Security Bulletin: WebSphere Application Server is vulnerable to Information Disclosure (CVE-2021-29842)

Summary WebSphere Application Server configured with a federated repository is vulnerable to information disclosure. This has been addressed. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server could allow a remote user to enumerate usernames due to a...

Moderate: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2021-40530

The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Directory Server

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Directory Server ISDS. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Server side request forgery (ssrf)

The vRealize Operations Manager API 8.x prior to 8.5 contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure...

CVE-2021-22026

The SSRF issue CVE-2021-22026 affects VMware vRealize Operations Manager API (versions 8.x before 8.5). The vulnerability allows an unauthenticated actor with network access to perform server-side requests, leading to information disclosure. VMware’s advisory (VMSA-2021-0018) details the affected...

CVE-2021-29736

CVE-2021-29736 affects IBM WebSphere Application Server (versions 7.0, 8.0, 8.5, 9.0) and allows a remote attacker to gain elevated privileges. The connected IBM security bulletins describe a Privilege Escalation vulnerability and instruct upgrading to fixed/interim fixes per bulletin content; se...

IBM WebSphere Application Server 安全漏洞

IBM WebSphere Application Server WAS is an application server developed and distributed by IBM in compliance with open standards, such as Java EE, XML and Web Services. IBM WebSphere Application Server versions 7.0, 8.0, 8.5, 9.0 An elevation of privilege vulnerability exists. A remote attacker...

nvme-cli bug fix and enhancement update

An update is available for nvme-cli. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The nvme-cli packages provide the Non-volatile Memory Express NVMe...

Security Bulletin: A security bulletin has been identified in WebSphere Application Server Java Batch is vulnerable to an XML External Entity Injection (XXE) vulnerability (CVE-2021-20492)

Summary WebSphere Application Server Java Batch is vulnerable to an XML External Entity Injection XXE vulnerability. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2021-20453

CVE-2021-20453 affects IBM WebSphere Application Server 8.0, 8.5, and 9.0. It is an XML External Entity (XXE) injection vulnerability in XML data processing that could allow a remote attacker to expose sensitive information or exhaust memory. CVSS v3 base score is 8.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server is vulnerability in Dojo affects WebSphere Application Server (CVE-2020-5258)

Summary There is a vulnerability in the Dojo library used by WebSphere Application Server. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20453)

Summary WebSphere Application Server is vulnerable to an XML External Entity XXE Injection vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20453 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a XML External Entity Injection XXE attack when processing...

Security Bulletin: Vulnerability in Apache MyFaces affects WebSphere Application Server in IBM Cloud (CVE-2021-26296)

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server in IBM Cloud. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins list...

Security Bulletin: Security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager(CVE-2020-4949)

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilitiy affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2021-27653

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure...

Pegasystem PEGA Platform 访问控制错误漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. An access control error vulnerability...

CVE-2021-27653

Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure...

CVE-2021-25161

A remote cross-site scripting xss vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below;...

CVE-2021-25145

A remote unauthorized disclosure of information vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.1...