Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to prototype polution due to CVE-2022-21824

Summary Node.js is used by all operands of IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands may be vulnerable to prototype polution. This bulletin provides patch information to address the reported vulnerability CVE-2022-21824 in Node.js...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to elevated privileges due to CVE-2022-26691

Summary CUPS is not used directly by IBM App Connect Enterprise Certified Containers but is present in the images as part of the base operationg system. IBM App Connect Enterprise Certified Container operands may be vulnerable to privilage elevation. This bulletin provides patch information to...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to Node.js module moment-timezone (IBM X-Force ID: 237819)

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to Node.js module moment-timezone IBM X-Force ID: 237819. The fix includes a version of moment-timezone 0.5.35 Vulnerability Details IBM X-Force ID: 237819 DESCRIPTION: Node.js moment-timezone module could allow a remote...

CVE-2022-39387

XWiki OIDC authenticator (prior to 1.29.1) is vulnerable to authentication bypass by supplying a custom OpenID provider through request parameters (oidc.endpoint.* or oidc.xwikiprovider) and can also map the user to XWikiAdminGroup via oidc.groups.mapping. This stems from improper authentication ...

CVE-2022-39387 XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWi...

XWiki OIDC 授权问题漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki OIDC versions prior to 1.29.1, which stems from the ability to bypass authentication altogether by providing its details to a third-party...

Pulse Connect Secure < 9.1R16 Client Side Desync (SA45476)

The Pulse Connect Secure installed on the remote host is prior to 9.1R16. It is, therefore, affected by client-side http request smuggling. When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends u...

CVE-2022-39387 XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWi...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of integrity due to CVE-2022-1621

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of integrity. This bulletin provides...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-2124, CVE-2022-2125, CVE-2022-2126 and CVE-2022-2129

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1629

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1927

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1897

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1785

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2017-0663 and loss of confidentiality due to CVE-2017-7375

Summary Libxml2 is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of libxml2 within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution and loss of...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the postgresql connector code may be vulnerable to SQL Injection due to [CVE-2022-35942]

Summary The postgresql Loopback connector is available in the IntegrationServer image from IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container does not use this component directly but it is available for use by an application developed to run in an...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code execution due to [CVE-2022-36067]

Summary Node.js module vm2 is used by the Box connector in IBM App Connect Enterprise Certified Container IntegrationServer operands. IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code injection. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to arbitrary code execution due to [CVE-2016-4658]

Summary The libxml2 library is not used directly by IBM App Connect Enterprise Certified Container but is included in the operating system packages in the operator and operand images. IBM App Connect Enterprise Certified Container operator and operand images may be vulnerable to arbitrary code...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing access restrictions due to [CVE-2022-27782]

Summary cURL is used by IBM App Connect Enterprise Certified Container for internal communication and status checking. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing access restrictions. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to arbitrary code execution [CVE-2022-25255]

Summary Qt for Linux is not used directly by IBM App Connect Enterprise Certified Container but it is included as an operating system package in the images. IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to arbitrary code execution. This bulletin provides...