Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced (CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850. An update to IBM CICS TX Advanced has been released to addre...

IBM CICS TX Advanced Information Disclosure Vulnerability

IBM CICS TX Advanced is a transaction processing monitoring system from International Business Machines IBM for running large-scale, high-transaction-volume applications in enterprise environments. An information disclosure vulnerability exists in IBM CICS TX Advanced version 10.1, which stems fr...

CVE-2023-38360

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769...

CVE-2023-38360

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769...

Cross site scripting

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769...

Design/Logic Flaw

IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814...

Security Bulletin: Due to the use of OpenSSL, IBM CICS TX Advanced is vulnerable to a denial of service (DOS) (CVE-2023-3817 and CVE-2023-3446).

Summary There are vulnerabilities in OpenSSL when using the DHcheck, DHcheckex or EVPPKEYparamcheck functions to check a DH key or DH parameters. OpenSSL is used IBM CICS TX Advanced to provide cryptographic functionality within its applications. An update to IBM CICS TX Advanced has been release...

Security Bulletin: Due to the use of the gawk package, IBM CICS TX Advanced is vulnerable to a heap out-of-bounds flaw (CVE-2023-4156).

Summary IBM CICS TX Advanced is vulnerable to CVE-2023-4156 due to the use of the gawk package. The gawk package is used by IBM CICS TX Advanced to make it possible to handle simple data-reformatting jobs with just a few lines of code. An update to IBM CICS TX Advanced has been released to addres...

Security Bulletin: Due to the use of curl, IBM CICS TX Advanced is vulnerable to security restrictions potentially being bypassed (CVE-2023-38546).

Summary IBM CICS TX Advanced is vulnerable to CVE-2023-38546 if curl function, curleasyduphandle, has cookies enabled during the transfer when the handle is duplicated. Curl is used by IBM CICS TX Advancede to transfer data. An update to IBM CICS TX Advanced has been released to address this...

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM CICS TX Advanced CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049. An update to IBM CICS TX Advanced has been released to address these vulnerabilities...

Security Bulletin: IBM CICS TX Advanced is vulnerable to a Denial of Service (CVE-2021-33294 and CVE-2020-21047).

Summary The Elfutils package is used by IBM CICS TX Advanced in order to read, create and modify ELF Executable and Linkable Format binary files. The Elfutils package is vulnerable to a Denial of Service CVE-2021-33294 and CVE-2020-21047. An update to IBM CICS TX Advanced has been released to...

Security Bulletin: Due to the use of IBM WebSphere Liberty, IBM CICS TX Advanced is vulnerable to an information disclosure due to Apache Santuario (CVE-2023-44483).

Summary There is a vulnerability in the Apache Santuario library used by IBM WebSphere Application Server Liberty when the wsSecurity-1.1, wsSecuritySaml-1.1 or samlWeb-2.0 feature is enabled CVE-2023-44483. IBM WebSphere Liberty is used by IBM CICS TX Advanced to provide a web based administrati...

Security Bulletin: Due to the use of IBM WebSphere Liberty, IBM CICS TX Advanced is vulnerable to weaker than expected security due to improper resource expiration handling (CVE-2023-46158).

Summary IBM WebSphere Liberty is used by IBM CICS TX Advanced to provide a web based administration console CVE-2023-46158. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due t...

Security Bulletin: Due to the use of IBM WebSphere Liberty, IBM CICS TX Advanced is vulnerable to a flaw in handling multiplexed streams in the HTTP/2 protocol (CVE-2023-44487).

Summary IBM WebSphere Liberty is used by IBM CICS TX Advanced to provide a web based administration console CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/...

Security Bulletin: Multiple vulnerabilities in Golang Go affect IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 (CVE-2023-39318 and CVE-2023-39319).

Summary Multiple vulnerabilities in Golang Go affect IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 CVE-2023-39318 and CVE-2023-39319. IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 have addressed the applicable issues. Vulnerability Details CVEID:CVE-2023-39318 DESCRIPTION:...

CVE-2023-38364

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821...

CVE-2023-38363

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

CVE-2023-38364

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821...

CVE-2023-38364 IBM CICS TX Advanced cross-site scripting

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821...

PT-2023-26387 · Ibm · Ibm Cics Tx Advanced

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Advanced version 10.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...