CVE-2023-28382

Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for...

CVE-2023-28382

CVE-2023-28382 describes a directory traversal vulnerability in ESS REC Agent Server Edition series. An authenticated attacker can view or alter arbitrary files on the server. Affected editions and versions include: Linux V1.0.0–V1.4.3, Solaris V1.1.0–V1.4.0, HP-UX V1.1.0–V1.4.0, and AIX V1.2.0–V...

Security Bulletin: Vulnerabilites in OpenSSL may affect IBM Spectrum Protect Backup-Archive Client (CVE-2022-4450, CVE-2023-0216, CVE-2023-0401, CVE-2022-4203, CVE-2023-0217)

Summary IBM Spectrum Protect Backup-Archive Client can be affected by vulnerabilities in OpenSSL. Vulnerabilities include disclosure of sensitive information and denial of service, as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-4450...

Security Bulletin: server-side request forgery vulnerability in Apache CXF (CVE-2022-46364) may affect TXSeries for Multiplatforms

Summary TXSeries for Multiplatforms has addressed a vulnerability in Apache CXF CVE-2022-46364. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using...

K62695363: OpenSSL vulnerability CVE-2018-0733

Security Advisory Description Because of an implementation bug the PA-RISC CRYPTOmemcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than th...

K34146339: OpenSSL vulnerability CVE-2000-1254

Security Advisory Description crypto/rsa/rsagen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX...

SUSE CVE-2018-0733

Because of an implementation bug the PA-RISC CRYPTOmemcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security...

Security Bulletin: IBM Cognos BI 8.4 Partial Denial of Service Vulnerability

Abstract A malicious IBM Cognos BI 8.4 user is able to send a crafted request to the Cognos server which triggers high CPU utilization that may cause a partial denial of service condition due to CPU consumption. This vulnerability can only be exploited by authenticated users, and is not applicabl...

Security Bulletin: IBM Informix Genero vulnerable to libpng chunk decompression integer overflow vulnerability (CVE-2011-3026).

Abstract A remote, unauthenticated attacker can exploit an integer overflow vulnerability in the libpng library to cause a crash or execute malicious code on a vulnerable system. Content CVE ID: CVE-2011-3026 DESCRIPTION: The libpng library used by IBM Informix Genero contains an integer overflow...

Security Bulletin: Potential Oracle Outside In Technology Vulnerabilities Exposed in DB2 9.7.0.4 Accessories Suite (CVE-2011-2264, CVE-2011-0794, and CVE-2011-0808)

Abstract Oracle Outside In Technology contains exploitable vulnerabilities in the CorelDRAW CVE-2011-2264 file parser, the File ID SDK CVE-2011-0794, and file filters CVE-2011-0808. Each of these vulnerabilities may allow a remote, unauthenticated user to execute arbitrary code on a vulnerable...

CVE-2022-28623

Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the following updated modules to resolve these vulnerabilities. HPE IceWall SSO version 10.0 certd library Patch 9 for RHEL and HPE IceWall SS...

CVE-2022-28623

Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the following updated modules to resolve these vulnerabilities. HPE IceWall SSO version 10.0 certd library Patch 9 for RHEL and HPE IceWall SS...

Sql injection

Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the following updated modules to resolve these vulnerabilities. HPE IceWall SSO version 10.0 certd library Patch 9 for RHEL and HPE IceWall SS...

CVE-2022-28623

HPE IceWall SSO 10.0 certd library contains a remote SQL injection/unauthorized data injection vulnerability (CVE-2022-28623). The issue affects the certd component and is mitigated by Patch 9 for both RHEL and HP-UX releases.

Security Bulletin: IBM® Db2® could allow a local user elevated privileges due to allowing modification of columns of existing tasks (CVE-2021-38926)

Summary Db2 could allow a local user elevated privileges due to allowing modification of columns of existing tasks. Vulnerability Details CVEID: CVE-2021-38926 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server could allow a local user to gain privileges due to allowing...

Security Bulletin: Stack-based Buffer Overflow vulnerability in IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Space Management (CVE-2021-39048)

Summary IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Space Management are vulnerable to a stack-based buffer overflow caused by improper bounds checking. Vulnerability Details CVEID: CVE-2021-39048 DESCRIPTION: IBM Spectrum Protect Client is vulnerable to a stack based...

Security Bulletin: IBM® Db2® could allow a local user to read and write specific files due to weak file permissions (CVE-2020-4976)

Summary IBM® Db2® could allow a local user to read and write specific files due to weak file permissions Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and wri...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary Java SE issues disclosed in the Oracle July 2021 Critical Patch Update, minus CVE-2021-2341. CVE-2021-2341 will be covered in an additional bulletin. Vulnerability Details CVEID: CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an...

Security Bulletin: A Vulnerability in IBM Java Runtime Affects IBM Sterling Connect:Direct FTP+

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 8.0.6.15 and 8.0.5.35, used by IBM Sterling Connect:Direct FTP+ on AIX, Linux, Solaris, Windows, and HP-UX platforms. IBM Sterling Connect:Direct FTP+ has addressed the applicable CVE. Vulnerability Details CVEID:...

Security Bulletin: IBM® Db2® is vulnerable to weak file permissions allowing access to specific files (CVE-2020-4976)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local user to read and write specific files due to weak file permissions. Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a loc...