Security Bulletin: Multiple vulnerabilities affect IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2022-33987 DESCRIPTION: Node.js got module could allow a...

Security Bulletin: IBM Robotic Process Automation is vulnerable to arbitrary code execution due to async (CVE-2021-43138)

Summary async is used by IBM Robotic Process Automation as part of control center UI functionality. CVE-2021-43138 Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution in the mapValues...

CVE-2022-31162

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

Information disclosure

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

CVE-2022-31162

CVE-2022-31162 affects Slack Morphism (Rust) prior to 0.41.0. The root issue was overly verbose debug formatting that could cause Slack OAuth client information to leak into application logs. Exploitation guidance is not provided in the documents; however, various sources confirm an information d...

Security Bulletin: Vulnerability in async opensource package affects IBM VM Recovery Manager HA & DR GUI

Summary There is vulnerability in async opensource package which affects IBM VM Recovery Manager HA and DR GUI. No impacts to VM Recovery Manager HA and DR cli. Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system,...

H3C Magic R200 缓冲区错误漏洞

H3C Magic R200 is a wireless router device. H3C Magic R200 AJAX/ajaxget processing ajaxmsg parameter has a buffer overflow vulnerability, which can be exploited by remote attackers to submit special requests that can crash the service or execute arbitrary code in application context...

elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution, due to the async CVE-2021-43138 and nconf CVE-2022-21803 modules for Node.js. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes...

Malicious Package

Overview test-async-config is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

MAL-2022-1150 Malicious code in async-problem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2aacc68e48c5a12a15906bd6fc0fef4bb3fc0c2205e74310d659a167a754f473 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in async-problem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2aacc68e48c5a12a15906bd6fc0fef4bb3fc0c2205e74310d659a167a754f473 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in async-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18992b007a3273e69ee3c365af70c91f814c261e52abf630067112f064a8c291 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1149 Malicious code in async-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18992b007a3273e69ee3c365af70c91f814c261e52abf630067112f064a8c291 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @manomano-toolbox/async-exports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ed6043d62007fd2c0e9cbb7d2c4c3f699d6f97ae27a7f8cc5744c19e9128c6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-412 Malicious code in @manomano-toolbox/async-exports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ed6043d62007fd2c0e9cbb7d2c4c3f699d6f97ae27a7f8cc5744c19e9128c6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication flaw

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

CVE-2022-31013 Authentication bypass in Vartalap chat-server

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

CVE-2022-31013 Authentication bypass in Vartalap chat-server

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

qemu security update

15:4.2.1-17.el7 - arm/acpi: fix an out of spec UID for PCI root Michael S. Tsirkin - arm/acpi: fix duplicated UID of PCI interrupt link devices Heyi Guo - arm/acpi: fix PCI PRT definition Heyi Guo - docs: fix references to docs/devel/atomics.rst Stefano Garzarella Orabug: 33659123 - rcu: do not...