Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details IBM X-Force ID: 212233 DESCRIPTION: d3-color is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted string that starts with the letter 'A' to the rgb a...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2022-27664 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted request, a remote attacker could exploit this vulnerability...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2022-21189 DESCRIPTION: Node.js dexie module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the Dexie.setByKeyPathobj, keyPath,...

Security Bulletin: IBM Edge Application Manager is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965))

Summary IBM Edge Application Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a...

Security Bulletin: Vulnerabilities in Apache Log4j affects IBm Edge Application Manager (CVE-2021-45105 and CVE-2021-45046)

Summary IBM Edge Application Manager IEAM 4.3.1 contains two dependencies that are affected by the Apache Log4j vulnerabilities described in CVE-2021-45105 and CVE-2021-45046. Note that IBM Edge Application Manager does not use Log4j directly. The first relates to code included in Intel Secure...

Security Bulletin: IBM Edge Application Manager is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary IBM Edge Application Manager IEAM 4.3.0 has a dependency on IBM Cloud Pak Foundational Services IBM Common Services which includes an unused Operator that contains a vulnerable version of Apache Log4j as described in CVE-2021-44228. An upgrade has been released which includes Apache Log4j...

IBM Edge Cross-Site Scripting Vulnerability

IBM Edge Application Manager is an application from IBM Corporation, USA. It provides powerful solutions to address the need to deliver enterprise computing power at the edge of the cloud, closer to where the data is created and at the edge of the enterprise where action needs to be taken. A...