LuckyMouse Hackers Target Banks, Companies and Governments in 2020

An adversary known for its watering hole attacks against government entities has been linked to a slew of newly detected intrusions targeting various organizations in Central Asia and the Middle East. The malicious activity, collectively named "EmissarySoldier," has been attributed to a threat...

Security Bulletin: IBM® Db2® could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. (CVE-2020-4739)

Summary IBM DB2 on Windows could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability ...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM StoredIQ for Legal

Summary There are multiple vulnerabilities in IBM Db2 that affect IBM StoredIQ for Legal. These have been addressed in Fix Pack 2.0.3.13 of StoredIQ for Legal Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11...

Security Bulletin: A security vulnerability has been identified in IBM DB2 shipped with IBM Maximo Asset Management (CVE-2020-4701 and CVE-2020-4739)

Summary IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about the security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Atlassian Bitbucket on Windows is vulnerable to privilege escalation due to weak ACLs

Overview Atlassian Bitbucket on Windows fails to properly set ACLs, which can allow an unprivileged Windows user to run arbitrary code with SYSTEM privileges. Description The Atlassian Bitbucket Windows installer fails to set a secure access-control list ACL on the default installation directory,...

Security Bulletin: Multiple security vulnerabilities may affect IBM DB2 shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary IBM DB2 is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Information about security vulnerabilities affecting DB2 has been published in multiple security bulletins as below. Vulnerability Details Refer to the security bulletins listed...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple IBM DB2 Server security vulnerabilities affect IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checkin...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Emptoris Supplier Lifecycle Mgmt

Summary Multiple IBM DB2 Server Security vulnerabilities affect IBM Emptoris Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Program Management

Summary Multiple IBM DB2 Server security vulnerabilities affect IBM Emptoris Program Management deployments. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform

Summary Multiple IBM DB2 Server security vulnerabilities affect IBM Emptoris Strategic Supply Management Platform deployments. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Contract Management

Summary Multiple IBM DB2 server security vulnerabilities affect IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper...

Adobe ColdFusion is vulnerable to privilege escalation due to weak ACLs

Overview Adobe ColdFusion fails to properly set ACLs, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description The Adobe ColdFusion installer fails to set a secure access-control list ACL on the default installation directory, such as...

Security Bulletin: Security vulnerability in IBM Java SDK affecting Rational Synergy (CVE-2019-4732)

Summary There is a security vulnerability in IBM® SDK Java™ Technology Edition, Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55 used by Rational Synergy versions 7.2.1.0 to 7.2.1.7. Rational Synergy has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-4732...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM ILOG CPLEX Optimization Studio

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM CPLEX Optimization Studio. IBM CPLEX Optimization Studio has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product...

Security Bulletin: Multiple vulnerabilities in Db2 affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary IBM® Db2® shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise is vulnerable to information disclosure. Vulnerabilities have been identified in IBM Db2 and information about their fixes are published in a security bulletin. Vulnerability Details Refer to the security...

IBM DB2 9.7 < FP11 40481 / 10.1 < FP6 40480 / 10.5 < FP11 40479 / 11.1 < FP5 40478 / 11.5 < 11.5.5000.1587 Command Injection (Windows)

A command injection vulnerability exists in IBM DB2 due to a DLL search order hijacking vulnerability in Microsoft Windows client. An unauthenticated, local attacker can exploit this, by placing a specially crafted file in a compromised folder, to execute arbitrary commands. Note that Nessus has...

IBM DB2 Connect 9.7 < FP11 40481 / 10.1 < FP6 40480 / 10.5 < FP11 40479 / 11.1 < FP5 40478 / 11.5 < 11.5.5000.1587 Command Injection

A command injection vulnerability exists in IBM DB2 Connect due to a DLL search order hijacking vulnerability in Microsoft Windows client. An unauthenticated, local attacker can exploit this, by placing a specially crafted file in a compromised folder, to execute arbitrary commands. Note that...

Spoofing

IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft...

CVE-2020-4739

CVE-2020-4739 is a DLL search order hijacking vulnerability in IBM Db2 on Windows client components. The CVE affects IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) across multiple releases (9.7, 10.1, 10.5, 11.1, 11.5) and requires a local authenticated user to place a crafted...

CVE-2020-4739

IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft...