UBUNTU-CVE-2023-32248

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2TREECONNECT and SMB2QUERYINFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to Node.js (CVE-2023-23920)

Summary IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to Node.js CVE-2023-23920. The fix includes Node.js 14.21.3 Vulnerability Details CVEID:CVE-2023-23920 DESCRIPTION: Node.js could allow a remote authenticated attacker to bypass security restrictions, caused b...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to a denial of service due to FasterXML jackson-databind (CVE-2022-42004, CVE-2022-42003)

Summary IBM App Connect for Manufacturing is vulnerable to a denial of service due to FasterXML jackson-databind CVE-2022-42004, CVE-2022-42003 Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in i...

OpenID Connect Anonymous Account

OpenID Connect is an identity layer on top of the OAuth 2.0 protocol which aims to determine the provider URL for an end user. By leveraging the /.well-known/webfinger endpoint, it is sometimes possible to determine if an anonymous account exists on the target server. By leveraging this...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation. A security vulnerability exists in the Linux kernel that stems from flaws in the handling of the SMB2TREECONNECT and SMB2QUERYINFO commands, which lack proper validation of pointers before they are...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability exploits the jira connect intergration allowing a malicious attacker to inject and execute malicious javascript on victim's browser...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to SOAPAction spoofing when processing JAX-WS Web Services requests (CVE-2022-38712)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to SOAPAction spoofing when processing JAX-WS Web Services requests CVE-2022-38712. The fix includes the IBM Websphere Application Server APAR PH49111 Vulnerability Details CVEID:CVE-2022-38712 DESCRIPTION: IBM WebSphere...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to IBM MQ (CVE-2023-26285, CVE-2023-28950)

Summary Features requiring MQ client connectivity in IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to IBM MQ CVE-2023-26285, CVE-2023-28950. The fix includes IBM Managed File Transfer and IBM MQ classes for Java at version 9.2.0.11 Vulnerability...

Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard operands are vulnerable to security restrictions bypass due to [CVE-2022-32221], [CVE-2023-27533], [CVE-2023-28322]

Summary cURL is present in the IBM App Connect Enterprise Certified Container Dashboard operand image. cURL is vulnerable to security restrictions bypass. This bulletin provides patch information to address the reported vulnerability in cURL. CVE-2022-32221, CVE-2023-27533, CVE-2023-28322...

CVE-2021-38933

IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210574...

CVE-2023-29260

IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135...

CVE-2023-29259

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

CVE-2023-29260

IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135...

CVE-2023-29259

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

Code injection

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055...

CVE-2023-29260

CVE-2023-29260: IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to SSRF (server-side request forgery). An authenticated attacker can trigger unauthorized requests from the affected system, potentially enabling network enumeration or other attacks. Root cause is SSRF in the server componen...

CVE-2023-29259

CVE-2023-29259 affects IBM Sterling Connect:Express for UNIX browser UI (1.5.x). The underlying issue is cookies sent without the SameSite attribute, enabling potentially cookie-based attacks. IBM bulletin lists CVSS base score 3.7 (LOW) and notes affected version 1.5.x. Remediation is to upgrade...

Debian dla-3499 : libapache2-mod-auth-openidc - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3499-1 [email protected]...

IBM Sterling Connect:Express for UNIX 代码问题漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect Express for UNIX version 1.5 that stems from vulnerability to server-side request forgery SSRF attacks, which c...

IBM Sterling Connect:Express for UNIX 安全漏洞

IBM Sterling Connect:Express for UNIX is a file transfer solution from International Business Machines IBM for the UNIX platform. A security vulnerability exists in IBM Sterling Connect:Express for UNIX version 1.5, which stems from the vulnerability of the browser UI to cookies...