Pulse Secure Pulse Connect Secure 环境问题漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. An environmental issue vulnerability exists in Pulse Secure Pulse Connect Secure version 9.115 and prior versions. An attacker could exploit this...

Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to zlib (CVE-2018-25032)

Summary IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to zlib. The fix includes zlib 1.2.12. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM App Connect Enterprise and IBM Integration Bus

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM App Connect Enterprise and IBM Integration Bus. These issues were disclosed as part of the IBM SDK, Java Technology Edition Quarterly CPU - Apr 2022 includes Oracle April 2022 CPU. The fix includes IBM Jav...

Security Bulletin: Javadoc vulnerability exists in the IMS Connect API for Java component of IMS Enterprise Suite (CVE-2013-1571)

Abstract The IMS™ Connect API for Java™ component of IMS Enterprise Suite version 2.2 contains a frame injection vulnerability for Javadoc™. Content VULNERABILITY DETAILS CVE ID : CVE-2013-1571 DESCRIPTION HTML documentation generated by the Javadoc tool contains a security vulnerability. The...

Security Bulletin: IBM DB2 is impacted by a vulnerability in the IBM GSKit library (CVE-2013-0169).

Abstract GSKit is used by IBM DB2 for SSL support. The version of GSKit iused by DB2 is vulnerable to the “Lucky Thirteen” security vulnerability. By default, DB2 does not use SSL for client-server communication and therefore DB2 is vulnerable only if SSL is enabled. Content VULNERABILITY DETAILS...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IMS™ Enterprise Suite: Connect API for Java, SOAP Gateway, and Explorer for Development (CVE-2015-0138, CVE-2015-0410, CVE-2014-6593)

Abstract There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, IBM SDK, Java Technology Edition, Version 7 Service Refresh 8 that is used the following IMS™ Enterprise Suite components: Connect API for Java, SOAP Gateway, and Explorer for Development. These issues were disclose...

PT-2022-34273 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: A potential security issue exists in the RDMA/siw component, where a duplicated reported IW CM EVENT CONNECT REPLY event may occur. The actual impact and attack plausibility have not yet be...

PT-2022-33773 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.9 through v5.15.62 Description: A memory leak issue exists in the vsock connect function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v3.9 through...

PT-2022-34374 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.256 Description: A memory leak issue exists in the vsock connect function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v4.19.256,...

PT-2022-34481 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.9 through v4.14.290 Description: A memory leak was discovered in the vsock connect function. The issue was introduced in version v3.9 and is fixed in version v4.14.291. Recommendations: For Linux Kernel versions v3.9...

PT-2022-33938 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.61 Description: The issue is related to an out of bound read for SMB2 TREE CONNECT. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to...

GSD-2022-1005356 ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT

ksmbd: prevent out of bound read for SMB2TREECONNNECT This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

PT-2022-33498 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.3 through v5.19.1 Description: A potential security issue is identified in the RDMA/siw component, related to a duplicated reported IW CM EVENT CONNECT REPLY event. The actual impact and attack plausibility have not y...

PT-2022-33398 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v3.9 through v5.19.3 Description: A memory leak issue was discovered in the vsock connect function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions v3.9...

Security Bulletin: Due to use of pac4j, IBM Cloud PAK for Watson AI Ops is vulnerable to token bypass (CVE-2021-44878)

Summary If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none"...

CVE-2022-22520

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2...

CVE-2022-22520

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2...

Code injection

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2...

CVE-2022-22520

CVE-2022-22520 describes a remote, unauthenticated user enumeration vulnerability in MB connect line products: mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual up to v2.11.2. The underlying issue is that the webservice allows attackers to enumerate valid users by sending specific...

CVE-2022-22520 User enumeration vulnerability in MB connect line and Helmholz products

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2...