Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to xmldom vulnerability [CVE-2022-37616]

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to xmldom vulnerability with details below. CVE-2022-37616 This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-37616 DESCRIPTION: xmldom could allow a remote attacker to...

WordPress Knowledge Base Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Knowledge Base Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.4 Developer WebberZone PSID af732cb0c7f5 Credits N/A Required privilege Contributor...

Security Bulletin: Vulnerablity in Apache Log4j may affect IBM Tivoli Monitoring installed WebSphere Application Server (CVE-2021-44228)

Summary The following security issue has been identified in the WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. Note that log4j 2.x is not actually used by ITM but is present as part of the Tivoli Portal Server component installation as it prereqs and...

org.apache.kylin:kylin-spark-test (4.0.0-alpha), org.apache.kylin:kylin-tool-assembly (>=2.1.0, <=4.0.0-alpha) +2 more potentially affected by CVE-2022-44621 via org.apache.kylin:kylin-server-base (>=2.1.0, <=4.0.0-alpha)

org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.4.0 Source cves: CVE-2022-44621 Source advisory: GHSA-W9RV-XMF7-X3GH...

org.apache.kylin:kylin-spark-test (4.0.0-alpha), org.apache.kylin:kylin-tool-assembly (>=2.1.0, <=4.0.0-alpha) +2 more potentially affected by CVE-2022-44621 via org.apache.kylin:kylin-server-base (>=2.1.0, <=4.0.0-alpha)

org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.4.0 Source cves: CVE-2022-44621 Source advisory: OSV:GHSA-W9RV-XMF7-X3GH...

org.apache.kylin:kylin-spark-test (4.0.0-alpha), org.apache.kylin:kylin-tool-assembly (>=2.1.0, <=4.0.0-alpha) +2 more potentially affected by CVE-2022-44621 via org.apache.kylin:kylin-server-base (>=2.1.0, <=4.0.0-alpha)

org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.4.0 Source cves: CVE-2022-44621 Source advisory: MEND:CVE-2022-44621...

cvxpy (>=1.1.22, <=1.3.0), cvxpy-base (>=1.1.22, <=1.3.0) +3 more potentially affected by CVE-2022-40897 via setuptools (64.0.2)

setuptools PYPI version 64.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvxpy =1.1.22, =1.1.22, =0.0.0, =0.2.0, =0.2.3 Source cves: CVE-2022-40897 Source advisory: OSV:GHSA-R9HX-VWMV-Q579...

cvxpy (>=1.1.22, <=1.3.0), cvxpy-base (>=1.1.22, <=1.3.0) +3 more potentially affected by CVE-2022-40897 via setuptools (64.0.2)

setuptools PYPI version 64.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvxpy =1.1.22, =1.1.22, =0.0.0, =0.2.0, =0.2.3 Source cves: CVE-2022-40897 Source advisory: OSV:PYSEC-2022-43012...

DEBIAN-CVE-2022-45406

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5,...

CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

DEBIAN-CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Security Bulletin: Vulnerabilities (CVE-2022-21541 and CVE-2022-21540) in IBM Java Runtime affects CICS Transaction Gateway Desktop Editon

Summary IBM® Runtime Environment Java™ is used by CICS Transaction Gateway Desktop Editon. The fix removes vulnerabilities CVE-2022-21541 and CVE-2022-21540 that could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact...

Security Bulletin: Vulnerability (CVE-2021-41041) in Eclipse Openj9 affects CICS Transaction Gateway

Summary Eclipse Openj9 is used by CICS Transaction Gateway. The fix removes vulnerability CVE-2021-41041 that could allow a remote attacker to bypass security restrictions. Vulnerability Details CVEID:CVE-2021-41041 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-40956: Improper Neutralization of Input During Web Page Generation

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

LDAP Active Directory - trustedDomain Enumeration

Binary data ldapenumtrusteddomain.nbin...

Community Plugin Framework Cross-Site Script Vulnerabilities

Community Plugin Framework is a plugin framework. A security vulnerability exists in Community Plugin Framework, which stems from an unknown function in the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java, where manipulation of the parameter baseUrl can lead to...