Security Bulletin: IBM Security Risk Manager on CP4S is affected by multiple vulnerabilities

Summary IBM Security Risk Manager on CP4S has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a...

Security Bulletin: IBM Security Guardium Insights is affected by components with known vulnerabilities (CVE-2018-10237, CVE-2020-9488)

Summary IBM Security Guardium Insights has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-10237 DESCRIPTION: Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and CompoundOrdering class. By sendin...

CVE-2018-10237

A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service...

Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2019-13990 DESCRIPTION: Terracotta could allow a remote attacker to obtain sensitive information, caused by improper handling of...

Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp...

guava: local information disclosure via temporary directory created with unsafe permissions

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...

3.6 bug fix and enhancement update

An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...

Security Bulletin: Guava Google Core Libraries Vulnerability Affects IBM Control Center (CVE-2020-8908)

Summary Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp directory creation vulnerability. Vulnerability Details CVEID: CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp...

Google Guava Files createTempDir Unauthorized Access

The vulnerability of the Files.createTempDir function implementation in the Java libraries of Google Guava is related to the incorrect assignment of permissions for the temporary file directory. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected informati...

Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory. - Vulnerability in Oracle NoSQL Database component: Administration Node.js. The supported version th...

Security Bulletin: A vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis Analysis (CVE-2018-10237)

Summary A vulnerability on unbounded memory allocation was addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2018-10237 DESCRIPTION: Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and...

0x.plugin.bom:zero-x-plugin-bom (>=0.0.10, <=1.1.0), ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3) +9787 more potentially affected by CVE-2020-8908 via com.google.guava:guava (29.0-jre)

com.google.guava:guava MAVEN version 29.0-jre is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - 0x.plugin.bom:zero-x-plugin-bom =0.0.10, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0....

Information Disclosure in Guava

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir. The permissions granted to the directory created defau...

cc.smartcash.smartcashj:smartcashj-core (0.17.2), com.github.chajath:guice-aqueduct (1.2) +31 more potentially affected by CVE-2020-8908 via com.google.guava:guava (24.0-android)

com.google.guava:guava MAVEN version 24.0-android is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - cc.smartcash.smartcashj:smartcashj-core 0.17.2 - com.github.chajath:guice-aqueduct 1.2 -...

br.com.tecsinapse:glimpse-server (>=1.1.1, <=1.1.2), cc.factorie:factorie_2.11 (1.2) +1129 more potentially affected by CVE-2020-8908 via com.google.guava:guava (12.0)

com.google.guava:guava MAVEN version 12.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - br.com.tecsinapse:glimpse-server =1.1.1, =2.0.4, =1.5, =0.5.0, =0.5.1 - com.data-artisans:flakka-contrib2.10...

ai.databand.azkaban:azkaban-common (3.18.0), ai.databand.azkaban:azkaban-exec-server (3.18.0) +2457 more potentially affected by CVE-2020-8908 via com.google.guava:guava (13.0.1)

com.google.guava:guava MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.databand.azkaban:azkaban-common 3.18.0 - ai.databand.azkaban:azkaban-exec-server 3.18.0 -...

com.google.guava:guava-gwt (23.0-rc1), com.google.guava:guava-testlib (23.0-rc1) potentially affected by CVE-2020-8908 via com.google.guava:guava (23.0-rc1)

com.google.guava:guava MAVEN version 23.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - com.google.guava:guava-gwt 23.0-rc1 - com.google.guava:guava-testlib 23.0-rc1 Source cves: CVE-2020-8908 Source...

cc.vileda:kotlin-openapi3-dsl (>=0.18.0, <=0.20.1), ch.vorburger:xtendbeans (>=1.2.2, <=1.2.3) +251 more potentially affected by CVE-2020-8908 via com.google.guava:guava (19.0-rc3)

com.google.guava:guava MAVEN version 19.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - cc.vileda:kotlin-openapi3-dsl =0.18.0, =1.2.2, =0.78, =0.78, =0.78, =2.3.2, =2.3.2, =7.0.0, =2.0.0, =3.0.0,...

com.github.hazendaz.maven:makeself-maven-plugin (1.1.0), com.google.guava:guava-testlib (25.0-android) +32 more potentially affected by CVE-2020-8908 via com.google.guava:guava (25.0-android)

com.google.guava:guava MAVEN version 25.0-android is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - com.github.hazendaz.maven:makeself-maven-plugin 1.1.0 - com.google.guava:guava-testlib 25.0-android -...

ai.chronon:flink_2.12 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115), ai.chronon:online_2.12 (>=chaining-0.0.46-dev, <=0.0.115) +5438 more potentially affected by CVE-2020-8908 via com.google.guava:guava (14.0.1)

com.google.guava:guava MAVEN version 14.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.chronon:flink2.12 =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =chaining-0.0.46-dev,...