Security Bulletin: Multiple vulnerabilities in IBM SDK Java affect IBM App Connect Enterprise and IBM Integration Bus

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM App Connect Enterprise and IBM Integration Bus. CVE-2022-21426, CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619, CVE-2022-3676, CVE-2023-21930, CVE-2023-21967, CVE-2023-21954, CV2-2023-21939,...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js (CVE-2023-0842)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js CVE-2023-0842. The latest Fix Pack includes xml2js version 5.0 Vulnerability Details CVEID:CVE-2023-0842 DESCRIPTION: xml2js could allow a remote attacker to execute arbitrary...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl and Google protobuf-java. (CVE-2022-42915, CVE-2021-22569, CVE-2022-3509, CVE-2022-3171, CVE-2022-3510)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl and protobuf-java. IBM App Connect Enterprise v12 OpenTelemetry trace is affected by cURL libcurl CVE-2022-42915. IBM App Connect Enterprise v11 and v12 DFDL is affected by protobuf-java CVE-2021-25569,...

Security Bulletin: Multiple vulnerabilities affect the IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit

Summary The IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit are vulnerable, as per the CVEs listed in the Vulnerability Details section. These vulnerabilities affect some development tasks in the product toolkit. CVE-2022-29599 and CVE-2020-10683 only affect Test and Java...

Elasticsearch 8.8.2, 7.17.11 Security Update

Elasticsearch Denial of Service DoS issue ESA-2023-10 This issue only affects users that have at least one OpenID Connect authentication realm or at least one JWT authentication realm configured. A denial of service vulnerability was discovered in Elasticsearch that could lead to the service...

CVE-2023-27866

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511...

CVE-2023-27866

CVE-2023-27866 affects IBM Informix JDBC Driver versions 4.10 and 4.50, with a remote code execution risk via JNDI injection when the LDAP URL in the Connect String is not verified. Affected software: Informix JDBC 4.10.x and 4.50.x. Root cause: unverified LDAP URL enabling JNDI injection. Impact...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to [CVE-2022-23539], [CVE-2022-23540] and [CVE-2022-23541]

Summary Node.js module Auth0 jsonwebtoken is used by IBM App Connect Enterprise Certified Container for generating, parsing and verifying JWTs. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions. This bulletin provides patch information...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to several vulnerabilities in Node.js due to [CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807]

Summary Node.js is used by all IBM App Connect Enterprise Certified Container components as a runtime engine. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, security restriction bypassing, cross-site script attack, cache poisoning, session hijacking,...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to directory traversal due to GHSA-v5gw-mw7f-84px [X-Force 255807]

Summary Python module Starlette is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to directory traversal. This bulletin provides patch information t...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of confidentiality due to [CVE-2023-32681]

Summary Python module Requests is used by IBM App Connect Enterprise Certified Container for making HTTPS calls in mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to loss of confidentiality. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to html injection due to [CVE-2023-24539]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to html injection. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24539 Vulnerability Details CVEID:CVE-2023-24539 DESCRIPTION: Go is vulnerable to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to HTML injection due to [CVE-2023-24540]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to HTML injection. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24540 Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go is vulnerable to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to denial of service due to [CVE-2023-24536]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24536 Vulnerability Details CVEID:CVE-2023-24536 DESCRIPTION: Golang Go is...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to denial of service due to [CVE-2023-24537]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24537 Vulnerability Details CVEID:CVE-2023-24537 DESCRIPTION: Golang Go is...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service due to [CVE-2023-2800]

Summary Hugging Face Transformers is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service. This bulletin provides patch information t...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service due to [CVE-2023-34104]

Summary Node.js module fast-xml-parser is used by IBM App Connect Enterprise Certified Container for parsing XML. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2023-26920]

Summary Node.js module fast-xml-parser is used by IBM App Connect Enterprise Certified Container for parsing XML data. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator are vulnerable to [CVE-2023-24532]

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to an unspecified error due to an error in the ScalarMult and ScalarBaseMult methods of the P256 Curve in Golang Go. This bulletin provides patch information to address the reported vulnerability in Golang...

PT-2023-21383 · Ibm · Ibm Informix Jdbc Driver

Name of the Vulnerable Software and Affected Versions: IBM Informix JDBC Driver versions 4.10 and 4.50 Description: The issue allows for remote code execution via JNDI injection when the driver code or the application using the driver does not verify the supplied LDAP URL in the Connect String...