Security Bulletin: IBM UrbanCode Deploy (UCD) Agents as a windows service is vulnerable to a Denial Of Service (CVE-2023-42012)

Summary An IBM UrbanCode Deploy UCD Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. Vulnerability Details CVEID:CVE-2023-42012 DESCRIPTION: An IBM UrbanCode Deploy Agent installed as a Windows service in a...

Security Bulletin: IBM UrbanCode Deploy (UCD) is susceptible to an HTML injection vulnerability (CVE-2023-42015)

Summary IBM UrbanCode Deploy UCD is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. Vulnerability Details CVEID:CVE-2023-42015 DESCRIPTION: IBM UrbanCode Deploy UCD is vulnerable ...

Security Bulletin: Vulnerability in d3-color affects IBM UrbanCode Velocity . WS-2022-0322

Summary WS-2022-0322 The d3-color module prior to 3.1.0 which Velocity was using is susceptible to a regular expression denial of service attack. Vulnerability Details IBM X-Force ID: 212233 DESCRIPTION: d3-color is vulnerable to a denial of service, caused by improper input validation. By sendin...

Security Bulletin: IBM UrbanCode Release addresses multiple vulnerablities.

Summary IBM UrbanCode Release 6.2.5.11 addresses multiple vulnerablities. CVE-2023-41080, CVE-2022-40149, CVE-2022-40150, CVE-2022-45685, CVE-2023-1436, CVE-2022-45693, CVE-2023-28709, CVE-2020-13936, CVE-2023-28708, CVE-2023-34981, CVE-2019-10172, CVE-2019-10202 Vulnerability Details CVEID:...

Security Bulletin: IBM UrbanCode Release 6.2.5.11 addresses multiple vulnerablities

Summary IBM UrbanCode Release 6.2.5.11 addresses multiple vulnerablities Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function...

CVE-2023-40376: Missing Authorization

IBM UrbanCode Deploy UCD 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X-Force ID: 263581...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to XML external entity XXE due to Apache Ivy

Summary Apache Ivy may be used by plugins or custom scripts in IBM UrbanCode Deploy UCD. Apache Ivy is vulnerable to a XXE caused by improper handling of XML external entity XXE declarations by the XML parser. CVE-2022-46751 Vulnerability Details CVEID:CVE-2022-46751 DESCRIPTION: Apache Ivy could...

Security Bulletin: IBM UrbanCode Build is vulnerable to CVE-2023-24998

Summary IBM UrbanCode Build is vulnerable to CVE-2023-24998. IBM has addressed these vulnerabilities by updating Apache Tomcat Server. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2023-37161)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...

CVE-2022-43877

IBM UrbanCode Deploy UCD versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148...

CVE-2022-43877 IBM UrbanCode Deploy (UCD) information disclosure

IBM UrbanCode Deploy UCD versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148...

CVE-2022-43877: Insecure Storage of Sensitive Information

IBM UrbanCode Deploy UCD versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to HTTP response splitting due to Netty (CVE-2022-41915)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. An attacker may be able to inject HTTP/1.1 response header and cause the server to return a split resonse. CVE-2022-41915 Vulnerability Details CVEID:CVE-2022-41915 DESCRIPTION: Netty is vulnerable to HTTP response...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to sensitive information disclosure due to Apache Commons Net (CVE-2021-37533)

Summary Apache Commons Net is used by the included zOS Utility plugin FTP Artifacts step to connect to remote FTP servers. By persuading a victim to connect to a specially-crafted server, an attacker could exploit this vulnerability to obtain information about services running on the private...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to Path Traversal due to Apache Ivy (CVE-2022-37865, CVE-2022-37866)

Summary Apache Ivy is used by IBM UrbanCode Deploy as part of the Agents Apache Groovy scripting home. CVE-2022-37865, CVE-2022-37866 Vulnerability Details CVEID:CVE-2022-37866 DESCRIPTION: Apache Ivy could allow a remote attacker to traverse directories on the system, caused by improper validati...

Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-45143

Summary IBM UrbanCode Build is affected by CVE-2022-45143 Vulnerability Details CVEID:CVE-2022-45143 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by not escape the type, message or description values in the JsonErrorReportValve function. By...

Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-45143

Summary IBM UrbanCode Release is affected by CVE-2022-45143 Vulnerability Details CVEID:CVE-2022-45143 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by not escape the type, message or description values in the JsonErrorReportValve function. By...

Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-42252

Summary IBM UrbanCode Release is affected by CVE-2022-42252 Vulnerability Details CVEID:CVE-2022-42252 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by the failure to reject a request containing an invalid Content-Length header when configured to ignore invalid HTTP...

Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-42252

Summary IBM UrbanCode Release is affected by CVE-2022-42252 Vulnerability Details CVEID:CVE-2021-43980 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a long standing concurrency flaw in the simplified implementation of blocking reads and writes...

Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-34305

Summary IBM UrbanCode Release is affected by CVE-2022-34305 Vulnerability Details CVEID:CVE-2022-34305 DESCRIPTION: Apache Tomcat is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability using the...