Security Bulletin: Apache Commons IO used by IBM InfoSphere Identity Insight has a potential vulnerability (CVE-2024-47554)

Summary The Apache Commons IO used by Identity Insight is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the org.apache.commons.io.input.XmlStreamReader class. By sending a specially crafted input, a remote attacker could exploit this vulnerability to...

Security Bulletin: Vulnerability in Apache Commons Compress ( CVE-2024-26308) may affect IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential vulnerability CVE-2024-26308 has been identified related to Apache Commons Compress that may affect IBM watsonx Assistant for IBM Cloud Pak for Data. vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-26308...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack due to the Apache Commons Compress component (CVE-2024-25710, CVE-2024-26308).

Summary IBM Event Streams is vulnerable to a denial of service due to the Apache Commons Compress component. Commons Compress is a library that creates a standard interface for the most widely used compression and archiving formats. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Apache...

Security Bulletin: IBM PowerVM Novalink is vulnerable because Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the org.apache.commons.io.input.XmlStreamReader class. ( CVE-2024-47554)

Summary IBM PowerVM Novalink is vulnerable because Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the org.apache.commons.io.input.XmlStreamReader class. By sending a specially crafted input, a remote attacker could exploit this...

org.apache.hive:hive-llap-client (2.3.6), org.apache.hive:hive-llap-tez (2.3.6) +5 more potentially affected by CVE-2024-23953 via org.apache.hive:hive-llap-common (2.3.6)

org.apache.hive:hive-llap-common MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-llap-common and may be impacted: - org.apache.hive:hive-llap-client 2.3.6 - org.apache.hive:hive-llap-tez 2.3.6 -...

Security Bulletin: Vulnerabilities in Apache Commons Collections, Apache Synapse, Oracle WebLogic Server, MuleSoft and Red Hat JBoss might affect IBM Storage Copy Data Management.

Summary IBM Storage Copy Data Management can be affected by vulnerabilities in Apache Commons Colections, Apache Synapse, Oracle WebLogic Server, MuleSoft and Red Hat JBoss. Vulnerabilities include an attacker could exploit these vulnerabilities to execute arbitrary code on the system, allow remo...

Oracle Primavera Unifier (January 2025 CPU)

The versions of Primavera Unifier installed on the remote host are affected a vulnerability as referenced in the January 2025 CPU advisory. - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Apache Commons BCEL vulnerability (USN-7208-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7208-1 advisory. Felix Wilhelm discovered that Apache Commons BCEL APIs incorrectly handled parameters due to a memory issue. An attacker...

USN-7208-1 bcel vulnerability

Felix Wilhelm discovered that Apache Commons BCEL APIs incorrectly handled parameters due to a memory issue. An attacker supplying malicious input could exploit this to generate and execute arbitrary bytecode...

USN-7208-1: Apache Commons BCEL vulnerability

Felix Wilhelm discovered that Apache Commons BCEL APIs incorrectly handled parameters due to a memory issue. An attacker supplying malicious input could exploit this to generate and execute arbitrary bytecode...

Atlassian Confluence 7.14.x < 7.19.25 / 7.20.x < 8.5.12 / 8.6.x < 8.9.4 / 9.2.0 (CONFSERVER-98680)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-98680 advisory. - Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3...

Security Bulletin: vulnerability in Apache Commons HttpClient affects IBM Workload Automation.

Summary IBM Workload Automation is affected by a vulnerability in Apache Commons HttpClient that can cause Authorization Bypass CVE-2012-5783 Vulnerability Details CVEID:CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Service FPS merchant Java SDK and oth...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the org.apache.commons.io.input.XmlStreamReader class.

Summary Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by the FileNameUtils.normalize method. An attacker could send a specially-crafted URL request containing dot dot sequences /../ to view arbitrary files on the system...

PT-2025-25565

Name of the Vulnerable Software and Affected Versions Apache Commons FileUpload versions 1.0 through 1.5 Apache Commons FileUpload versions 2.0.0-M1 through 2.0.0-M3 Description The issue is related to the allocation of resources for multipart headers with insufficient limits, which enables a...

org.springmodules:spring-modules-jakarta-commons (>=0.8, <=0.8a), org.springmodules:spring-modules-osworkflow (>=0.8, <=0.8a) potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (2.0.3)

org.springframework:spring-webmvc MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons =0.8, =0.8, =0.8a Source cves: CVE-2024-3881...

org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...

ch.hortis.sonar:sonar-application (>=1.0-beta, <=1.0.2), ch.hortis.sonar:sonar-commons (>=1.0-beta, <=1.0.2) +24 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (0.9.8)

ch.qos.logback:logback-core MAVEN version 0.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.hortis.sonar:sonar-application =1.0-beta, =1.0-beta, =1.0-beta, =1.0-beta, =1.0-beta, =0.9.9, =0.9.9,...

ch.hortis.sonar:sonar-commons (0.2), ch.hortis.sonar:sonar-maven-plugin (0.2) +4 more potentially affected by CVE-2024-12798 via ch.qos.logback:logback-core (0.9.5)

ch.qos.logback:logback-core MAVEN version 0.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.hortis.sonar:sonar-commons 0.2 - ch.hortis.sonar:sonar-maven-plugin 0.2 - ch.qos.logback:log4j-bridge...

Security Bulletin: TADDM is vulnerable to a denial of service due to vulnerability in SBLIM and Apache Commons Library

Summary SBLIM and Apache Commons used by IBM Tivoli Application Dependency Discovery Manager and is vulnerable to CVE-2008-7230, CVE-2010-1937 and CVE-2012-2328 Vulnerability Details CVEID:CVE-2008-7230 DESCRIPTION: An unspecified vulnerability in SBLIM-SFCB Small Footprint CIM Broker has an...

Security Bulletin: IBM Operational Decision Manager for Nov 2024 - Multiple CVEs addressed

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-47554...