Code injection

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538...

CVE-2020-5013

CVE-2020-5013 affects IBM QRadar SIEM 7.3.x (7.3.0–7.3.3 Patch 7) and 7.4.x (7.4.0–7.4.2 Patch 2). The issue is an XML External Entity (XXE) injection when processing XML data, enabling a remote attacker to potentially disclose sensitive information or exhaust memory/CPU resources. Mitigations/Re...

CVE-2020-4993

CVE-2020-4993 – IBM QRadar SIEM path traversal : QRadar SIEM versions 7.3.0–7.3.3 Patch 7 and 7.4.0–7.4.2 Patch 2 are vulnerable when decompressing or verifying the signature of ZIP files. The root cause is improper handling during ZIP data processing, enabling path traversal. Basescore 4.9 (CVSS...

CVE-2020-4979

CVE-2020-4979 affects IBM QRadar SIEM 7.3.x and 7.4.x, where insecure inter‑deployment communication can enable an attacker who can compromise or spoof traffic between hosts to execute arbitrary commands. Root cause is insecure inter‑deployment communications between QRadar components. Impact is ...

CVE-2020-4979

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538...

CVE-2020-4929

IBM QRadar SIEM is affected by CVE-2020-4929, a Cross-Site Scripting (XSS) vulnerability in the Web UI. Affected versions include QRadar 7.3.0–7.3.3 Patch 7 and 7.4.0–7.4.2 Patch 2. The underlying issue permits embedding arbitrary JavaScript in the Web UI, with potential credential disclosure wit...

CVE-2020-4932

CVE-2020-4932 affects IBM QRadar SIEM 7.3.x and 7.4.x. Root cause: hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Impact: potential disclosure or misuse of embedded credentials. Affected versions per sources: QRadar 7.3.0–7.3.3 Patch 7...

IBM QRadar SIEM 跨站脚本漏洞

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A cross-site scripting vulnerability exists in IBM QRadar SIEM versions 7.3 and...

Security Bulletin: Security vulnerability in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology

Summary The Jazz Team Server is shipped with/or supports versions of the Apache Tomcat web server which contains a security vulnerability that could potentially impact the following IBM Rational products deployed on Apache Tomcat: Collaborative Lifecycle Management CLM, Rational DOORS Next...

CVE-2021-1818

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause unexpected application termination or...

CVE-2021-1801

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy...

CVE-2021-1797

The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to read arbitrary files...

Design/Logic Flaw

The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to read arbitrary files...

CVE-2021-1797

The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to read arbitrary files...

CVE-2021-1761

This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause a denial of service...

CVE-2021-1791

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A...

CVE-2021-1782

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a...

CVE-2021-1778

An out-of-bounds read issue existed in the curl. This issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafte...

CVE-2021-1789

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to...

CVE-2021-1791

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A...