Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to IBM Dojo (CVE-2021-234550), Java SE (CVE-2021-35578), IBM WebSphere Application Server - Liberty (CVE-2021-39031), Apache Log4j (CVE-2021-44832) and Gson (217225)

Summary IBM Spectrum Control has multiple vulnerabilities: arbitrary code execution due to Apache Log4j CVE-2021-44832 and Dojo CVE-2021-23450, denial of service due to Java SE CVE-2021-35578 and Gson 217225 and LDAP injection due to IBM Websphere Application Security - Liberty CVE-2021-39031. Th...

Vulnerabilities fixed in IBM Spectrum Control

IBM has fixed vulnerabilities in several components of IBM Spectrum Control. These include vulnerabilities in third-party software parties such as Apache Log4j, Dojo, Java SE, Gson and Websphere Liberty. A malicious party could exploit the vulnerabilities to cause damage cause damage in the...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1 <=1.0.2), ai.api.libai.speech:libai-speech-gcp (>=1.4.6 <=1.6.12) +44214 more potentially affected by CVE-2022-25647 via com.google.code.gson:gson (>=2.2.3 <=2.8.8)

com.google.code.gson:gson MAVEN version =2.2.3, =1.0.1, =1.4.6, =1.4.6, =1.1.0, ='1.0.3', =0.9.6, =1.0.0, =1.0.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.2.8 and more Source cves: CVE-2022-25647 Source advisory: SNYK:JAVA-COMGOOGLECODEGSON-1730327...

CVE-2021-21430

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

Design/Logic Flaw

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

CVE-2021-21430

OpenAPI Generator contains a vulnerability where code generated for Java/Scala performs insecure temporary file creation via File.createTempFile, risking exposure of application/data when handling binary uploads/downloads. Affected generators include Java (jersey2, okhttp-gson default) and scala-...

Prototype Pollution in sagold/gson-query

Description gson-query is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following PoC file: js // poc.js var gsonQuery = require"gson-query" var obj =...

CVE-2020-8028 salt-api is accessible to every user on SUSE Manager Server

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system...

Oracle Communications WebRTC Session Controller Denial of Service Vulnerability

Oracle Communications Applications is a suite of applications for rapidly delivering and monetizing digital life communications from Oracle Corporation.Oracle Communications WebRTC Session Controller is one of the session controller components. A security vulnerability exists in the Security Gson...