Security Bulletin: IBM Netezza as a Service is vulnerable to CVE-2022-0811

Summary IBM Netezza as a Service is vulnerable to arbitrary code execution as root on the cluster node due to CVE-2022-0811 although severity is low. Vulnerability is addressed by upgrading OCP version to 4.8.42. Vulnerability Details CVEID: CVE-2022-0811 DESCRIPTION: CRI-O could allow a remote...

Security Bulletin: IBM Engineering Test Management is vulnerable to execute arbitrary commands on system due to XStream ( CVE-2021-29505 ).

Summary IBM Engineering Test Management is vulnerable to remote attacker to execute arbitrary commands on the system, caused by improper input validation. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system...

Problems with the access control of the fillOrder() function

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. fillOrder does not check order.maker ! = caller, which means that mintorder.maker, uint256orderHash; & mintmsg.sender, positionId; can mint NFT to the same person and therefore may create unintended...

JVN#14077132: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-2909 Operation restriction bypass in multiple applications CWE-285 - CVE-2022-30602 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L| Base Score: 5.4 CVSS v2|...

PHP Library Remote Code Execution

JAHx221 - RCE in copy/pasted PHP compat libraries, jsondecode function =============================================================================== Several PHP compatability libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existi...

Net-SNMP 缓冲区错误漏洞

Net-SNMP is an open source Simple Network Management Protocol SNMP software. The software is used to monitor network devices, computer devices, UPS devices, and more. Net-SNMP suffers from a buffer error vulnerability that stems from a buffer overflow in the INDEX handling of NET-SNMP-VACM-MIB th...

Security Bulletin: Vulnerability in PostgreSQL may affect IBM Spectrum Protect Plus

Summary PostgreSQL could allow a remote attacker to gain unauthorized access to the system which may affect IBM Spectrum Protect Plus. Vulnerability Details IBM X-Force ID: 220313 DESCRIPTION: PostgreSQL JDBC Driver could allow a remote attacker to gain unauthorized access to the system, caused b...

Security Bulletin: IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift vulnerable to login security bypass (CVE-2022-22472)

Summary BM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift is vulnerable to login security being bypassed which can result in gaining unauthorized access to the IBM Spectrum Protect Plus Server. Vulnerability Details CVEID:CVE-2022-22472 DESCRIPTION: IBM...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to directory traversal due to its use of Apache Commons IO (CVE-2021-29425)

Summary Apache Commons IO is used by several components in IBM Cloud Pak for Multicloud Management Monitoring. The product does not allow input that processes files or directories, but the affected software has been updated out of an abundance of caution. Vulnerability Details CVEID: CVE-2021-294...

baseRatePerBlock not updated when a new base rate is set

Lines of code Vulnerability details Impact When an admin sets a new baseRatePerYear in setBaseRatePerYear, the baseRatePerBlock is not updated. If the deltaBlocks has not passed yet, it will also not be updated when getSupplyRate is called, i.e. a stale value will be returned there. Recommended...

getSupplyRate returns rate per year instead of per block

Lines of code Vulnerability details Impact According to the documentation in InterestRateModel, getSupplyRate has to return the supply rate per block and the function supplyRatePerBlock in CToken directly returns the value of getSupplyRate. However, the rate per year is returned for NoteInterest...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (2022:5239)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:5239-1 advisory. - 389-ds-base: sending crafted message could result in DoS CVE-2022-0918 - 389-ds-base: expired password was still allowed to access the database...

389-ds-base security, bug fix, and enhancement update

1.3.10.2-16 - Bump version to 1.3.10.2-16 - Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS - Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log - Resolves: Bug 2018153 - RFE - Provide an option to abort...

GSD-2022-1004004 drivers/base/node.c: fix compaction sysfs file leak

drivers/base/node.c: fix compaction sysfs file leak This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.283 by commit...

GSD-2022-1003785 firmware: arm_scmi: Fix list protocols enumeration in the base protocol

firmware: armscmi: Fix list protocols enumeration in the base protocol This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003715 driver: base: fix UAF when driver_attach failed

driver: base: fix UAF when driverattach failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003584 firmware: arm_scmi: Fix list protocols enumeration in the base protocol

firmware: armscmi: Fix list protocols enumeration in the base protocol This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit...

GSD-2022-1003537 driver: base: fix UAF when driver_attach failed

driver: base: fix UAF when driverattach failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...

GSD-2022-1003337 firmware: arm_scmi: Fix list protocols enumeration in the base protocol

firmware: armscmi: Fix list protocols enumeration in the base protocol This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

GSD-2022-1003284 driver: base: fix UAF when driver_attach failed

driver: base: fix UAF when driverattach failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...