", "RH:CVE-2021-21347", "RH:CVE-2021-21348", "RH:CVE-2021-21349", "RH:CVE-2021-21350", "RH:CVE-2021-21351", "RH:CVE-2021-22060", "RH:CVE-2021-22096", "RH:CVE-2021-22118", "RH:CVE-2021-22569", "RH:CVE-2021-23222", "RH:CVE-2021-27807", "RH:CVE-2021-27906", "RH:CVE-2021-28657", "RH:CVE-2021-29425", "RH:CVE-2021-29505", "RH:CVE-2021-31811", "RH:CVE-2021-31812", "RH:CVE-2021-35515", "RH:CVE-2021-35516", "RH:CVE-2021-35517", "RH:CVE-2021-35550", "RH:CVE-2021-35603", "RH:CVE-2021-3564", "RH:CVE-2021-3573", "RH:CVE-2021-36090", "RH:CVE-2021-36373", "RH:CVE-2021-3752", "RH:CVE-2021-37714", "RH:CVE-2021-38153", "RH:CVE-2021-39139", "RH:CVE-2021-39140", "RH:CVE-2021-39141", "RH:CVE-2021-39144", "RH:CVE-2021-39145", "RH:CVE-2021-39146", "RH:CVE-2021-39147", "RH:CVE-2021-39148", "RH:CVE-2021-39149", "RH:CVE-2021-39150", "RH:CVE-2021-39151", "RH:CVE-2021-39152", "RH:CVE-2021-39153", "RH:CVE-2021-39154", "RH:CVE-2021-40690", "RH:CVE-2021-4155", "RH:CVE-2021-43859", "RH:CVE-2022-0330", "RH:CVE-2022-0538", "RH:CVE-2022-21248", "RH:CVE-2022-21291", "RH:CVE-2022-21293", "RH:CVE-2022-21294", "RH:CVE-2022-21305", "RH:CVE-2022-21340", "RH:CVE-2022-21341", "RH:CVE-2022-21349", "RH:CVE-2022-21360", "RH:CVE-2022-21365", "RH:CVE-2022-22942", "RH:CVE-2022-22950", "RH:CVE-2022-22963", "RH:CVE-2022-22965", "RH:CVE-2022-23181", "RH:CVE-2022-23437", "RH:CVE-2022-23596"]}, {"type": "rocky", "idList": ["RLSA-2020:4670", "RLSA-2020:4807", "RLSA-2020:4847", "RLSA-2021:3891", "RLSA-2021:3893", "RLSA-2021:4135", "RLSA-2021:4140", "RLSA-2021:4356", "RLSA-2022:0161", "RLSA-2022:0176", "RLSA-2022:0185", "RLSA-2022:0188", "RLSA-2022:0307", "RLSA-2022:0819", "RLSA-2022:0825", "RLSA-2022:161", "RLSA-2022:176", "RLSA-2022:185", "RLSA-2022:1860", "RLSA-2022:1861", "RLSA-2022:188", "RLSA-2022:1891", "RLSA-2022:1975", "RLSA-2022:1988", "RLSA-2022:307", "RLSA-2022:819", "RLSA-2022:825"]}, {"type": "rubygems", "idList": ["RUBY:BOOTSTRAP-2018-14040", "RUBY:NOKOGIRI-2022-23437"]}, {"type": "saint", "idList": ["SAINT:364F42DDB229F6E8A0EF4BB04CE504D2", "SAINT:38F4E0E6CE11A2F3EC10321A6DF373E2", "SAINT:B8E045060F9ACF0F8D488745DBF66B54", "SAINT:EA211AC1CE6B335FAB2D22929BF61475"]}, {"type": "securelist", "idList": ["SECURELIST:0ED76DA480D73D593C82769757DFD87A", "SECURELIST:11665FFD7075FB9D59316195101DE894", "SECURELIST:D9AF9603FDB076FD6351B6ED483A4947", "SECURELIST:E21F9D6D3E5AFD65C99FC385D4B5F1DC"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:30528", "SECURITYVULNS:DOC:30529", "SECURITYVULNS:DOC:30881", "SECURITYVULNS:DOC:31941", "SECURITYVULNS:DOC:32573", "SECURITYVULNS:VULN:12399", "SECURITYVULNS:VULN:13701", "SECURITYVULNS:VULN:13845", "SECURITYVULNS:VULN:13868", "SECURITYVULNS:VULN:14031", "SECURITYVULNS:VULN:14233", "SECURITYVULNS:VULN:14410"]}, {"type": "seebug", "idList": ["SSV:60155", "SSV:89999", "SSV:96979", "SSV:99251"]}, {"type": "slackware", "idList": ["SSA-2021-202-01", "SSA-2022-031-01"]}, {"type": "spring", "idList": ["SPRING:0A31867D9351CED0BD42C5AD9FB90F8C", "SPRING:DA8F6AA20460EB2D550732A7F74584F6", "SPRING:DE384E814B204ABC68C9A98C00ACA572", "SPRING:EA9C08B2E57AC70E90A896D25F4A8BEE"]}, {"type": "srcincite", "idList": ["SRC-2022-0021"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2016:3129-1", "OPENSUSE-SU-2016:3144-1", "OPENSUSE-SU-2019:2058-1", "OPENSUSE-SU-2020:0719-1", "OPENSUSE-SU-2020:1906-1", "OPENSUSE-SU-2020:2034-1", "OPENSUSE-SU-2020:2112-1", "OPENSUSE-SU-2020:2260-1", "OPENSUSE-SU-2021:0140-1", "OPENSUSE-SU-2021:0242-1", "OPENSUSE-SU-2021:0447-1", "OPENSUSE-SU-2021:0579-1", "OPENSUSE-SU-2021:0605-1", "OPENSUSE-SU-2021:0832-1", "OPENSUSE-SU-2021:0911-1", "OPENSUSE-SU-2021:0940-1", "OPENSUSE-SU-2021:1115-1", "OPENSUSE-SU-2021:1357-1", "OPENSUSE-SU-2021:1365-1", "OPENSUSE-SU-2021:1401-1", "OPENSUSE-SU-2021:1455-1", "OPENSUSE-SU-2021:1480-1", "OPENSUSE-SU-2021:1500-1", "OPENSUSE-SU-2021:1584-1", "OPENSUSE-SU-2021:1840-1", "OPENSUSE-SU-2021:1876-1", "OPENSUSE-SU-2021:1975-1", "OPENSUSE-SU-2021:1977-1", "OPENSUSE-SU-2021:1995-1", "OPENSUSE-SU-2021:2163-1", "OPENSUSE-SU-2021:2305-1", "OPENSUSE-SU-2021:2352-1", "OPENSUSE-SU-2021:2612-1", "OPENSUSE-SU-2021:3338-1", "OPENSUSE-SU-2021:3387-1", "OPENSUSE-SU-2021:3447-1", "OPENSUSE-SU-2021:3476-1", "OPENSUSE-SU-2021:3615-1", "OPENSUSE-SU-2021:3671-1", "OPENSUSE-SU-2021:3758-1", "OPENSUSE-SU-2021:3759-1", "OPENSUSE-SU-2021:3762-1", "OPENSUSE-SU-2021:3770-1", "OPENSUSE-SU-2021:3876-1", "OPENSUSE-SU-2021:4058-1", "OPENSUSE-SU-2022:0363-1", "OPENSUSE-SU-2022:0366-1", "OPENSUSE-SU-2022:0370-1", "OPENSUSE-SU-2022:0500-1", "OPENSUSE-SU-2022:0503-1", "OPENSUSE-SU-2022:0816-1", "OPENSUSE-SU-2022:0817-1", "OPENSUSE-SU-2022:0818-1", "OPENSUSE-SU-2022:0870-1", "OPENSUSE-SU-2022:0873-1", "OPENSUSE-SU-2022:1027-1", "SUSE-SU-2014:0902-1", "SUSE-SU-2016:3079-1", "SUSE-SU-2016:3081-1", "SUSE-SU-2017:1632-1", "SUSE-SU-2017:1660-1", "SUSE-SU-2022:1265-1", "SUSE-SU-2022:1418-1", "SUSE-SU-2022:2111-1", "SUSE-SU-2022:3264-1", "SUSE-SU-2022:3397-1", "SUSE-SU-2022:3609-1", "SUSE-SU-2022:3809-1", "SUSE-SU-2022:3922-1"]}, {"type": "symantec", "idList": ["SMNTC-109915", "SMNTC-111516", "SMNTC-111546"]}, {"type": "talosblog", "idList": ["TALOSBLOG:3587BB077717B0512A9D0EFCCBE8770B"]}, {"type": "thn", "idList": ["THN:51196AEF32803B9BBB839D4CADBF5B38", "THN:701EA1BEE49C9AF916F8D5BAE87B2264", "THN:7A3DFDA680FEA7FB77640D29F9D3E3E2", "THN:8FDA592D55831C1C4E3583B81FABA962", "THN:90DC43ADC5123FED500235ACDF6D6277", "THN:9F9D436651F16F99B6EA52F0DB9AE75C", "THN:EAFAEB28A545DC638924DAC8AAA4FBF2", "THN:ECDABD8FB1E94F5D8AFD13E4C1CB5840"]}, {"type": "threatpost", "idList": ["THREATPOST:F8F0749C57FDD3CABE842BDFEAD33452"]}, {"type": "tomcat", "idList": ["TOMCAT:134FFF2A5E889835054EC92E557C984D", "TOMCAT:3BE7322A30732B9FCCD5C138E261173F", "TOMCAT:47B91042927062AB4C945C176AD09B02", "TOMCAT:75BDD1762995663D2613C2EC3D1F16DD", "TOMCAT:790F7EF00EBD814D5B55BBA9ADFAB91D", "TOMCAT:8423D2ED2F8751548B2F3411FE07D05F", "TOMCAT:937E284FF802C2D5A6E9C8A59AB6C822", "TOMCAT:BD106E970B6D4964B80C5CC3715C6DD2"]}, {"type": "trellix", "idList": ["TRELLIX:33C611A7064C89E309C4A45CAE585BD5", "TRELLIX:341471F990B5DC7BFF1C28F924F10E32"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:3BBEDAD3D1AE692D361A31D5E9AE2538", "TRENDMICROBLOG:59C3D813302731E6DE220FB088280F67", "TRENDMICROBLOG:AFF0912EF635E2446F0D546515038F73"]}, {"type": "typo3", "idList": ["TYPO3-PSA-2019-005"]}, {"type": "ubuntu", "idList": ["USN-2769-1", "USN-3177-1", "USN-3177-2", "USN-4557-1", "USN-4575-1", "USN-4679-1", "USN-4710-1", "USN-4711-1", "USN-4714-1", "USN-4751-1", "USN-4752-1", "USN-4766-1", "USN-4943-1", "USN-5015-1", "USN-5044-1", "USN-5045-1", "USN-5046-1", "USN-5050-1", "USN-5095-1", "USN-5136-1", "USN-5145-1", "USN-5202-1", "USN-5239-1", "USN-5265-1", "USN-5267-1", "USN-5267-2", "USN-5267-3", "USN-5268-1", "USN-5278-1", "USN-5294-1", "USN-5294-2", "USN-5295-1", "USN-5295-2", "USN-5297-1", "USN-5298-1", "USN-5299-1", "USN-5313-1", "USN-5313-2", "USN-5343-1", "USN-5362-1", "USN-5505-1", "USN-5513-1", "USN-5525-1", "USN-5765-1", "USN-5884-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2012-2098", "UB:CVE-2012-5783", "UB:CVE-2012-6153", "UB:CVE-2014-0114", "UB:CVE-2014-3604", "UB:CVE-2015-1796", "UB:CVE-2015-4852", "UB:CVE-2015-7501", "UB:CVE-2016-1000027", "UB:CVE-2016-10735", "UB:CVE-2016-6796", "UB:CVE-2017-18640", "UB:CVE-2018-11771", "UB:CVE-2018-1324", "UB:CVE-2018-14040", "UB:CVE-2018-14042", "UB:CVE-2018-20676", "UB:CVE-2018-20677", "UB:CVE-2019-10086", "UB:CVE-2019-12402", "UB:CVE-2019-12415", "UB:CVE-2019-17359", "UB:CVE-2019-8331", "UB:CVE-2020-10683", "UB:CVE-2020-13936", "UB:CVE-2020-13956", "UB:CVE-2020-15522", "UB:CVE-2020-25704", "UB:CVE-2020-26217", "UB:CVE-2020-26258", "UB:CVE-2020-26259", "UB:CVE-2020-26939", "UB:CVE-2020-28052", "UB:CVE-2020-36322", "UB:CVE-2020-5421", "UB:CVE-2020-7746", "UB:CVE-2021-21341", "UB:CVE-2021-21342", "UB:CVE-2021-21343", "UB:CVE-2021-21344", "UB:CVE-2021-21345", "UB:CVE-2021-21346", "UB:CVE-2021-21347", "UB:CVE-2021-21348", "UB:CVE-2021-21349", "UB:CVE-2021-21350", "UB:CVE-2021-21351", "UB:CVE-2021-22060", "UB:CVE-2021-22096", "UB:CVE-2021-22118", "UB:CVE-2021-22569", "UB:CVE-2021-23222", "UB:CVE-2021-27807", "UB:CVE-2021-27906", "UB:CVE-2021-28657", "UB:CVE-2021-29425", "UB:CVE-2021-29505", "UB:CVE-2021-31811", "UB:CVE-2021-31812", "UB:CVE-2021-35515", "UB:CVE-2021-35516", "UB:CVE-2021-35517", "UB:CVE-2021-35550", "UB:CVE-2021-35603", "UB:CVE-2021-3564", "UB:CVE-2021-3573", "UB:CVE-2021-36090", "UB:CVE-2021-36373", "UB:CVE-2021-3752", "UB:CVE-2021-37714", "UB:CVE-2021-38153", "UB:CVE-2021-39139", "UB:CVE-2021-39140", "UB:CVE-2021-39141", "UB:CVE-2021-39144", "UB:CVE-2021-39145", "UB:CVE-2021-39146", "UB:CVE-2021-39147", "UB:CVE-2021-39148", "UB:CVE-2021-39149", "UB:CVE-2021-39150", "UB:CVE-2021-39151", "UB:CVE-2021-39152", "UB:CVE-2021-39153", "UB:CVE-2021-39154", "UB:CVE-2021-40690", "UB:CVE-2021-4155", "UB:CVE-2021-43859", "UB:CVE-2022-0330", "UB:CVE-2022-21248", "UB:CVE-2022-21291", "UB:CVE-2022-21293", "UB:CVE-2022-21294", "UB:CVE-2022-21305", "UB:CVE-2022-21340", "UB:CVE-2022-21341", "UB:CVE-2022-21349", "UB:CVE-2022-21360", "UB:CVE-2022-21365", "UB:CVE-2022-22942", "UB:CVE-2022-22950", "UB:CVE-2022-22965", "UB:CVE-2022-23181", "UB:CVE-2022-23437"]}, {"type": "vaadin", "idList": ["VAADIN:ADVISORY-2021-10-27", "VAADIN:ADVISORY-2022-04-01"]}, {"type": "veracode", "idList": ["VERACODE:13488", "VERACODE:21314", "VERACODE:21389", "VERACODE:21591", "VERACODE:21671", "VERACODE:21775", "VERACODE:22175", "VERACODE:22252", "VERACODE:22499", "VERACODE:25055", "VERACODE:26780", "VERACODE:27558", "VERACODE:27672", "VERACODE:27719", "VERACODE:27737", "VERACODE:27879", "VERACODE:27911", "VERACODE:28627", "VERACODE:28628", "VERACODE:28637", "VERACODE:28922", "VERACODE:29153", "VERACODE:29563", "VERACODE:29689", "VERACODE:29698", "VERACODE:29700", "VERACODE:29772", "VERACODE:29784", "VERACODE:29785", "VERACODE:29787", "VERACODE:29788", "VERACODE:29789", "VERACODE:29790", "VERACODE:29793", "VERACODE:29814", "VERACODE:29816", "VERACODE:29934", "VERACODE:29972", "VERACODE:30531", "VERACODE:30595", "VERACODE:30614", "VERACODE:30708", "VERACODE:30955", "VERACODE:30959", "VERACODE:31200", "VERACODE:31202", "VERACODE:31213", "VERACODE:31465", "VERACODE:31748", "VERACODE:31789", "VERACODE:31793", "VERACODE:31794", "VERACODE:31795", "VERACODE:31796", "VERACODE:31797", "VERACODE:31798", "VERACODE:31799", "VERACODE:31800", "VERACODE:31801", "VERACODE:31803", "VERACODE:31805", "VERACODE:31806", "VERACODE:31850", "VERACODE:32164", "VERACODE:32200", "VERACODE:32216", "VERACODE:32723", "VERACODE:32733", "VERACODE:32757", "VERACODE:32955", "VERACODE:33110", "VERACODE:33570", "VERACODE:33884", "VERACODE:33938", "VERACODE:33940", "VERACODE:33941", "VERACODE:33942", "VERACODE:33943", "VERACODE:33944", "VERACODE:33947", "VERACODE:33948", "VERACODE:33953", "VERACODE:33954", "VERACODE:33961", "VERACODE:33977", "VERACODE:33979", "VERACODE:34149", "VERACODE:34347", "VERACODE:34616", "VERACODE:34883", "VERACODE:35014", "VERACODE:35544", "VERACODE:35784"]}, {"type": "virtuozzo", "idList": ["VZA-2021-063", "VZA-2022-001", "VZA-2022-027"]}, {"type": "vmware", "idList": ["VMSA-2014-0008", "VMSA-2014-0008.2", "VMSA-2022-0010", "VMSA-2022-0010.1", "VMSA-2022-0010.3", "VMSA-2022-0010.4", "VMSA-2022-0010.5", "VMSA-2022-0027", "VMSA-2022-0027.1"]}, {"type": "zdt", "idList": ["1337DAY-ID-27400", "1337DAY-ID-28661", "1337DAY-ID-30269", "1337DAY-ID-37692", "1337DAY-ID-38069", "1337DAY-ID-38179"]}]}, "affected_software": {"major_version": [{"name": "ibm data risk manager", "version": 2}]}, "epss": [{"cve": "CVE-2012-2098", "epss": "0.035570000", "percentile": "0.901480000", "modified": "2023-03-19"}, {"cve": "CVE-2012-5783", "epss": "0.002380000", "percentile": "0.601000000", "modified": "2023-03-19"}, {"cve": "CVE-2014-0114", "epss": "0.973390000", "percentile": "0.997760000", "modified": "2023-03-19"}, {"cve": "CVE-2014-3604", "epss": "0.001030000", "percentile": "0.405690000", "modified": "2023-03-19"}, {"cve": "CVE-2014-3643", "epss": "0.001660000", "percentile": "0.515700000", "modified": "2023-03-19"}, {"cve": "CVE-2015-1796", "epss": "0.003760000", "percentile": "0.685540000", "modified": "2023-03-19"}, {"cve": "CVE-2015-4852", "epss": "0.963130000", "percentile": "0.992030000", "modified": "2023-03-19"}, {"cve": "CVE-2015-6420", "epss": "0.008800000", "percentile": "0.800330000", "modified": "2023-03-19"}, {"cve": "CVE-2015-7501", "epss": "0.013000000", "percentile": "0.837680000", "modified": "2023-03-19"}, {"cve": "CVE-2016-1000027", "epss": "0.024330000", "percentile": "0.882870000", "modified": "2023-03-19"}, {"cve": "CVE-2016-10735", "epss": "0.002870000", "percentile": "0.639050000", "modified": "2023-03-19"}, {"cve": "CVE-2016-6796", "epss": "0.001530000", "percentile": "0.497910000", "modified": "2023-03-19"}, {"cve": "CVE-2017-15708", "epss": "0.007160000", "percentile": "0.775220000", "modified": "2023-03-19"}, {"cve": "CVE-2017-18640", "epss": "0.008060000", "percentile": "0.790790000", "modified": "2023-03-19"}, {"cve": "CVE-2018-10237", "epss": "0.010120000", "percentile": "0.814330000", "modified": "2023-03-19"}, {"cve": "CVE-2018-11771", "epss": "0.001840000", "percentile": "0.540300000", "modified": "2023-03-19"}, {"cve": "CVE-2018-1324", "epss": "0.001100000", "percentile": "0.424980000", "modified": "2023-03-19"}, {"cve": "CVE-2018-14040", "epss": "0.010730000", "percentile": "0.820070000", "modified": "2023-03-19"}, {"cve": "CVE-2018-14042", "epss": "0.003350000", "percentile": "0.666580000", "modified": "2023-03-19"}, {"cve": "CVE-2018-20676", "epss": "0.002990000", "percentile": "0.646890000", "modified": "2023-03-19"}, {"cve": "CVE-2018-20677", "epss": "0.004340000", "percentile": "0.706210000", "modified": "2023-03-19"}, {"cve": "CVE-2018-8009", "epss": "0.075010000", "percentile": "0.930550000", "modified": "2023-03-19"}, {"cve": "CVE-2019-10086", "epss": "0.003110000", "percentile": "0.653590000", "modified": "2023-03-19"}, {"cve": "CVE-2019-10202", "epss": "0.009040000", "percentile": "0.803180000", "modified": "2023-03-19"}, {"cve": "CVE-2019-12402", "epss": "0.003000000", "percentile": "0.647430000", "modified": "2023-03-19"}, {"cve": "CVE-2019-12415", "epss": "0.000690000", "percentile": "0.282230000", "modified": "2023-03-19"}, {"cve": "CVE-2019-13116", "epss": "0.017900000", "percentile": "0.861820000", "modified": "2023-03-19"}, {"cve": "CVE-2019-17359", "epss": "0.008750000", "percentile": "0.799560000", "modified": "2023-03-19"}, {"cve": "CVE-2019-8331", "epss": "0.002690000", "percentile": "0.627110000", "modified": "2023-03-19"}, {"cve": "CVE-2020-10683", "epss": "0.002610000", "percentile": "0.620460000", "modified": "2023-03-19"}, {"cve": "CVE-2020-13936", "epss": "0.001170000", "percentile": "0.440090000", "modified": "2023-03-19"}, {"cve": "CVE-2020-13954", "epss": "0.955910000", "percentile": "0.989700000", "modified": "2023-03-19"}, {"cve": "CVE-2020-13956", "epss": "0.001240000", "percentile": "0.451330000", "modified": "2023-03-19"}, {"cve": "CVE-2020-15522", "epss": "0.001090000", "percentile": "0.421930000", "modified": "2023-03-19"}, {"cve": "CVE-2020-25704", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2020-26217", "epss": "0.970910000", "percentile": "0.995890000", "modified": "2023-03-19"}, {"cve": "CVE-2020-26258", "epss": "0.964680000", "percentile": "0.992620000", "modified": "2023-03-19"}, {"cve": "CVE-2020-26259", "epss": "0.624530000", "percentile": "0.972220000", "modified": "2023-03-19"}, {"cve": "CVE-2020-26939", "epss": "0.000610000", "percentile": "0.239130000", "modified": "2023-03-19"}, {"cve": "CVE-2020-28052", "epss": "0.001990000", "percentile": "0.559950000", "modified": "2023-03-19"}, {"cve": "CVE-2020-36322", "epss": "0.000450000", "percentile": "0.120110000", "modified": "2023-03-19"}, {"cve": "CVE-2020-5421", "epss": "0.856990000", "percentile": "0.979440000", "modified": "2023-03-19"}, {"cve": "CVE-2020-7746", "epss": "0.013550000", "percentile": "0.841050000", "modified": "2023-03-19"}, {"cve": "CVE-2020-8908", "epss": "0.000600000", "percentile": "0.231780000", "modified": "2023-03-19"}, {"cve": "CVE-2020-9492", "epss": "0.004860000", "percentile": "0.722800000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21341", "epss": "0.019110000", "percentile": "0.867270000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21342", "epss": "0.015170000", "percentile": "0.849660000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21343", "epss": "0.003980000", "percentile": "0.694170000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21344", "epss": "0.013650000", "percentile": "0.841690000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21345", "epss": "0.007920000", "percentile": "0.789130000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21346", "epss": "0.013650000", "percentile": "0.841690000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21347", "epss": "0.011760000", "percentile": "0.828350000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21348", "epss": "0.010760000", "percentile": "0.820330000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21349", "epss": "0.009020000", "percentile": "0.803040000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21350", "epss": "0.013650000", "percentile": "0.841690000", "modified": "2023-03-19"}, {"cve": "CVE-2021-21351", "epss": "0.938190000", "percentile": "0.985900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-22060", "epss": "0.000520000", "percentile": "0.184190000", "modified": "2023-03-19"}, {"cve": "CVE-2021-22096", "epss": "0.000760000", "percentile": "0.305060000", "modified": "2023-03-19"}, {"cve": "CVE-2021-22118", "epss": "0.000460000", "percentile": "0.140340000", "modified": "2023-03-19"}, {"cve": "CVE-2021-22569", "epss": "0.000540000", "percentile": "0.194600000", "modified": "2023-03-19"}, {"cve": "CVE-2021-23222", "epss": "0.000820000", "percentile": "0.331960000", "modified": "2023-03-19"}, {"cve": "CVE-2021-27807", "epss": "0.000690000", "percentile": "0.279850000", "modified": "2023-03-19"}, {"cve": "CVE-2021-27906", "epss": "0.000690000", "percentile": "0.279850000", "modified": "2023-03-19"}, {"cve": "CVE-2021-28657", "epss": "0.000540000", "percentile": "0.197230000", "modified": "2023-03-19"}, {"cve": "CVE-2021-29425", "epss": "0.001840000", "percentile": "0.539230000", "modified": "2023-03-19"}, {"cve": "CVE-2021-29505", "epss": "0.004760000", "percentile": "0.719680000", "modified": "2023-03-19"}, {"cve": "CVE-2021-31811", "epss": "0.000740000", "percentile": "0.299840000", "modified": "2023-03-19"}, {"cve": "CVE-2021-31812", "epss": "0.000720000", "percentile": "0.293230000", "modified": "2023-03-19"}, {"cve": "CVE-2021-35515", "epss": "0.001690000", "percentile": "0.521820000", "modified": "2023-03-19"}, {"cve": "CVE-2021-35516", "epss": "0.002280000", "percentile": "0.592530000", "modified": "2023-03-19"}, {"cve": "CVE-2021-35517", "epss": "0.002920000", "percentile": "0.642610000", "modified": "2023-03-19"}, {"cve": "CVE-2021-35550", "epss": "0.001270000", "percentile": "0.457130000", "modified": "2023-03-19"}, {"cve": "CVE-2021-35603", "epss": "0.000680000", "percentile": "0.278130000", "modified": "2023-03-19"}, {"cve": "CVE-2021-3564", "epss": "0.000430000", "percentile": "0.077860000", "modified": "2023-03-19"}, {"cve": "CVE-2021-3573", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2021-36090", "epss": "0.002180000", "percentile": "0.580710000", "modified": "2023-03-19"}, {"cve": "CVE-2021-36373", "epss": "0.000730000", "percentile": "0.296140000", "modified": "2023-03-19"}, {"cve": "CVE-2021-3752", "epss": "0.000970000", "percentile": "0.391390000", "modified": "2023-03-19"}, {"cve": "CVE-2021-37714", "epss": "0.004130000", "percentile": "0.699420000", "modified": "2023-03-19"}, {"cve": "CVE-2021-38153", "epss": "0.000730000", "percentile": "0.296260000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39139", "epss": "0.008570000", "percentile": "0.797470000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39140", "epss": "0.003800000", "percentile": "0.687350000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39141", "epss": "0.005490000", "percentile": "0.739710000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39144", "epss": "0.964710000", "percentile": "0.992650000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39145", "epss": "0.006580000", "percentile": "0.763870000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39146", "epss": "0.009320000", "percentile": "0.806260000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39147", "epss": "0.005340000", "percentile": "0.735900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39148", "epss": "0.005340000", "percentile": "0.735900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39149", "epss": "0.005340000", "percentile": "0.735900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39150", "epss": "0.005860000", "percentile": "0.748360000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39151", "epss": "0.005340000", "percentile": "0.735900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39152", "epss": "0.005860000", "percentile": "0.748360000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39153", "epss": "0.005340000", "percentile": "0.735900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-39154", "epss": "0.005340000", "percentile": "0.735900000", "modified": "2023-03-19"}, {"cve": "CVE-2021-40690", "epss": "0.002040000", "percentile": "0.566920000", "modified": "2023-03-19"}, {"cve": "CVE-2021-4155", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2021-43859", "epss": "0.006020000", "percentile": "0.752040000", "modified": "2023-03-19"}, {"cve": "CVE-2022-0330", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21248", "epss": "0.000810000", "percentile": "0.329810000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21291", "epss": "0.000910000", "percentile": "0.371930000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21293", "epss": "0.001010000", "percentile": "0.399720000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21294", "epss": "0.000830000", "percentile": "0.336250000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21305", "epss": "0.000910000", "percentile": "0.371930000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21340", "epss": "0.000830000", "percentile": "0.336250000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21341", "epss": "0.000830000", "percentile": "0.336250000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21349", "epss": "0.000590000", "percentile": "0.226600000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21360", "epss": "0.000830000", "percentile": "0.336250000", "modified": "2023-03-19"}, {"cve": "CVE-2022-21365", "epss": "0.000830000", "percentile": "0.336250000", "modified": "2023-03-19"}, {"cve": "CVE-2022-22950", "epss": "0.000510000", "percentile": "0.180030000", "modified": "2023-03-19"}, {"cve": "CVE-2022-22965", "epss": "0.974880000", "percentile": "0.999430000", "modified": "2023-03-19"}, {"cve": "CVE-2022-23181", "epss": "0.000430000", "percentile": "0.077200000", "modified": "2023-03-19"}, {"cve": "CVE-2022-23437", "epss": "0.004740000", "percentile": "0.719190000", "modified": "2023-03-19"}, {"cve": "CVE-2022-23596", "epss": "0.000850000", "percentile": "0.343090000", "modified": "2023-03-19"}, {"cve": "CVE-2022-27772", "epss": "0.000420000", "percentile": "0.056360000", "modified": "2023-03-19"}], "vulnersScore": 0.4}, "_state": {"dependencies": 1677548948, "score": 1677549201, "affected_software_major_version": 1677549706, "epss": 1679302437}, "_internal": {"score_hash": "c37678ac62dcfb3998a5dfaffb09c5d9"}, "affectedSoftware": [{"version": "2.0.6.12", "operator": "eq", "name": "ibm data risk manager"}]}

{"ibm": [{"lastseen": "2023-02-28T01:51:56", "description": "## Summary\n\nVulnerabilities in XStream, such as execution of arbitrary code, server-side request forgery, denial of service, bypassing security restrictions, and deletion of arbitrary files, may affect IBM Spectrum Copy Data Management.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2020-26217](<https://vulners.com/cve/CVE-2020-26217>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and SecurityVulnerabilityTest.java scripts. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/192210](<https://exchange.xforce.ibmcloud.com/vulnerabilities/192210>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-29505](<https://vulners.com/cve/CVE-2021-29505>) \n** DESCRIPTION: **XStream XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202795](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202795>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26258](<https://vulners.com/cve/CVE-2020-26258>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when unmarshalling. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to obtain sensitive data. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193525](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193525>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2020-26259](<https://vulners.com/cve/CVE-2020-26259>) \n** DESCRIPTION: **XStream could allow a remote attacker to delete arbitrary files from the system, caused by improper input sanitization. By manipulating the processed input, an attacker could exploit this vulnerability to delete arbitrary files from the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193524](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193524>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| **Version(s)** \n---|--- \nIBM Spectrum Copy Data Management| 2.2.13 and below \n \n\n\n## Remediation/Fixes\n\n**IBM Spectrum Copy Data Management**** Release**| **First Fixing** \n**VRM Level**| **Platform**| **Link to Fix** \n---|---|---|--- \n2.2| 2.2.14| Linux| <https://www.ibm.com/support/pages/node/6507419> \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-12-11T00:37:03", "type": "ibm", "title": "Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26217", "CVE-2020-26258", "CVE-2020-26259", "CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351", "CVE-2021-29505", "CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154"], "modified": "2021-12-11T00:37:03", "id": "007E1AC1E4228B8135E45C63FCEF82799BD02C157157F082CD8D3E0F0D61C361", "href": "https://www.ibm.com/support/pages/node/6525260", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-28T21:38:15", "description": "## Summary\n\nIBM Security Verify Governance uses XStream which is vulnerable to multiple security threats which could allow attackers to perform various attacks like denial of service, arbitrary code execution, file deletion and server-side request forgery. The fix involves upgrading the XStream jar to the patched version.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26217](<https://vulners.com/cve/CVE-2020-26217>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and SecurityVulnerabilityTest.java scripts. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/192210](<https://exchange.xforce.ibmcloud.com/vulnerabilities/192210>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-29505](<https://vulners.com/cve/CVE-2021-29505>) \n** DESCRIPTION: **XStream XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202795](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202795>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2020-26258](<https://vulners.com/cve/CVE-2020-26258>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when unmarshalling. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to obtain sensitive data. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193525](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193525>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26259](<https://vulners.com/cve/CVE-2020-26259>) \n** DESCRIPTION: **XStream could allow a remote attacker to delete arbitrary files from the system, caused by improper input sanitization. By manipulating the processed input, an attacker could exploit this vulnerability to delete arbitrary files from the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193524](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193524>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-43859](<https://vulners.com/cve/CVE-2021-43859>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker could exploit this vulnerability to allocate 100% CPU time on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/219177](<https://exchange.xforce.ibmcloud.com/vulnerabilities/219177>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Security Verify Governance| 10.0 \n \n## Remediation/Fixes\n\nIBM strongly encourages customers to update their systems promptly.\n\nAffected Product(s)\n\n| \n\nVersion(s)\n\n| \n\nFirst Fix \n \n---|---|--- \n \nIBM Security Verify Governance\n\n| \n\n10.0.1\n\n| \n\n[10.0.1.0-ISS-ISVG-IGVA-FP0002](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Tivoli/IBM+Security+Verify+Governance&release=10.0.0.0&platform=Linux&function=fixId&fixids=10.0.1.0-ISS-ISVG-IGVA-FP0002&includeRequisites=1&includeSupersedes=0&downloadMethod=http>) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-11-22T16:29:37", "type": "ibm", "title": "Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26217", "CVE-2020-26258", "CVE-2020-26259", "CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351", "CVE-2021-29505", "CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154", "CVE-2021-43859"], "modified": "2022-11-22T16:29:37", "id": "CEE16EDAFB404DDF033F95C90CAC7DC93AC2A4F7F086C619B9F25A120A2D62C1", "href": "https://www.ibm.com/support/pages/node/6841035", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-28T01:46:57", "description": "## Summary\n\nMultiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-43859](<https://vulners.com/cve/CVE-2021-43859>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker could exploit this vulnerability to allocate 100% CPU time on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/219177](<https://exchange.xforce.ibmcloud.com/vulnerabilities/219177>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nInfoSphere Information Server, InfoSphere Information Server on Cloud| 11.7 \n \n\n\n## Remediation/Fixes\n\n**Product** | **VRMF**| **APAR**| **Remediation** \n---|---|---|--- \nInfoSphere Information Server, InfoSphere Information Server on Cloud| 11.7| [JR64083](<http://www.ibm.com/support/docview.wss?uid=swg1JR64083> \"JR64083\" )| \\--Apply IBM InfoSphere Information Server version [11.7.1.0](<https://www.ibm.com/support/pages/node/878310>) \n\\--Apply IBM InfoSphere Information Server version [11.7.1.3](<https://www.ibm.com/support/pages/node/6498109> \"11.7.1.3\" ) \n\\--Apply Information Server [11.7.1.3 Service pack 4](<https://www.ibm.com/support/pages/node/6568469> \"11.7.1.3 Service pack 4\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-04-27T23:05:41", "type": "ibm", "title": "Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154", "CVE-2021-43859"], "modified": "2022-04-27T23:05:41", "id": "5BF8A9DC926143E23508F6210FE0B532543FD24EDC5C7CD6C44B29877B6C8DDE", "href": "https://www.ibm.com/support/pages/node/6575535", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-02-28T01:53:23", "description": "## Summary\n\nIBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of XStream.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-29505](<https://vulners.com/cve/CVE-2021-29505>) \n** DESCRIPTION: **XStream XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202795](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202795>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nWatson Discovery| 4.0.0 \nWatson Discovery| 2.0.0-2.2.1 \n \n\n\n## Remediation/Fixes\n\nUpgrade to IBM Watson Discovery 4.0.2 \n\nUpgrade to IBM Watson Discovery 2.2.1 and apply cpd-watson-discovery-2.2.1-patch-4\n\n<https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install>\n\n<https://www.ibm.com/support/pages/available-patches-watson-discovery-ibm-cloud-pak-data>\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-10-01T06:19:43", "type": "ibm", "title": "Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-29505", "CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154"], "modified": "2021-10-01T06:19:43", "id": "55839214411417A2AFB018FDF4D19D29C2EC9218038EB311ABEF9AC0DC9B2637", "href": "https://www.ibm.com/support/pages/node/6492209", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-02-28T01:51:56", "description": "## Summary\n\nMultiple vulnerabilities in XStream, such as execution of arbitrary code, denial of service, and server-side request forgery, may affect IBM Spectrum Protect Plus.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| **Version(s)** \n---|--- \nIBM Spectrum Protect Plus| 10.1.0.0-10.1.8.x \n \n## Remediation/Fixes\n\n**IBM Spectrum Protect** \n**Plus Release**| **First Fixing** \n**VRM Level**| **Platform**| **Link to Fix** \n---|---|---|--- \n10.1| 10.1.9| Linux| <https://www.ibm.com/support/pages/node/6487159> \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2021-12-10T20:38:36", "type": "ibm", "title": "Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Protect Plus", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154"], "modified": "2021-12-10T20:38:36", "id": "401F21678376C80B276AF0614D770A3AD8E3D24723155CD0D9EBD1E19DB56B7D", "href": "https://www.ibm.com/support/pages/node/6525066", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-02-28T01:46:05", "description": "## Summary\n\nVulnerabilities in XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE such as execution of arbitrary code, denial of service, server-side request forgery, amd weaker than expected security may affect IBM Spectrum Control.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-4160](<https://vulners.com/cve/CVE-2021-4160>) \n** DESCRIPTION: **OpenSSL could provide weaker than expected security, caused by a carry propagation flaw in the MIPS32 and MIPS64 squaring procedure. An attacker could exploit this vulnerability to launch further attacks on the system \nCVSS Base score: 6.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/218394](<https://exchange.xforce.ibmcloud.com/vulnerabilities/218394>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39152](<https://vulners.com/cve/CVE-2021-39152>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208120](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208120>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-43859](<https://vulners.com/cve/CVE-2021-43859>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote attacker could exploit this vulnerability to allocate 100% CPU time on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/219177](<https://exchange.xforce.ibmcloud.com/vulnerabilities/219177>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39140](<https://vulners.com/cve/CVE-2021-39140>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an infinite loop flaw. By manipulating the processed input stream, a remote authenticated attacker could exploit this vulnerability to allocate 100% CPU time on the target system, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208110](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208110>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39150](<https://vulners.com/cve/CVE-2021-39150>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to conduct SSRF attack to request data from internal resources. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208118](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208118>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2022-23437](<https://vulners.com/cve/CVE-2022-23437>) \n** DESCRIPTION: **Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading a victim to open a specially-crafted XML document payloads, a remote attacker could exploit this vulnerability to consume system resources for prolonged duration. \nCVSS Base score: 5.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217982](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217982>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** IBM X-Force ID: **217968 \n** DESCRIPTION: **FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to serialize and deserialize JsonNode values. By sending a specially crafted request, an attacker could exploit this vulnerability to cause a denial of service. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [https://exchange.xforce.ibmcloud.com/vulnerabilities/217968 ](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217968>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| **Version(s)** \n---|--- \nIBM Spectrum Control| 5.4.0 - 5.4.6 \n \n \n\n\n## Remediation/Fixes\n\n**Release**| ** Link to Fix** \n---|--- \nIBM Spectrum Control v5.4.7| **<https://www.ibm.com/support/pages/latest-downloads-ibm-spectrum-control>** \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-05-26T07:31:20", "type": "ibm", "title": "Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2021-39139", "CVE-2021-39140", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39150", "CVE-2021-39151", "CVE-2021-39152", "CVE-2021-39153", "CVE-2021-39154", "CVE-2021-4160", "CVE-2021-43859", "CVE-2022-23437"], "modified": "2022-05-26T07:31:20", "id": "9530EB6ACBF40BF0B043F5EB44A8DF4581A4EF8F0AD4A4B066F908B8510CE360", "href": "https://www.ibm.com/support/pages/node/6590209", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T21:35:19", "description": "## Summary\n\nXStream is used in ITNCM to serialise data objects to XML and back again. XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-39149](<https://vulners.com/cve/CVE-2021-39149>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208117](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208117>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39144](<https://vulners.com/cve/CVE-2021-39144>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208112](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208112>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39146](<https://vulners.com/cve/CVE-2021-39146>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208114](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208114>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39154](<https://vulners.com/cve/CVE-2021-39154>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208122](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208122>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39153](<https://vulners.com/cve/CVE-2021-39153>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208121](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208121>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39151](<https://vulners.com/cve/CVE-2021-39151>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208119](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208119>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39139](<https://vulners.com/cve/CVE-2021-39139>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208108](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208108>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39141](<https://vulners.com/cve/CVE-2021-39141>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208111](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208111>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39148](<https://vulners.com/cve/CVE-2021-39148>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208116](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208116>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39145](<https://vulners.com/cve/CVE-2021-39145>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208113](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208113>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-39147](<https://vulners.com/cve/CVE-2021-39147>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/208115](<https://exchange.xforce.ibmcloud.com/vulnerabilities/208115>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nITNCM| 6.4.2 \n \n\n\n## Remediation/Fixes\n\nAffected Product(s)| Version(s)| Remediation \n---|---|--- \nITNCM| 6.4.2| Upgrade to ITNCM 6.4.2 Fix Pack 17 (6.4.2.17) \n \nITNCM 6.4.2 Fix Pack 17 can be downloaded from Fix Central: [6.4.2-TIV-ITNCM-FP017](<https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FTivoli+Netcool+Configuration+Manager&fixids=6.4.2-TIV-ITNCM-FP017&source=SAR&function=fixId&parent=ibm/Tivoli> \"6.4.2-TIV-ITNCM-FP017\" )\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-01-24T14:30:09", "type": "ibm", "title": "Security Bulletin: Due to use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to arbitrary code execution attack", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-39139", "CVE-2021-39141", "CVE-2021-39144", "CVE-2021-39145", "CVE-2021-39146", "CVE-2021-39147", "CVE-2021-39148", "CVE-2021-39149", "CVE-2021-39151", "CVE-2021-39153", "CVE-2021-39154"], "modified": "2023-01-24T14:30:09", "id": "9AD36464B7BFAA6C6A8004130473F7EBCFFB8197512C68559A7AF743D6FEEB09", "href": "https://www.ibm.com/support/pages/node/6857277", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-02-28T01:55:45", "description": "## Summary\n\nMultiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed.\n\n## Vulnerability Details\n\n**CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n**DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n**CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n**DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n**CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n**DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n**CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n**DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n**CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n**DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n**CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n**DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n**CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n**DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n**CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n**DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n**CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n**DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n**CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n**DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n**CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n**DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s) | Version(s) \n---|--- \nInfoSphere Information Server | 11.7 \n \n## Remediation/Fixes\n\n**_Product_** | **_VRMF_** | **_APAR_** | **_Remediation/First Fix_** \n---|---|---|--- \nInfoSphere Information Server, \nInformation Server on Cloud | 11.7 | [JR63438](<http://www.ibm.com/support/docview.wss?uid=swg1JR63438> \"JR63438\" ) | \\--Apply InfoSphere Information Server version [11.7.1.0](<https://www.ibm.com/support/docview.wss?uid=ibm10878310> \"11.7.1.0\" ) \n\\--Apply InfoSphere Information Server version [11.7.1.0 Fix Pack 1](<https://www.ibm.com/support/pages/node/6209196> \"11.7.1.0 Fix Pack 1\" ) \n\\--Apply InfoSphere Information Server [11.7.1.1 Service Pack 2](<https://www.ibm.com/support/pages/node/6466751> \"11.7.1.1 Service Pack 2\" ) \n \nFor Red Hat 8 installations, contact IBM Customer support \n \n**Contact Technical Support:**\n\nIn the United States and Canada dial **1-800-IBM-SERV** \nView the support [contacts for other countries](<http://www.ibm.com/planetwide/>) outside of the United States. \nElectronically [open a Service Request](<http://www.ibm.com/software/support/probsub.html>) with Information Server Technical Support.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-07-08T19:08:29", "type": "ibm", "title": "Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351"], "modified": "2021-07-08T19:08:29", "id": "F000446708B91A19B1F61CA99B1AF67BFEB9C3B680087EEAA89007C8D02D6447", "href": "https://www.ibm.com/support/pages/node/6468567", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-28T01:54:44", "description": "## Summary\n\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a allowlist limited to the minimal required types. If you rely on XStream's default blocklist of the Security Framework, you will have to use at least version 1.4.16.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\n \n\n\nAffected Product(s)| Version(s) \n---|--- \nITNCM| 6.4.2 \n \n\n\n## Remediation/Fixes\n\n \n\n\nAffected Product(s)| Version(s)| Remediation \n---|---|--- \nITNCM| 6.4.2| Upgrade to ITNCM 6.4.2 Fix Pack 14 (6.4.2.14) \n \nITNCM 6.4.2 Fix Pack 14 can be downloaded from Fix Central\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-08-23T05:52:50", "type": "ibm", "title": "Security Bulletin: XStream (Publicly disclosed vulnerability)", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351"], "modified": "2021-08-23T05:52:50", "id": "D92ADA90B46EC7B09898EB31D2D008827097E27BEC48AE4B2D1B9121A6F37C05", "href": "https://www.ibm.com/support/pages/node/6483059", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-28T01:57:10", "description": "## Summary\n\nIBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of XStream.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nICP - Discovery| 2.0.0-2.2.1 \n \n\n\n## Remediation/Fixes\n\nUpgrade to IBM Watson Discovery 2.2.1 and apply 2.2.1 patch-2 \n\n<https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install>\n\n<https://www.ibm.com/support/pages/available-patches-watson-discovery-ibm-cloud-pak-data>\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-05-14T01:38:05", "type": "ibm", "title": "Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351"], "modified": "2021-05-14T01:38:05", "id": "FDA97DD243269D8176D4598B89F04D28DF3C51AA39B222AF75B2387650313DA7", "href": "https://www.ibm.com/support/pages/node/6450783", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-28T01:43:45", "description": "## Summary\n\nIBM Engineering Test Management is vulnerable to arbitrary code execution due to XStream. (CVE-2021-21342, CVE-2021-21350, CVE-2021-21346, CVE-2021-21349, CVE-2021-21341, CVE-2021-21345, CVE-2021-21348, CVE-2021-21344, CVE-2021-21347, CVE-2021-21343, CVE-2021-21351)\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nRational Quality Manager (RQM)| 6.0.6.1 \nEngineering Test Management (ETM)| 7.0.1 \nETM| 7.0.2 \nRQM| 6.0.6 \nETM| 7.0.0 \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends addressing the vulnerability now by upgrading to following IBM Engineering Test Management releases or any version later : \n\n * [IBM Engineering Test Management 7.0.2 iFix008](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Test+Management&release=7.0.2&platform=All&function=all> \"IBM Engineering Test Management 7.0.2 iFix008\" )\n * [IBM Engineering Test Management 7.0.1 iFix012](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Test+Management&release=7.0.1&platform=All&function=all> \"IBM Engineering Test Management 7.0.1 iFix017\" )\n * [IBM Engineering Test Management 7.0 iFix013](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Engineering&product=ibm/Rational/IBM+Engineering+Lifecycle+Management&release=7.0&platform=All&function=all> \"IBM Engineering Test Management 7.0 iFix016\" )\n * [Rational Quality Manager 6.0.6.1 iFix020](<http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Rational&product=ibm/Rational/Rational+Quality+Manager&release=6.0.6.1&platform=All&function=all> \"Rational Quality Manager 6.0.6.1 iFix020\" )\n * [Rational Quality Manager 6.0.6 iFix024](<http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Rational&product=ibm/Rational/Rational+Quality+Manager&release=6.0.6&platform=All&function=all> \"Rational Quality Manager 6.0.6 iFix024\" )\n\n## Workarounds and Mitigations\n\nNone.\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2022-07-26T06:38:02", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilites affect IBM Engineering Test Management product due to XStream", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351"], "modified": "2022-07-26T06:38:02", "id": "2C7412E482349885BC031D8092C58A0522256DA1A334A7F460ABFBD30F40BDE0", "href": "https://www.ibm.com/support/pages/node/6607095", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-27T21:44:03", "description": "## Summary\n\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.\n\n## Vulnerability Details\n\nRefer to the security bulletin(s) listed in the Remediation/Fixes section\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nUCD - IBM UrbanCode Deploy| 7.0.5.3 \nUCD - IBM UrbanCode Deploy| 7.1.0.0 \nUCD - IBM UrbanCode Deploy| 6.2.7.4 \nUCD - IBM UrbanCode Deploy| 6.2.7.3 \nUCD - IBM UrbanCode Deploy| 6.2.7.8 \nUCD - IBM UrbanCode Deploy| 7.0.4.0 \nUCD - IBM UrbanCode Deploy| 7.0.3.0 \n \n \n\n\n \n\n\n## Remediation/Fixes\n\nUpdate to IBM UrbanCode Deploy [7.1.0.1](<https://www.ibm.com/support/fixcentral/swg/selectFixes?fixids=7.1.0.1.ifix01-IBM-UrbanCode-Deploy&product=ibm%2FRational%2FIBM%20UrbanCode%20Deploy&source=dbluesearch&mhsrc=ibmsearch_s&mhq=UrbanCode%20Deploy&function=fixId&parent=ibm/Rational> \"7.1.0.1\" ), [6.2.7.9](<https://www.ibm.com/support/fixcentral/swg/selectFixes?fixids=6.2.7.9-IBM-UrbanCode-Deploy&product=ibm%2FRational%2FIBM%20UrbanCode%20Deploy&source=dbluesearch&mhsrc=ibmsearch_s&mhq=UrbanCode%20Deploy&function=fixId&parent=ibm/Rational> \"6.2.7.9\" ), or [7.0.5.4](<https://www.ibm.com/support/fixcentral/swg/selectFixes?fixids=7.0.5.4-IBM-UrbanCode-Deploy&product=ibm%2FRational%2FIBM%20UrbanCode%20Deploy&source=dbluesearch&mhsrc=ibmsearch_s&mhq=UrbanCode%20Deploy&function=fixId&parent=ibm/Rational> \"7.0.5.4\" ) or later. These releases no longer include the xstream library, and therefore the following CVE's no longer apply: \n\n \n\n\nCVE-2021-21351 \nCVE-2021-21341 \nCVE-2021-21344 \nCVE-2021-21348 \nCVE-2021-21345 \nCVE-2021-21342 \nCVE-2021-21346 \nCVE-2021-21343 \nCVE-2021-21347 \nCVE-2021-21349 \nCVE-2021-21350\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-04-13T21:10:50", "type": "ibm", "title": "Security Bulletin: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351"], "modified": "2021-04-13T21:10:50", "id": "3AB9E06E0036C8F4205D0B9C799D43CE7751D6227E9C183F98AF145F9DCCCE6B", "href": "https://www.ibm.com/support/pages/node/6442999", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-28T01:37:07", "description": "## Summary\n\nVulnerabilities in Java affects IBM Cloud Application Business Insights - Quaterly Java update, CVE-2021-35603 and CVE-2021-35550\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Cloud Application Business Insights| 1.1.7 \nIBM Cloud Application Business Insights| 1.1.6 \n \n \n\n\n## Remediation/Fixes\n\nFor systems where IBM Cloud Application Business Insights version 1.1.7 is installed, the vulnerabilities can be remediated by applying the ICABI FixPack 1.1.7.4. \n\nFor systems where IBM Cloud Application Business Insights version 1.1.6 is installed, the vulnerabilities can be remediated by applying the ICABI FixPack 1.1.6.6.\n\n**The fixes and install instructions can be found at the following location:**\n\n**Fix Pack**| **Download Link (Fix Central)** \n---|--- \nICABI 1.1.7.4 Fix Pack| \n\n[http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Cloud+App+Management&amp;fixids=ICABI_1.1.7.4.xml&amp;source=SAR](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Cloud+App+Management&fixids=ICABI_1.1.7.4.xml&source=SAR>) \n \nICABI 1.1.7.4 Fix Pack (pLinux)| \n\n[http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Cloud+App+Management&amp;fixids=ICABI_1.1.7.4_pLinux&amp;source=SAR](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Cloud+App+Management&fixids=ICABI_1.1.7.4_pLinux&source=SAR>) \n \nICABI 1.1.6.6 Fix Pack| \n\n[http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Cloud+App+Management&amp;fixids=ICABI_1.1.6.6&amp;source=SAR](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FIBM+Cloud+App+Management&fixids=ICABI_1.1.6.6&source=SAR>) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-12-30T15:09:22", "type": "ibm", "title": "Security Bulletin: Vulnerabilities in Java affects IBM Cloud Application Business Insights - Quaterly Java update, CVE-2021-35603 and CVE-2021-35550", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-12-30T15:09:22", "id": "006B840BADC68F9143BFB9DEB8F134915B185FD525BA7DAEF54E58E6E5CE5325", "href": "https://www.ibm.com/support/pages/node/6594745", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T01:45:48", "description": "## Summary\n\nIBM\u00ae SDK Java\u2122 Technology Edition and IBM\u00ae Runtime Environment Java\u2122 used by IBM i are vulnerable to unauthorized attacker obtaining sensitive information and other vulnerabilities as described in the vulnerability details section. The vulnerability is fixed by applying a Group PTF as described in the Remediation/Fixes section.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM i| 7.5 \nIBM i| 7.4 \nIBM i| 7.3 \nIBM i| 7.2 \n \n\n\n## Remediation/Fixes\n\nThese vulnerabilities can be fixed by applying the latest Java Group PTF to the IBM i Operating System. \n\nPlease see the Java document at this URL for the latest Java information for IBM i: \n<https://www.ibm.com/support/pages/java-ibm-i>\n\nReleases 7.5, 7.4, 7.3, and 7.2 of IBM i will be fixed. \nThe IBM i Group PTF numbers containing the fix for the vulnerability follows. Future Group PTFs for Java will also contain the fix for these vulnerabilities.\n\nIBM i Release| 5770-JV1 Group PTF Number and Level| PTF Download Link \n---|---|--- \n7.5| \n\nSF99955 Level 1\n\n| \n\n<https://www.ibm.com/support/pages/sf99955-750-java-level-1> \n \n7.4| \n\nSF99665 Level 14\n\n| \n\n<https://www.ibm.com/support/pages/sf99665-740-java-level-14> \n \n7.3| \n\nSF99725 Level 25\n\n| \n\n<https://www.ibm.com/support/pages/sf99725-730-java-level-25> \n \n7.2| \n\nSF99716 Level 35\n\n| \n\n<https://www.ibm.com/support/pages/sf99716-720-java-level-35> \n \nIf you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether additional Java vulnerabilities are applicable to your code. For a complete list of vulnerabilities, refer to the \"IBM Java SDK Security Vulnerabilities\", located in the References section for more information.\n\n**Important note: _IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products._**\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-06-02T20:54:33", "type": "ibm", "title": "Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthenticated attacker obtaining sensitive information and other attacks due to multiple vulnerabilities.", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-02T20:54:33", "id": "5D37D9894107E099AF55AB01810271292EA8713125D23C65AF66AC7E5D960981", "href": "https://www.ibm.com/support/pages/node/6591519", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T01:46:58", "description": "## Summary\n\nIBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nWatson Discovery| 4.0.0-4.0.7 \nWatson Discovery| 2.0.0-2.2.1 \n \n\n\n## Remediation/Fixes\n\nUpgrade to IBM Watson Discovery 4.0.8 \n\nUpgrade to IBM Watson Discovery 2.2.1 and apply cpd-watson-discovery-2.2.1-patch-10\n\n<https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-install>\n\n<https://www.ibm.com/support/pages/available-patches-watson-discovery-ibm-cloud-pak-data>\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-04-27T14:53:08", "type": "ibm", "title": "Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-04-27T14:53:08", "id": "C620E533FFA4572A8A147EB0AA52BF2066886CC78F0AFA9232BBBF4E21B81BEB", "href": "https://www.ibm.com/support/pages/node/6570941", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T01:47:00", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition used by IBM Integration Bus &amp; IBM App Connect Enterprise. These issues were disclosed as part of the IBM Java SDK updates in the January 2022\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\n## Affected Products and Versions\n\n**Product(s)**\n\n| **Version(s)** \n---|--- \nIBM App Connect Enterprise| v12.0.1.0 to v12.0.4.0 \nIBM App Connect Enterprise| v11.0.0.0 to v11.0.0.17 \n \nIBM Integration Bus\n\n| v10.0.0.0 to v10.0.0.25 \n \n\n\n## Remediation/Fixes\n\n**IBM strongly recommends addressing the vulnerability/vulnerabilities now by the applying the appropriate fix to IBM Integration Bus/IBM App Connect Enterprise**\n\n**Product(s)**\n\n| **Version(s)**| **APAR**| \n\n**Remediation / Fix** \n \n---|---|---|--- \nIBM App Connect Enterprise| v12.0.1.0 to v12.0.4.0| IT40441| \n\nInterim fix for APAR (IT40441) is available from\n\n[IBM Fix Central](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+App+Connect+Enterprise&release=12.0.4.0&platform=All&function=aparId&apars=IT40441> \"IBM Fix Central\" ) \n \nIBM App Connect Enterprise| v11.0.0.0 to v11.0.0.17| IT40441 | \n\nInterim fix for APAR (IT40441) is available from\n\n[IBM Fix Central](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+App+Connect+Enterprise&release=11.0.0.17&platform=All&function=aparId&apars=IT40441> \"IBM Fix Central\" ) \n \nIBM Integration Bus\n\n| v10.0.0.0 to v10.0.0.25| IT40441| \n\nInterim fix for APAR (IT40441) is available from\n\n[IBM Fix Central](<https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/Integration+Bus&release=10.0.0.25&platform=All&function=aparId&apars=IT40441> \"IBM Fix Central\" ) \n \n## Workarounds and Mitigations\n\n**as per the Remediation/Fixes plan**\n\n## ", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-04-27T10:39:35", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM Java Runtime which affects IBM Integration Bus and IBM App Connect Enterprise", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-04-27T10:39:35", "id": "C71DDFC63060CAC9DB6117AB095CFA4A88D16B5941EC25773ADD896BB601E27C", "href": "https://www.ibm.com/support/pages/node/6575365", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T01:48:15", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition, Version 1.8 and IBM\u00ae Runtime Environment Java\u2122 Version 1.8 used by Rational Functional Tester. Rational Functional Tester has addressed the applicable CVEs.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nRFT| 9.1 \nRFT| 9.2 \nRFT| 9.5 \n \n\n\n## Remediation/Fixes\n\n**Product**| **Version**| **APAR**| **Remediation/ Fix** \n---|---|---|--- \nRFT| 9.1 - 9.1.1.1, and 9.2 - 9.5| None| Download IBM SDK, Java Technology Edition, Version 8R0 Service Refresh 7 Fix Pack 5 from the Fix Central and apply it. [https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7ERational&amp;product=ibm/Rational/Rational+Functional+Tester&amp;release=9.5.0&amp;platform=All&amp;function=fixId&amp;fixids=Rational-RFT-JavaPatch-Java8SR7FP5&amp;includeRequisites=1&amp;includeSupersedes=0&amp;downloadMethod=http&amp;login=true](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7ERational&product=ibm/Rational/Rational+Functional+Tester&release=9.5.0&platform=All&function=fixId&fixids=Rational-RFT-JavaPatch-Java8SR7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http&login=true>) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-03-23T07:10:55", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Functional Tester", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-03-23T07:10:55", "id": "D3ED00EF6FDB857A7DDB990044338D6699A0B7C70D288C7BC0B9459A58DDCF76", "href": "https://www.ibm.com/support/pages/node/6565659", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T01:45:25", "description": "## Summary\n\nJava SE is used by IBM TXSeries for Multiplatforms to run WebSphere Liberty, Fix Installer and Java based CICS applications in the product. The following CVEs are applicable: Denial of service CVEs - CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21294, CVE-2022-21293, CVE-2022-21248. No confidentiality impact and low integrity impact CVEs - CVE-2022-21305, CVE-2022-21291.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM TXSeries for Multiplatforms| 8.2 \nIBM TXSeries for Multiplatforms| 9.1 \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends you apply these fixes \n\nProduct\n\n| \n\nVersion\n\n| \n\nDefect\n\n| \n\nRemediation / First Fix \n \n---|---|---|--- \n \nIBM TXSeries for Multiplatforms v9.1\n\n| \n\n9.1.0.0 \n9.1.0.2\n\n| \n\n127699\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FTXSeries+for+Multiplatforms&fixids=TXSeries_91_SpecialFIX_Java_062022&source=SAR> \"Fix Central Link\" ) \n \nIBM TXSeries for Multiplatforms v8.2\n\n| \n\n8.2.0.0 \n8.2.0.1 \n8.2.0.2\n\n| \n\n127699\n\n| [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FTXSeries+for+Multiplatforms&fixids=TXSeries_82_SpecialFIX_Java_062022&source=SAR> \"Fix Central Link\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-15T15:49:41", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in Java SE affect IBM TXSeries for Multiplatforms", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-15T15:49:41", "id": "CE775945F289BD36F1D2084FEABB7571C4F15F7453E6FB8935C6504A39748020", "href": "https://www.ibm.com/support/pages/node/6595161", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-15T01:33:13", "description": "## Summary\n\nJava SE is used by IBM CICS TX Advanced to run WebSphere Liberty, Fix Installer and Java based CICS applications in the product. The following CVEs are applicable: Denial of service CVEs - CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21294, CVE-2022-21293, CVE-2022-21248. No confidentiality impact and low integrity impact CVEs - CVE-2022-21305, CVE-2022-21291\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM CICS TX Advanced| 10.1 \nIBM CICS TX Advanced| 11.1 \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends you apply the following fixes \n\nProduct \n\n| \n\nVersion \n\n| \n\nDefect \n\n| \n\nRemediation / First Fix \n \n---|---|---|--- \n \nIBM CICS TX Advanced \n\n| \n\n11.1\n\n| \n\n127699\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FCICS+TX+on+Cloud&fixids=ibm-cics-tx-advanced-image-11.1.0.0-ifix2&source=SAR> \"Fix Central Link\" ) \n \nIBM CICS TX Advanced\n\n| \n\n10.1\n\n| \n\n127699\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FCICS+TX+on+Cloud&fixids=ibm-cics-tx-advanced-docker-image-10.1.0.0-ifix9&source=SAR> \"Fix Central Link\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-02-14T21:04:36", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in Java SE affect IBM CICS TX Advanced", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2023-02-14T21:04:36", "id": "116303B95D4B05625352F4B4983E591A174E56CE825865FBC6C2E50F189B1946", "href": "https://www.ibm.com/support/pages/node/6595159", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-15T05:32:52", "description": "## Summary\n\nJava SE is used by IBM CICS TX Standard to run WebSphere Liberty, Fix Installer and Java based CICS applications in the product. The following CVEs are applicable: Denial of service CVEs - CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21294, CVE-2022-21293, CVE-2022-21248. No confidentiality impact and low integrity impact CVEs - CVE-2022-21305, CVE-2022-21291\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM CICS TX Standard| 11.1 \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends you apply the following fix \n\nProduct \n\n| \n\nVersion \n\n| \n\nDefect \n\n| \n\nRemediation / First Fix \n \n---|---|---|--- \n \nIBM CICS TX Standard \n\n| \n\n11.1\n\n| \n\n127699 \n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FCICS+TX+Standard&fixids=ibm-cics-tx-standard-image-11.1.0.0-ifix2&source=SAR> \"Fix Central Link\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-02-14T21:14:53", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in Java SE affect IBM CICS TX Standard", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2023-02-14T21:14:53", "id": "4B1A4A09D6ABB8D3DBABBBB15304AC93C628BB6C8917F6E379CBB7C2B74995D7", "href": "https://www.ibm.com/support/pages/node/6595153", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:42:14", "description": "## Summary\n\nMultiple vulnerabilities have been identified in Oracle January 2022 CPU for Java 8 which is shipped with IBM\u00ae Intelligent Operations Center. Information about these vulnerabilities affecting IBM\u00ae Intelligent Operations Center have been published and addressed the applicable CVEs.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIntelligent Operations Center (IOC) | 5.1.0, 5.1.0.2 ,5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1, 5.2.2 \n \n\n\n## Remediation/Fixes\n\nThe recommended solution is to apply an interim fix that contains the fix for this issue as soon as practical. \n\nDownload the IBM Intelligent Operations Center Version 5.2.3 is an upgrade to IBM Intelligent Operations Center Version 5.2.2 through IBM Intelligent Operations Center Version 5.2 from the following link:\n\n[IBM Intelligent Operations Center Version 5.2.3](<https://www.ibm.com/support/pages/node/6610605> \"IBM Intelligent Operations Center Version 5.2.3\" )\n\nInstallation instructions for the fix are included in the readme document that is in the fix package.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-09-07T12:15:32", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities have been identified in IBM Java 8 shipped with IBM\u00ae Intelligent Operations Center (CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-20)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-09-07T12:15:32", "id": "FED518F1BE68A68CF01E2CE3888B85890D717B12247E4C447108C458E733EDFA", "href": "https://www.ibm.com/support/pages/node/6618717", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:44:58", "description": "## Summary\n\nThere are a number of vulnerabilities in the Java JDK used by IBM Event Streams.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Event Streams (Continuous Delivery)| \n\n10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.4.0 \n \nIBM Event Streams (Extended Update Support)| 10.2.0-eus, 10.2.1-eus (2.2.1, 2.2.2, and 2.2.3) \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends addressing the vulnerability now by upgrading \n\n**IBM Event Streams (Continuous Delivery)**\n\n * Upgrade to IBM Event Streams 10.5.0 by following the [upgrading and migrating](<https://ibm.github.io/event-streams/10.5/installing/upgrading/> \"upgrading and migrating\" ) documentation.\n\n**IBM Event Streams (Extended Update Support)**\n\n * Upgrade to IBM Event Streams 10.2.1-eus (2.2.4) by following the [upgrading and migrating](<https://ibm.github.io/event-streams/10.2/installing/upgrading/> \"\" ) documentation.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-27T10:32:59", "type": "ibm", "title": "Security Bulletin: Vulnerabilities in the Java JDK affect IBM Event Streams (CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21248)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-27T10:32:59", "id": "A5D66703DB49524BC0E6FF153597AE66CD2BEDC4A2F7CBC9286EC444D39E58E0", "href": "https://www.ibm.com/support/pages/node/6598745", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:45:10", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in Jan 2022.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nITCAM for Transactions| 7.4.0.x \n \n\n\n## Remediation/Fixes\n\n**Product Name**| **VRMF**| **APAR**| **Remediation/First Fix** \n---|---|---|--- \nITCAM for Transactions| 7.4.0.x| | 7.4.0.1-TIV-CAMRT-IF0058 for different platforms: [7.4.0.1-TIV-CAMRT-AIX-IF0058](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FTivoli+Composite+Application+Manager+for+Transactions&fixids=7.4.0.1-TIV-CAMRT-AIX-IF0058&source=SAR&function=fixId&parent=Tivoli%20Composite%20Application%20Manager> \"7.4.0.1-TIV-CAMRT-AIX-IF0058\" )\n\n[7.4.0.1-TIV-CAMRT-LINUX-IF0058](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FTivoli+Composite+Application+Manager+for+Transactions&fixids=7.4.0.1-TIV-CAMRT-LINUX-IF0058&source=SAR&function=fixId&parent=Tivoli%20Composite%20Application%20Manager> \"7.4.0.1-TIV-CAMRT-LINUX-IF0058\" )\n\n[7.4.0.1-TIV-CAMRT-WINDOWS-IF0058](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FTivoli+Composite+Application+Manager+for+Transactions&fixids=7.4.0.1-TIV-CAMRT-WINDOWS-IF0058&source=SAR&function=fixId&parent=Tivoli%20Composite%20Application%20Manager> \"7.4.0.1-TIV-CAMRT-WINDOWS-IF0058\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-22T02:20:49", "type": "ibm", "title": "Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2022 - Includes Oracle\u00ae January 2022 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-22T02:20:49", "id": "03ABF1F2B2FD0953F8EB3B027A7B4518DE0EE743E4F242C3FB5BEC357F568F89", "href": "https://www.ibm.com/support/pages/node/6597491", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:45:11", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae Runtime Environment Java\u2122 Versions. Sterling Connect:Direct Browser User Interface has addressed the applicable CVEs.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| **Version(s)** \n---|--- \nIBM Sterling Connect:Direct Browser User Interface| 1.5.0.2 \nIBM Sterling Connect:Direct Browser User Interface| 1.4.1.1 \n \n\n\n## Remediation/Fixes\n\n**Product**| **Version**| **Fix/Remediation \n** \n---|---|--- \nIBM Sterling Connect:Direct Browser User Interface| 1.4.1.1, 1.5.0.2| Apply 1.5.0.2 iFix-32, available in cumulative iFix030 on [Fix Central](<https://www.ibm.com/support/fixcentral/options?selectionBean.selectedTab=find&selection=ibm%2fOther+software%3bibm%2fOther+software%2fSterling+Connect%3aDirect+Browser+User+Interface> \"\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-21T20:13:13", "type": "ibm", "title": "Security Bulletin: IBM Sterling Connect:Direct Browser User Interface has multiple vulnerabilities due to IBM Java", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-21T20:13:13", "id": "43D2B0D4C08D283A5A1AC580A4FBB9FBD53D3F9F84D3FDD4A3550314699C083D", "href": "https://www.ibm.com/support/pages/node/6597279", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:48:01", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology used by IBM WebSphere Cast Iron Solution &amp; App Connect Professional. These issues were disclosed as part of the IBM Java SDK updates in January 2022 , IBM WebSphere Cast Iron Solution &amp; App Connect Professional have addressed the applicable CVEs. \n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nWebSphere Cast Iron | 7.5.1.0 \nApp Connect Professional| 7.5.2.0 \nApp Connect Professional| 7.5.3.0 \nApp Connect Professional| 7.5.4.0 \nApp Connect Professional| 7.5.5.0 \n \n\n\n## Remediation/Fixes\n\n_Product_| _VRMF_| _APAR_| _Remediation/First Fix_ \n---|---|---|--- \nApp Connect Professional| 7.5.4.0| LI82566| [7540 Fixcentral link](<http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm%2FWebSphere%2FApp+Connect+Professional&release=7.5.4.0&platform=All&function=fixId&fixids=7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.builtDockerImage,7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.docker,7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.vcrypt2,7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.sc-linux,7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.32bit.sc-linux,7.5.4.0-WS-ACP-20220316-1229_H8_64-CUMUIFIX-027.studio,7.5.4.0-WS-ACP-20220316-1229_H8_64-CUMUIFIX-027.32bit.studio,7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.32bit.sc-win,7.5.4.0-WS-ACP-20220318-0252_H28_64-CUMUIFIX-027.sc-win,&includeSupersedes=0> \"7540 Fixcentral link\" ) \nApp Connect Professional| 7.5.5.0| LI82566| [7550 Fixcentral link](<http://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm%2FWebSphere%2FApp+Connect+Professional&release=7.5.5.0&platform=All&function=fixId&fixids=7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.builtDockerImage,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.docker,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.vcrypt2,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.sc-linux,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.32bit.sc-linux,7.5.5.0-WS-ACP-20220321-0730_H7_64-CUMUIFIX-010.studio,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.ova,7.5.5.0-WS-ACP-20220321-0730_H7_64-CUMUIFIX-010.32bit.studio,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.32bit.sc-win,7.5.5.0-WS-ACP-20220321-0730_H31_64-CUMUIFIX-010.sc-win,&includeSupersedes=0> \"7550 Fixcentral link\" ) \n \nNote :- Customers with WebSphere Cast Iron v7.5.1 , App connect Professional v7.5.2 and 7.5.3 these vulnerabilities are addressed in App connect professional v7.5.5.0, customer should migrate to ACPv755 version without incurring any additional cost. \n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-04-01T06:22:35", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-04-01T06:22:35", "id": "CE7EFA1A3E604C6F25678505CC8FABC5CB819C691C6747E68755DE6B7F031791", "href": "https://www.ibm.com/support/pages/node/6568255", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:47:15", "description": "## Summary\n\nIBM\u00ae SDK Java\u2122 Technology Edition, is used by IBM Tivoli Application Dependency Discovery Manager (TADDM) and is vulnerable to a denial of service (CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21248).\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Tivoli Application Dependency Discovery Manager| 7.3.0.0 - 7.3.0.9 \n \n## Remediation/Fixes\n\nIn order to fix this vulnerability, java is to be upgraded to 8.0.7.5 for TADDM versions 7.3.0.5 - 7.3.0.9 or to 7.0.11.5 for TADDM versions 7.3.0.3 - 7.3.0.4.\n\nCheck java version installed on TADDM servers using the below command:\n\n$COLLATION_HOME/external/&lt;jdk- folder according to OS&gt;/bin/java -version\n\n * For TADDM 7.3.0.5 - 7.3.0.9 (JAVA 8), if the above command output contains **\"SR6 FP10\"** or \"**8.0.6.10**\" or Higher as build in Java(TM) SE Runtime Environment information, apply efix for the new IBM SDK only, **efix_jdk8.0.7.5_FP9211123.zip** given in Table-1 below.\n * For TADDM 7.3.0.3 - 7.3.0.4 (JAVA 7), if the above command output contains **\"SR10 FP65\"** or \"**7.0.10.65**\" or Higher as build in Java(TM) SE Runtime Environment information, apply efix for the new IBM SDK only, **efix_jdk7.0.11.5_FP420171214.zip** given in Table-1 below.\n * For TADDM 7.3.0.0 - 7.3.0.2 (JAVA 7), Please upgrade to IBM Tivoli Application Dependency Discovery Manager Version 7.3.0.3 or later (Preferably the latest release 7.3.0.9) and Apply the above mentioned for (7.3.0.3 - 7.3.0.4) or (7.3.0.5 - 7.3.0.9)\n * For all other cases,\n\nThe remediation consists of 2 steps:\n\n 1. Please contact IBM Support and open a case for a custom version of eFix \"**customJDK8.0.6.10**\" as this efix involves TADDM code changes. Include the current eFix level (ls -rlt etc/efix*), TADDM version and a link to this bulletin.\n 2. Alongwith the above efix, apply efix for the new IBM SDK as per TADDM version given in table below.\n\n**Table-1:**\n\nPlease get familiar with the eFix readme in etc/efix_readme.txt. These fixes for the respective FixPack(s) can be downloaded and applied directly.\n\n**Fix**| \n\n**VRMF **\n\n| **APAR**| **How to acquire fix** \n---|---|---|--- \nefix_jdk8.0.7.5_FP9211123.zip| \n\n7.3.0.5 - 7.3.0.9\n\n| None| [Download eFix](<https://www.secure.ecurep.ibm.com/download/?id=14jRGBdDuCuzWaqGRzkr8Sn6kopR7soamOIJlWDaj8I> \"Download eFix\" ) \nefix_jdk7.0.11.5_FP420171214.zip| \n\n7.3.0.3 - 7.3.0.4 \n\n| None| [Download eFix](<https://www.secure.ecurep.ibm.com/download/?id=Xt66BL4ZqctdwhNduMlQ8yef57D23T6aLzf90uXVb8E> \"Download eFix\" ) \n \n**Table-2:**\n\nBelow are the JREs :\n\n**Fix**| \n\n**VRMF **\n\n| **APAR**| **How to acquire fix** \n---|---|---|--- \nibm-java-jre-80-win-i386| \n\n7.3.0.5 - 7.3.0.9\n\n| None| [Download eFix](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FTivoli+Application+Dependency+Discovery+Manager&fixids=ibm-java-jre-80-win-i386&source=SAR> \"\" ) \nibm-java-jre-70-win-i386| \n\n7.3.0.3 - 7.3.0.4 \n\n| None| [Download eFix](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FTivoli%2FTivoli+Application+Dependency+Discovery+Manager&fixids=ibm-java-jre-70-win-i386&source=SAR> \"Download eFix\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-04-25T15:54:22", "type": "ibm", "title": "Security Bulletin: Due to use of IBM SDK, Java Technology Edition, IBM Tivoli Application Dependency Discovery Manager (TADDM) is vulnerable to denial of service", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-04-25T15:54:22", "id": "6D5D91620BF302DA5E3CBD00F8AE47E9657A3AB849EF71820A9FF0156C66535F", "href": "https://www.ibm.com/support/pages/node/6574811", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:43:56", "description": "## Summary\n\nIBM Java is used by IBM Rational Build Forge. Multple vulnerabilities have been identified (CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, and CVE-2022-21248). These vulnerabiltiies have been addressed.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Rational Build Forge| 8.0.0 - 8.0.0.22 \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends addressing the vulnerability now by upgrading to IBM Rational Build Forge version 8.0.0.23 or above. \n\n**Affected Supporting Product(s)**\n\n| \n\n**Remediation/Fix** \n \n---|--- \n \nIBM Rational Build Forge 8.0.0 to 8.0.0.22\n\n| \n\n[Download](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FRational%2FRational+Build+Forge&fixids=RationalBuildForge-8.0.0.23&source=SAR> \"Download\" ) IBM Rational Build Forge 8.0.0.23.\n\nThe fix includes IBM-JDK-8.0.7.10. \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-07-21T05:22:47", "type": "ibm", "title": "Security Bulletin: IBM Rational Build Forge is vulnerable to unspecified vulnerabilities due to the use of IBM Java.", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-07-21T05:22:47", "id": "430959A1FFDDCF67CED9618F6D7D9D4AA3375ACDF3A78F328893A6F7C60F4F35", "href": "https://www.ibm.com/support/pages/node/6606241", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:45:14", "description": "## Summary\n\nIBM WebSphere Application Server is shipped as a component of IBM WebSphere Application Server Patterns. There are multiple vulnerabilities in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the IBM Java SDK updates in October 2021. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published and is referenced in this security bulletin.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\n**IBM Java SDK shipped with IBM WebSphere Application Server Patterns 1.0.0.0 through 1.0.0.7 and 2.2.0.0 through 2.3.3.4.**\n\n \n\n\n## Remediation/Fixes\n\nPlease see the [IBM Java SDK Security Bulletin for IBM WebSphere Application Server](<https://www.ibm.com/support/pages/node/6559306> \"IBM Java SDK Security Bulletin for IBM WebSphere Application Server\" ) to determine which IBM WebSphere Application Server versions are affected and to obtain the JDK fixes. The interim fix [1.0.0.0-WS-WASPATTERNS-JDK-2201](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%2FWebSphere&product=ibm/WebSphere/WebSphere+Application+Server+Patterns&release=All&platform=All&function=fixId&fixids=1.0.0.0-WS-WASPATTERNS-JDK-2201&includeSupersedes=0> \"1.0.0.0-WS-WASPATTERNS-JDK-2201\" ) can be used to apply the January 2022 SDK iFixes in a PureApplication or Cloud Pak System Environment. \n\nDownload and apply the interim fix [1.0.0.0-WS-WASPATTERNS-JDK-2201](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%2FWebSphere&product=ibm/WebSphere/WebSphere+Application+Server+Patterns&release=All&platform=All&function=fixId&fixids=1.0.0.0-WS-WASPATTERNS-JDK-2201&includeSupersedes=0> \"1.0.0.0-WS-WASPATTERNS-JDK-2201\" )[.](<https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%2FWebSphere&product=ibm/WebSphere/WebSphere+Application+Server+Patterns&release=All&platform=All&function=fixId&fixids=1.0.0.0-WS-WASPATTERNS-JDK-2107&includeSupersedes=0> \"\" )\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-21T22:19:04", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM WebSphere Application Server January 2022 CPU that is bundled with IBM WebSphere Application Server Patterns", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-21T22:19:04", "id": "75EBAEF3802E5D231DDFEFE9E207A551984F9C800735545B1ECF45F84E8E9C99", "href": "https://www.ibm.com/support/pages/node/6597261", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:45:11", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition, Version 8 used by IBM Tivoli Business Service Manager. IBM Tivoli Business Service Manager has addressed the applicable CVEs.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Tivoli Business Service Manager| 6.2.0 \n \n\n\n## Remediation/Fixes\n\n### Remediation/Fixes:\n\nProduct| VRMF| APAR| Remediation \n---|---|---|--- \nIBM Tivoli Business Service Manager 6.2.0| 6.2.0.4| IJ39969| Upgrade to Upgrade to [IBM Tivoli Business Service Manager 6.2.0.4](<https://www.ibm.com/support/pages/node/6578641> \"IBM Tivoli Business Service Manager 6.2.0.4\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-22T04:07:46", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-22T04:07:46", "id": "05C269FD75BC7C24A326E5E6DE43E840168855B7B7039658D182C375AA61EAF0", "href": "https://www.ibm.com/support/pages/node/6597495", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:44:51", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition, Version 8 used by IBM Tivoli Netcool Impact. IBM Tivoli Netcool Impact has addressed the applicable CVEs. \n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Tivoli Netcool Impact| 7.1.0 \n \n\n\n## Remediation/Fixes\n\nProduct| VRMF| APAR| Remediation \n---|---|---|--- \nIBM Tivoli Netcool Impact 7.1.0| 7.1.0.26| IJ40679| Upgrade to [IBM Tivoli Netcool Impact 7.1.0 FP26](<https://www.ibm.com/support/pages/node/6587919> \"IBM Tivoli Netcool Impact 7.1.0 FP26\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-29T17:54:48", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-29T17:54:48", "id": "F4ABE31B697DC0DAB590475AF9A100CB37651AB509405E419E8BB770A610D340", "href": "https://www.ibm.com/support/pages/node/6599705", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:46:14", "description": "## Summary\n\nMultiple vulnerabilities exist in IBM\u00ae SDK Java\u2122 Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle January 2022 Critical Patch Update. CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21248\n\n## Vulnerability Details\n\nRefer to the security bulletin(s) listed in the Remediation/Fixes section\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nITNM| 4.2 \n \n\n\n## Remediation/Fixes\n\nTo update the Java Runtime Environment (JRE), complete the following steps. \n\n1\\. Locate the appropriate IBM JRE for your operating system on the IBM Fix Central website.\n\nAIX: [IBM Java 8.0.7.5 for AIX](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EWebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+64-bit,+pSeries&function=fixId&fixids=8.0.7.5-JavaTech-JavaSE-AIXpSeries64-ServiceRefresh7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"\" )\n\nLinux: [IBMJava 8.0.7.5 for 64-bit Linux](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EWebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=Linux+64-bit,x86_64&function=fixId&fixids=8.0.7.5-JavaTech-JavaSE-Linuxx86_6464-ServiceRefresh7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"\" )\n\nzLinux: [IBM Java 8.0.7.5 for Linux for z/OS](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EWebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=Linux+64-bit,zSeries&function=fixId&fixids=8.0.7.5-JavaTech-JavaSE-LinuxzSeries64-ServiceRefresh7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"\" )\n\n2\\. Download version 8.0.7.5 in archive, not binary, format and install it as per following steps.\n\n3\\. Back up the directory $NCHOME/precision/jre.\n\n4\\. Stop all running processes of the Network Manager Core Components and Apache Storm by using the itnm_stop command.\n\n5\\. Delete the contents of the $NCHOME/precision/jre/bin and $NCHOME/precision/jre/lib directory.\n\n6\\. Copy the contents of the bin and lib directories from the JRE that you installed in step 2 to $NCHOME/precision/jre/bin and $NCHOME/precision/jre/lib, respectively.\n\n7\\. Restart the Network Manager Core Components and Apache Storm by using the itnm_start command.\n\nTo upgrade or rollback the Network Manager Core Components, restore the backup that you made in step 3. Perform the upgrade or rollback, then perform steps 4 to 7 again.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-05-24T10:09:56", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities exist in the IBM\u00ae SDK, Java\u2122 Technology Edition affecting IBM Tivoli Network Manager", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-05-24T10:09:56", "id": "1CAFF665F90440069C40AC6A9EBBDA118B3BD6E4405F1E5FE44083D74C290229", "href": "https://www.ibm.com/support/pages/node/6589417", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:45:14", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae Runtime Environment Java\u2122 Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed seven CVEs that can allow denial of service and three CVEs that can allow no confidentiallty impact.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM CICS Transaction Gateway| v9.2.0.0 \u2013 9.2.0.2 \nIBM CICS Transaction Gateway| v9.1.0.0 \u2013 9.1.0.3 \nIBM CICS Transaction Gateway| v9.0.0.0 \u2013 9.0.0.5 \nIBM CICS Transaction Gateway| v8.1.0.0 \u2013 8.1.0.5 \nIBM CICS Transaction Gateway| v8.0.0.0 \u2013 8.0.0.6 \n \n\n\n## Remediation/Fixes\n\nIBM strongly recommends you apply these fixes: \n\n**Product**\n\n| **VRMF \n**| **APAR**| **Remediation / First Fix** \n---|---|---|--- \nCICS Transaction Gateway for Multiplatforms| 9.2.0.0 \n9.2.0.1 \n9.2.0.2| \n\nUpdated JRE's have been made available on Fix Central as Fix packs. \nAIX: [8.0.7-CICSTG-AIXpSeries32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-AIXpSeries32-JRE-SR10&source=SAR>) \nxLinux: [8.0.7-CICSTG-Linuxx8632-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Linuxx8632-JRE-SR10&source=SAR>) \npLinux: [8.0.7-CICSTG-LinuxpSeries32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR>) \nzLinux: [8.0.7-CICSTG-LinuxzSeries31-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR>) \nWindows:[8.0.7-CICSTG-Windowsx8632-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Windowsx8632-JRE-SR10&source=SAR>)\n\n| [Fix Central Link](<https://www-945.ibm.com/support/fixcentral/swg/identifyFixes?query.parent=ibm~Other%20software&query.product=ibm~WebSphere~CICS%20Transaction%20Gateway%20for%20Multiplatforms&query.release=9.2.0&query.platform=All> \"Fix Central Link\" ) \nCICS Transaction Gateway for Multiplatforms| 9.1.0.0 \n9.1.0.1 \n9.1.0.2 \n9.1.0.3| \n\nUpdated JRE's have been made available on Fix Central as Fix packs. \nAIX: [7.1.5-CICSTG-AIXpSeries32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-AIXpSeries32-JRE-SR10&source=SAR>) \nxLinux: [7.1.5-CICSTG-Linuxx8632-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-Linuxx8632-JRE-SR10&source=SAR>) \npLinux: [7.1.5-CICSTG-LinuxpSeries32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR>) \nzLinux: [7.1.5-CICSTG-LinuxzSeries31-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR>) \nWindows: [7.1.5-CICSTG-Windowsx8632-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-Windowsx8632-JRE-SR10&source=SAR>)\n\n| [Fix Central Link](<https://www-945.ibm.com/support/fixcentral/swg/identifyFixes?query.parent=ibm~Other%20software&query.product=ibm~WebSphere~CICS%20Transaction%20Gateway%20for%20Multiplatforms&query.release=9.1.0&query.platform=All> \"Fix Central Link\" ) \nCICS Transaction Gateway for Multiplatforms| \n\n9.0.0.0 \n9.0.0.1 \n9.0.0.2 \n9.0.0.3 \n9.0.0.4\n\n9.0.0.5 \n8.1.0.0 \n8.1.0.1 \n8.1.0.2 \n8.1.0.3 \n8.1.0.4 \n8.1.0.5 \n8.0.0.0 \n8.0.0.1 \n8.0.0.2 \n8.0.0.3 \n8.0.0.4 \n8.0.0.5 \n8.0.0.6\n\n| Updated JRE's have been made available on Fix Central as Fix packs. \nSolaris: [7.0.11-CICSTG-SolarisSPARC32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-SolarisSPARC32-JRE-SR10&source=SAR>) \nAIX: [7.0.11-CICSTG-AIXpSeries32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-AIXpSeries32-JRE-SR10&source=SAR>) \nxLinux: [7.0.11-CICSTG-Linuxx8632-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-Linuxx8632-JRE-SR10&source=SAR>) \npLinux: [7.0.11-CICSTG-LinuxpSeries32-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR>) \nzLinux: [7.0.11-CICSTG-LinuxzSeries31-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR>) \nWindows: [7.0.11-CICSTG-Windowsx8632-JRE-SR10](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-Windowsx8632-JRE-SR10&source=SAR>)| [Fix Central Link](<https://www-945.ibm.com/support/fixcentral/swg/identifyFixes?query.parent=ibm~Other%20software&query.product=ibm~WebSphere~CICS%20Transaction%20Gateway%20for%20Multiplatforms&query.release=9.0.0&query.platform=All> \"Fix Central Link\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-21T15:23:30", "type": "ibm", "title": "Security Bulletin: June 2022 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-21T15:23:30", "id": "9EED50A5725545E60FE319DE4F6AEDF02C01A56CA754A18F89ECF4B5BD5DAC8B", "href": "https://www.ibm.com/support/pages/node/6597243", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:42:23", "description": "## Summary\n\nVulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition, Version 8, affect IBM Workload Scheduler. These issue's were disclosed as part of the Oracle January 2022 Critical Patch Update. These vulnerabilities have been addressed.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nIBM Workload Scheduler| 9.5 \nIBM Workload Scheduler| 9.4 \n \n\n\n## Remediation/Fixes\n\nAPAR IJ38962 has been opened to address Java vulnerabilities affecting IBM Workload Scheduler. \nThe following limited availability fixes for IJ38962 are available for download on FixCentral \n940-TIV-TWS-FP7-IJ38962 \nto be applied on top of Tivoli Workload Scheduler Distributed 9.4.0.07. \nApar IJ38962 is already included in IBM Workload Scheduler 9.5.0.06.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-08-31T17:26:51", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in IBM\u00ae SDK Java\u2122 Technology Edition, Version 8, affect IBM Workload Scheduler.", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-08-31T17:26:51", "id": "D866C66B6D8CD08D68CCBEE835296E1B00F1750F755972C9B9CD596BF7B8EC14", "href": "https://www.ibm.com/support/pages/node/6610905", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:46:13", "description": "## Summary\n\nMultiple vulnerabilities exists in IBM\u00ae SDK Java\u2122 Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2, which was disclosed in the Oracle January 2022 Critical Patch Update. CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340, CVE-2022-21305, CVE-2022-21294, CVE-2022-21293, CVE-2022-21291, CVE-2022-21248\n\n## Vulnerability Details\n\nRefer to the security bulletin(s) listed in the Remediation/Fixes section\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nITNCM| 6.4.2 \n \n\n\n## Remediation/Fixes\n\nNote that only standalone worker servers and compliance servers (i.e. those which are not co-located on the same machine as a presentation server) need to have their JRE updated. To update the Java Runtime Environment (JRE), complete the following steps. \n\n1\\. Locate the appropriate IBM JRE for your operating system on the IBM Fix Central website.\n\nAIX: [IBM Java 8.0.7.5 for AIX](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EWebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+64-bit,+pSeries&function=fixId&fixids=8.0.7.5-JavaTech-JavaSE-AIXpSeries64-ServiceRefresh7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"\" )\n\nLinux: [IBMJava 8.0.7.5 for 64-bit Linux](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EWebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=Linux+64-bit,x86_64&function=fixId&fixids=8.0.7.5-JavaTech-JavaSE-Linuxx86_6464-ServiceRefresh7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"\" )\n\nzLinux: [IBM Java 8.0.7.5 for Linux for z/OS](<https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EWebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=Linux+64-bit,zSeries&function=fixId&fixids=8.0.7.5-JavaTech-JavaSE-LinuxzSeries64-ServiceRefresh7FP5&includeRequisites=1&includeSupersedes=0&downloadMethod=http> \"\" )\n\n2\\. Download version 8.0.7.5 in archive, rather than binary, form and install it.\n\n3\\. Back up the directory $NCMHOME/jre.\n\n4\\. Stop all running processes of the compliance or worker server by using the \u201citncm.sh stop\u201d command.\n\n5\\. Delete the contents of the $NCMHOME/jre/bin and $NCMHOME/jre/lib directory.\n\n6\\. Copy the contents of the bin and lib directories from the JRE that you installed in step 2 to $NCMHOME/jre/bin and $NCHOME/jre/lib, respectively.\n\n7\\. Restart the compliance or worker server by using the \u201citncm.sh start\u201d command.\n\nTo roll back to the previous Netcool Configuration Manager compliance or worker server JRE, restore the backup that you made in step 3. Perform the rollback, then perform steps 4 to 7 again.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-05-24T10:18:34", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabbilities exists in the IBM\u00ae SDK, Java\u2122 Technology Edition affect IBM Tivoli Network Configuration Manager", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-05-24T10:18:34", "id": "B50B9BE403018768D4C035B30989AFFD92205B6D2E2D02F04B45D6745CD79C4F", "href": "https://www.ibm.com/support/pages/node/6589429", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-03-14T09:34:32", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae Runtime Environment Java\u2122 Versions 7.0, 7.1, 8.0 and 11.0.13 used by CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition. CICS Transaction Gateway has addressed seven CVEs that can allow denial of service and three CVEs that can allow no confidentiallty impact.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nCICS Transaction Gateway for Muliplatforms and CICS Transaction Gateway Desktop Edition| 9.1 \nCICS Transaction Gateway for Muliplatforms and CICS Transaction Gateway Desktop Edition| 9.2 \nCICS Transaction Gateway for Muliplatforms and CICS Transaction Gateway Desktop Edition| 9.3 \n \nNote: PSIRT fixes for CICS Transaction Gateway for Multiplatforms 9.0 and CICS Transaction Gateway Desktop Edition 9.0 will be provided only with extended support via IBM Support.\n\n## Remediation/Fixes\n\nBelow are the fixes provided for CICS Transaction Gateway 9.1:\n\nProduct\n\n| \n\nVRMF\n\n| \n\nPlatform\n\n| \n\nRemediation/First Fix \n \n---|---|---|--- \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.1.0.3\n\n| \n\nAIX\n\n| \n\nIBM Runtime Environment Java 7.0: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-AIXpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-AIXpSeries32-JRE-SR10&source=SAR\" )\n\nIBM Runtime Environment Java 7.1: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-AIXpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-AIXpSeries32-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| 9.1.0.3| \n\nLinux on POWER Big Endian\n\n| \n\nIBM Runtime Environment Java 7.0: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR\" )\n\nIBM Runtime Environment Java 7.1: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition| 9.1.0.3| \n\nLinux on Intel \n\n| \n\nIBM Runtime Environment Java 7.0: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-Linuxx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-Linuxx8632-JRE-SR10&source=SAR\" )\n\nIBM Runtime Environment Java 7.1: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-Linuxx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-Linuxx8632-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.1.0.3\n\n| \n\nLinux on IBM Z \n\n| \n\nIBM Runtime Environment Java 7.0: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR\" )\n\nIBM Runtime Environment Java 7.1: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.1.0.3\n\n| \n\nWindows \n\n| \n\nIBM Runtime Environment Java 7.0: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-Windowsx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-Windowsx8632-JRE-SR10&source=SAR\" )\n\nIBM Runtime Environment Java 7.1: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-Windowsx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.1.5-CICSTG-Windowsx8632-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.1.0.3\n\n| \n\nSolaris\n\n| \n\nIBM Runtime Environment Java 7.0: [Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-SolarisSPARC32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=7.0.11-CICSTG-SolarisSPARC32-JRE-SR10&source=SAR\" ) \n \nBelow are the fixes provided for CICS Transaction Gateway 9.2:\n\nProduct\n\n| \n\nVRMF\n\n| \n\nPlatform\n\n| \n\nRemediation/First Fix \n \n---|---|---|--- \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.2.0.2\n\n| \n\nAIX\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-AIXpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-AIXpSeries32-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| 9.2.0.2| \n\nLinux on POWER Big Endian\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition| 9.2.0.2| \n\nLinux on Intel \n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Linuxx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Linuxx8632-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.2.0.2\n\n| \n\nLinux on IBM Z \n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxzSeries31-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.2.0.2\n\n| \n\nWindows \n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Windowsx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Windowsx8632-JRE-SR10&source=SAR\" ) \n \nBelow are the fixes provided for CICS Transaction Gateway 9.1:\n\nProduct\n\n| \n\nVRMF\n\n| \n\nPlatform\n\n| \n\nRemediation/First Fix \n \n---|---|---|--- \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.3.0.0\n\n| \n\nAIX\n\n| \n\n[Fix Central Link](<https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-AIX-JRE&source=SAR> \"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-AIX-JRE&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| 9.3.0.0| \n\nLinux on Intel\n\n| \n\n[Fix Central Link](<https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-ILNX-JRE&source=SAR> \"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-ILNX-JRE&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition| 9.3.0.0| \n\nLinux on IBM Z\n\n| \n\n[Fix Central Link](<https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-ZLNX-JRE&source=SAR> \"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-ZLNX-JRE&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.3.0.0\n\n| \n\nLinux on POWER Little Endian\n\n| \n\n[Fix Central Link](<https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-PLXLE-JRE&source=SAR> \"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-PLXLE-JRE&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms\n\n| \n\n9.3.0.0\n\n| \n\nLinux on IBM Z container\n\n| \n\n[Fix Central Link](<https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-s390xContainer-JRE&source=SAR> \"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-s390xContainer-JRE&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms\n\n| \n\n9.3.0.0\n\n| \n\nLinux on Intel container\n\n| \n\n[Fix Central Link](<https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-x86container-JRE&source=SAR> \"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=11.0.18.0-CICSTG-x86container-JRE&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.3.0.0\n\n| \n\nLinux on POWER Big Endian\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-LinuxpSeries32-JRE-SR10&source=SAR\" ) \n \nCICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition\n\n| \n\n9.3.0.0\n\n| \n\nWindows\n\n| \n\n[Fix Central Link](<http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Windowsx8632-JRE-SR10&source=SAR> \"http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FCICS+Transaction+Gateway+for+Multiplatforms&fixids=8.0.7-CICSTG-Windowsx8632-JRE-SR10&source=SAR\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-03-13T16:06:17", "type": "ibm", "title": "Security Bulletin: June 2022 : Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2023-03-13T16:06:17", "id": "9C12523FC5860CEF45C6EA41393E948036CE8B122B1C9603FE65EB5B891DA521", "href": "https://www.ibm.com/support/pages/node/6962411", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:45:53", "description": "## Summary\n\nThere are multiple vulnerabilities in IBM\u00ae Runtime Environment Java\u2122 Versions. IBM Sterling Connect:Direct Web Service has addressed the applicable CVEs.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| **Version(s)** \n---|--- \nIBM Sterling Connect Direct Web Services| 1.0 \nIBM Sterling Connect:Direct Web Services| 6.1.0 \nIBM Sterling Connect:Direct Web Services| 6.2.0 \nIBM Sterling Connect:Direct Web Services| 6.0 \n \n\n\n## Remediation/Fixes\n\n**Product(s)**| **Version(s)**| **Remediation/Fix \n** \n---|---|--- \nIBM Sterling Connect:Direct Web Services| 1.0| Apply 6.0.0.8, available on [Fix Central](<https://www.ibm.com/support/fixcentral/options?selectionBean.selectedTab=find&selection=ibm%2fOther+software%3bibm%2fOther+software%2fIBM+Connect%3aDirect+Web+Services> \"\" ) \nIBM Sterling Connect:Direct Web Services| 6.0| Apply 6.0.0.8, available on [Fix Central](<https://www.ibm.com/support/fixcentral/options?selectionBean.selectedTab=find&selection=ibm%2fOther+software%3bibm%2fOther+software%2fIBM+Connect%3aDirect+Web+Services> \"\" ) \nIBM Sterling Connect:Direct Web Services| 6.1| Apply 6.1.0.12, available on [Fix Central](<https://www.ibm.com/support/fixcentral/options?selectionBean.selectedTab=find&selection=ibm%2fOther+software%3bibm%2fOther+software%2fIBM+Connect%3aDirect+Web+Services> \"\" ) \nIBM Sterling Connect:Direct Web Services| 6.2| Apply 6.2.0.6, available on [Fix Central](<https://www.ibm.com/support/fixcentral/options?selectionBean.selectedTab=find&selection=ibm%2fOther+software%3bibm%2fOther+software%2fIBM+Connect%3aDirect+Web+Services> \"\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-06-01T11:30:27", "type": "ibm", "title": "Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-06-01T11:30:27", "id": "61259BFC3E51FA408F6B65E0842C8C80C5875177AA7C5D5856E5F989956796F6", "href": "https://www.ibm.com/support/pages/node/6591191", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:37:29", "description": "## Summary\n\nIBM Security Guardium has fixed these vulnerabilities.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2021-35550](<https://vulners.com/cve/CVE-2021-35550>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2021-35603](<https://vulners.com/cve/CVE-2021-35603>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/211676](<https://exchange.xforce.ibmcloud.com/vulnerabilities/211676>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) \n \n** CVEID: **[CVE-2021-39078](<https://vulners.com/cve/CVE-2021-39078>) \n** DESCRIPTION: **IBM Security Guardium stores user credentials in plain clear text which can be read by a local privileged user. \nCVSS Base score: 4.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/215589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/215589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| **Version(s)** \n---|--- \nIBM Security Guardium| 10.5 \nIBM Security Guardium| 10.6 \nIBM Security Guardium| 11.0 \nIBM Security Guardium| 11.1 \nIBM Security Guardium| 11.3 \nIBM Security Guardium| 11.2 \nIBM Security Guardium| 11.4 \n \n## Remediation/Fixes\n\nIBM encourages customers to update their systems promptly.\n\n**Product**| **Versions**| **Fix** \n---|---|--- \nIBM Security Guardium| 10.5| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=10.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard_10.0p550_Bundle_Mar-27-2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=Linux&function=fixId&fixids=SqlGuard_10.0p550_Bundle_Mar-27-2022&includeSupersedes=0&source=fc>) \nIBM Security Guardium| 10.6| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=10.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard_10.0p692_Bundle_May-12-2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=Linux&function=fixId&fixids=SqlGuard_10.0p692_Bundle_May-12-2022&includeSupersedes=0&source=fc>) \nIBM Security Guardium| 11.0| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=11.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard_11.0p45_Bundle_May-03-2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p45_Bundle_May-03-2022&includeSupersedes=0&source=fc>) \nIBM Security Guardium| 11.1| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=11.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard-11.0p165_Bundle_Sep_01_2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard-11.0p165_Bundle_Sep_01_2022&includeSupersedes=0&source=fc>) \nIBM Security Guardium| 11.2| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=11.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard_11.0p277_Bundle_Oct-26-2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p277_Bundle_Oct-26-2022&includeSupersedes=0&source=fc>) \nIBM Security Guardium| 11.3| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=11.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard_11.0p372_Bundle_Sep-19-2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p372_Bundle_Sep-19-2022&includeSupersedes=0&source=fc>) \nIBM Security Guardium| 11.4| [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&amp;product=ibm/Information+Management/InfoSphere+Guardium&amp;release=11.0&amp;platform=Linux&amp;function=fixId&amp;fixids=SqlGuard_11.0p440_Bundle_Jun-03-2022&amp;includeSupersedes=0&amp;source=fc](<http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p440_Bundle_Jun-03-2022&includeSupersedes=0&source=fc>) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-08T16:41:49", "type": "ibm", "title": "Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-35550", "CVE-2021-35603", "CVE-2021-39078", "CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-11-08T16:41:49", "id": "2CFDD7EB79CABE9467808BE1954249E5CD7205BF76604F99B481825CD7F613DD", "href": "https://www.ibm.com/support/pages/node/6572983", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:C/I:N/A:N"}}, {"lastseen": "2023-02-28T01:55:51", "description": "## Summary\n\nIBM Spectrum Protect Plus may be affected by vulnerabilities in MongoDB, Node.js, Docker, and XStream such as server-side request forgery, bypass of security restrictions, denial of service, execution of arbitrary code, elevation of privileges, and arbitrary file deletion.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2020-7929](<https://vulners.com/cve/CVE-2020-7929>) \n** DESCRIPTION: **MongoDB is vulnerable to a denial of service. By issuing a generic explain command on a find query, a remote authenticated attacker could exploit this vulnerability to cause a denial of service. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/197509](<https://exchange.xforce.ibmcloud.com/vulnerabilities/197509>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21342](<https://vulners.com/cve/CVE-2021-21342>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack o access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 7.4 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198619](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198619>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21350](<https://vulners.com/cve/CVE-2021-21350>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198627](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198627>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21346](<https://vulners.com/cve/CVE-2021-21346>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198623](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198623>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21349](<https://vulners.com/cve/CVE-2021-21349>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to conduct SSRF attack to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. \nCVSS Base score: 8.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198626](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198626>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) \n \n** CVEID: **[CVE-2021-21341](<https://vulners.com/cve/CVE-2021-21341>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by an endless loop flaw when processing stream at unmarshalling time. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to allocate 100% CPU time. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198618](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198618>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21345](<https://vulners.com/cve/CVE-2021-21345>) \n** DESCRIPTION: **XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198622](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198622>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21348](<https://vulners.com/cve/CVE-2021-21348>) \n** DESCRIPTION: **XStream is vulnerable to a denial of service, caused by a regular expression denial of service flaw (ReDos). By using a specially-crafted regular expression input, a remote attacker could exploit this vulnerability to consume maximum CPU time. \nCVSS Base score: 5.9 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198625](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198625>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21344](<https://vulners.com/cve/CVE-2021-21344>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code from a remote server. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198621](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198621>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21347](<https://vulners.com/cve/CVE-2021-21347>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198624](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198624>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21343](<https://vulners.com/cve/CVE-2021-21343>) \n** DESCRIPTION: **XStream could allow a remote attacker to bypass security restrictions, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to delete arbitrary files on the system. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198620](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198620>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) \n \n** CVEID: **[CVE-2021-21351](<https://vulners.com/cve/CVE-2021-21351>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when processing stream at unmarshalling time. By manipulating the processed input stream and replace or inject objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 8.1 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198628](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198628>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-21285](<https://vulners.com/cve/CVE-2021-21285>) \n** DESCRIPTION: **Docker is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to pull a specially-crafted Docker image, a remote attacker could exploit this vulnerability to cause the dockerd daemon to crash, and results in a denial of service condition. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/196049](<https://exchange.xforce.ibmcloud.com/vulnerabilities/196049>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-21284](<https://vulners.com/cve/CVE-2021-21284>) \n** DESCRIPTION: **Docker could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when using the --userns-remap option. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges as root on the system. \nCVSS Base score: 8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/196047](<https://exchange.xforce.ibmcloud.com/vulnerabilities/196047>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2021-29505](<https://vulners.com/cve/CVE-2021-29505>) \n** DESCRIPTION: **XStream XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system. \nCVSS Base score: 8.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/202795](<https://exchange.xforce.ibmcloud.com/vulnerabilities/202795>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26217](<https://vulners.com/cve/CVE-2020-26217>) \n** DESCRIPTION: **XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and SecurityVulnerabilityTest.java scripts. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 7.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/192210](<https://exchange.xforce.ibmcloud.com/vulnerabilities/192210>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n** CVEID: **[CVE-2021-22884](<https://vulners.com/cve/CVE-2021-22884>) \n** DESCRIPTION: **Node.js is vulnerable to a denial of service, caused by an error when the allowlist includes &amp;#34;localhost6&amp;#34;. By controlling the victim&amp;#39;s DNS server or spoofing its responses, an attacker could exploit this vulnerability to bypass the DNS rebinding protection mechanism using the &amp;#34;localhost6&amp;#34; domain and cause a denial of service. \nCVSS Base score: 6.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/197191](<https://exchange.xforce.ibmcloud.com/vulnerabilities/197191>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) \n \n** CVEID: **[CVE-2021-22883](<https://vulners.com/cve/CVE-2021-22883>) \n** DESCRIPTION: **Node.js is vulnerable to a denial of service, caused by a file descriptor leak. By making multiple attempts to connect with an &amp;#39;unknownProtocol&amp;#39;, an attacker could exploit this vulnerability to lead to an excessive memory usage and cause the system to run out of memory. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/197190](<https://exchange.xforce.ibmcloud.com/vulnerabilities/197190>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) \n \n** CVEID: **[CVE-2021-23358](<https://vulners.com/cve/CVE-2021-23358>) \n** DESCRIPTION: **Node.js underscore module could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the template function. By sending a specially-crafted argument using the variable property, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/198958](<https://exchange.xforce.ibmcloud.com/vulnerabilities/198958>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2020-26258](<https://vulners.com/cve/CVE-2020-26258>) \n** DESCRIPTION: **XStream is vulnerable to server-side request forgery, caused by a flaw when unmarshalling. By manipulating the processed input stream, a remote attacker could exploit this vulnerability to obtain sensitive data. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193525](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193525>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) \n \n** CVEID: **[CVE-2020-26259](<https://vulners.com/cve/CVE-2020-26259>) \n** DESCRIPTION: **XStream could allow a remote attacker to delete arbitrary files from the system, caused by improper input sanitization. By manipulating the processed input, an attacker could exploit this vulnerability to delete arbitrary files from the system. \nCVSS Base score: 7.5 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/193524](<https://exchange.xforce.ibmcloud.com/vulnerabilities/193524>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\n## Affected Products and Versions\n\n**Affected Product(s)**| Version(s) \n---|--- \nIBM Spectrum Protect Plus| 10.1.0-10.1.8 \n \n## Remediation/Fixes\n\n**IBM Spectrum Protect** \n**Plus Release**| **First Fixing** \n**VRM Level**| **Platform**| **Link to Fix** \n---|---|---|--- \n10.1| 10.1.8.1 \n| Linux| <https://www.ibm.com/support/pages/node/6415111> \n \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 9.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 6.0}, "published": "2021-06-28T20:25:47", "type": "ibm", "title": "Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26217", "CVE-2020-26258", "CVE-2020-26259", "CVE-2020-7929", "CVE-2021-21284", "CVE-2021-21285", "CVE-2021-21341", "CVE-2021-21342", "CVE-2021-21343", "CVE-2021-21344", "CVE-2021-21345", "CVE-2021-21346", "CVE-2021-21347", "CVE-2021-21348", "CVE-2021-21349", "CVE-2021-21350", "CVE-2021-21351", "CVE-2021-22883", "CVE-2021-22884", "CVE-2021-23358", "CVE-2021-29505"], "modified": "2021-06-28T20:25:47", "id": "D5FC516E557685CDE38A1C2C470F73080C33F28187E749A00C04F0812AFB9842", "href": "https://www.ibm.com/support/pages/node/6466599", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-28T01:49:19", "description": "## Summary\n\nThis bulletin covers all applicable Java SE CVEs published by Oracle as part of their January 2022 Critical Patch Update, except for CVE-2022-21299 which will be covered by a future bulletin. For more information please refer to Oracle's January 2022 CPU Advisory and the X-Force database entries referenced below.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2022-21365](<https://vulners.com/cve/CVE-2022-21365>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217659](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217659>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21360](<https://vulners.com/cve/CVE-2022-21360>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the ImageIO component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217654](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217654>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21349](<https://vulners.com/cve/CVE-2022-21349>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the 2D component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217643](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217643>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21341](<https://vulners.com/cve/CVE-2022-21341>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217636](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217636>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21340](<https://vulners.com/cve/CVE-2022-21340>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217635](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217635>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21305](<https://vulners.com/cve/CVE-2022-21305>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217600](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217600>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21294](<https://vulners.com/cve/CVE-2022-21294>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217589](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217589>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21293](<https://vulners.com/cve/CVE-2022-21293>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217588](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217588>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n** CVEID: **[CVE-2022-21291](<https://vulners.com/cve/CVE-2022-21291>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 5.3 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217586](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217586>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) \n \n** CVEID: **[CVE-2022-21248](<https://vulners.com/cve/CVE-2022-21248>) \n** DESCRIPTION: **An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. \nCVSS Base score: 3.7 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/217543](<https://exchange.xforce.ibmcloud.com/vulnerabilities/217543>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n## Affected Products and Versions\n\n7.0.0.0 - 7.0.11.0 \n7.1.0.0 - 7.1.5.0 \n8.0.0.0 - 8.0.7.0 \n \nFor detailed information on which CVEs affect which releases, please refer to the [IBM SDK, Java Technology Edition Security Vulnerabilities page](<https://developer.ibm.com/javasdk/support/security-vulnerabilities/>). \n \nNOTE: CVE-2022-21349, CVE-2022-21305 and CVE-2022-21291 affect IBM SDK, Java Technology Edition on Solaris, HP-UX and Mac OS only.\n\n## Remediation/Fixes\n\n7.0.11.5 \n7.1.5.5 \n8.0.7.5 \n \nIBM SDK, Java Technology Edition releases can be downloaded, subject to the terms of the developerWorks license, from the [Java Developer Center](<https://developer.ibm.com/javasdk/downloads/>). \n \nIBM customers requiring an update for an SDK shipped with an IBM product should contact [IBM support](<http://www.ibm.com/support/>), and/or refer to the appropriate product security bulletin.\n\n**APAR numbers are as follows:**\n\n[IJ37841](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37841>) (CVE-2022-21365) \n[IJ37842](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37842>) (CVE-2022-21360) \n[IJ37844](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37844>) (CVE-2022-21341) \n[IJ37846](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37846>) (CVE-2022-21340) \n[IJ37849](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37849>) (CVE-2022-21294) \n[IJ37851](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37851>) (CVE-2022-21293) \n[IJ37852](<http://www-01.ibm.com/support/docview.wss?uid=swg1IJ37852>) (CVE-2022-21248)\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-02-22T17:06:50", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities may affect IBM\u00ae SDK, Java\u2122 Technology Edition", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-21248", "CVE-2022-21291", "CVE-2022-21293", "CVE-2022-21294", "CVE-2022-21299", "CVE-2022-21305", "CVE-2022-21340", "CVE-2022-21341", "CVE-2022-21349", "CVE-2022-21360", "CVE-2022-21365"], "modified": "2022-02-22T17:06:50", "id": "D511C9D021B86BEFA8C830C2B52729718C7F823FB40C97B0965AF032F29F6EDD", "href": "https://www.ibm.com/support/pages/node/6558558", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-02-28T01:37:59", "description": "## Summary\n\nMultiple vulnerabilities in Apache Commons Collections used by IBM InfoSphere Information Server were addressed.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2015-4852](<https://vulners.com/cve/CVE-2015-4852>) \n** DESCRIPTION: **The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-6420](<https://vulners.com/cve/CVE-2015-6420>) \n** DESCRIPTION: **Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2017-15708](<https://vulners.com/cve/CVE-2017-15708>) \n** DESCRIPTION: **Apache Synapse could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Apache Commons Collections. By injecting specially-crafted serialized objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/136262](<https://exchange.xforce.ibmcloud.com/vulnerabilities/136262>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-7501](<https://vulners.com/cve/CVE-2015-7501>) \n** DESCRIPTION: **Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2019-13116](<https://vulners.com/cve/CVE-2019-13116>) \n** DESCRIPTION: **MuleSoft Mule runtime could allow a remote attacker to execute arbitrary code on the system, caused by Java deserialization, related to Apache Commons Collections. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/169704](<https://exchange.xforce.ibmcloud.com/vulnerabilities/169704>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\n## Affected Products and Versions\n\nAffected Product(s)| Version(s) \n---|--- \nInfoSphere Information Server| 11.7 \n \n\n\n## Remediation/Fixes\n\n_Product_| _VRMF_| _APAR_| _Remediation/First Fix_ \n---|---|---|--- \nInfoSphere Information Server, Information Server on Cloud| 11.7| [JR64991](<https://www.ibm.com/support/pages/apar/JR64991> \"JR64991\" ) \n| \\--Apply InfoSphere Information Server version [11.7.1.0](<https://www.ibm.com/support/docview.wss?uid=ibm10878310> \"11.7.1.0\" ) \n\\--Apply InfoSphere Information Server version [11.7.1.4](<https://www.ibm.com/support/pages/node/6620275> \"11.7.1.4\" ) \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-10-14T22:00:35", "type": "ibm", "title": "Security Bulletin: Multiple vulnerabilities in Apache Commons Collections affect IBM InfoSphere Information Server", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-4852", "CVE-2015-6420", "CVE-2015-7501", "CVE-2017-15708", "CVE-2019-13116"], "modified": "2022-10-14T22:00:35", "id": "DAB88099018B311F83DAFDB9431625A326A00FF72BE126856DCECA1262D7C308", "href": "https://www.ibm.com/support/pages/node/6829349", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-28T21:38:24", "description": "## Summary\n\nIBM Security Verify Governance uses Apache Commons Collections library which is vulnerable to arbitrary code execution by an attacker by sending specially crafted serialized objects (CVE-2017-15708, CVE-2015-7501, CVE-2015-6420, CVE-2015-4852, CVE-2019-13116). The fix includes upgrading the Commons Collections jar to the patched version.\n\n## Vulnerability Details\n\n** CVEID: **[CVE-2017-15708](<https://vulners.com/cve/CVE-2017-15708>) \n** DESCRIPTION: **Apache Synapse could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Apache Commons Collections. By injecting specially-crafted serialized objects, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/136262](<https://exchange.xforce.ibmcloud.com/vulnerabilities/136262>) for the current score. \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-7501](<https://vulners.com/cve/CVE-2015-7501>) \n** DESCRIPTION: **Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-6420](<https://vulners.com/cve/CVE-2015-6420>) \n** DESCRIPTION: **Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2015-4852](<https://vulners.com/cve/CVE-2015-4852>) \n** DESCRIPTION: **The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product. \nCVSS Base score: 9.8 \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) \n \n** CVEID: **[CVE-2019-13116](<https://vulners.com/cve/CVE-2019-13116>) \n** DESCRIPTION: **MuleSoft Mule runtime could allow a remote attacker to execute arbitrary code on the system, caused by Java deserialization, related to Apache Commons Collections. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base score: 9.8 \nCVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/169704](<https://exchange.xforce.ibmcloud.com/vulnerabilities/169704>) for the