Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. Guava, Red Hat Single Sign-On, Springfox and Spring Security could allow a remote attacker to bypass security restrictions...

Security Bulletin: IBM Integration Bus is vulnerable to arbitrary code execution due to Node.js ejs module (CVE-2022-29078)

Summary IBM Integration Bus is vulnerable to arbitrary code execution due to Node.js ejs module. Mitigation steps to disable node.js have been recommended. CVE-2022-29078 Vulnerability Details CVEID: CVE-2022-29078 DESCRIPTION: Node.js ejs module could allow a remote attacker to execute arbitrary...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to an issue in OPM and Golang Go packages (CVE-2020-15257, CVE-2021-21334 and CVE-2021-41771)

Summary IBM MQ Operator catalog container image is vulnerable to an issue in OPM package from Red Hat openshift4/ose-operator-registry and IBM MQ Operator, IBM Supplied Queue Manager container images are vulnerable to an issue in the Golang Go packages. CVE-2020-15257, CVE-2021-21334 and...

CVE-2022-23713

A cross-site-scripting XSS vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser...

CVE-2022-23713

A cross-site-scripting XSS vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser...

CVE-2022-23713

CVE-2022-23713 corresponds to a cross-site scripting (XSS) flaw in Vega Charts Kibana integration. Multiple sources (NVD entry, CNVD, Nessus findings, and Elastic security notes) confirm the affected component as Kibana’s Vega Charts integration and describe the impact as arbitrary JavaScript exe...

Fedora: Security Advisory for gopass-hibp (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Moderate: Red Hat Security Advisory: Satellite 6.11 Release

An update is now available for Red Hat Satellite 6.11 Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fixes: libsolv: Heap-based buff...

Satellite 6.11 Release

An update is available for libdb. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rocky Enterprise Software Foundation Satellite is a systems management tool for...

RLSA-2022:5498 Moderate: Satellite 6.11 Release

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fixes: libsolv: Heap-based buffer overflow in testcasere...

IBM App Connect Enterprise 资源管理错误漏洞

IBM Integration Bus IBM WebSphere Message Broker and IBM App Connect Enterprise are both products of IBM Corporation, USA.IBM Integration Bus is an Enterprise Service Bus ESB product that provides connectivity and common data transformation for Service Oriented Architecture SOA environments and...

Security Bulletin: IBM Integration Bus is vulnerable to denial of service due to ansi-regex module (CVE-2021-3807)

Summary IBM Integration Bus is vulnerable to a denial of service, due to the ansi-regex module for Node.js CVE-2021-3807. This affects the version of Node.js which is shipped with IBM Integration Bus for which a mitigation has been recommended. Vulnerability Details CVEID:CVE-2021-3807 DESCRIPTIO...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution, due to the async CVE-2021-43138 and nconf CVE-2022-21803 modules for Node.js. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to multiple openSSL vulnerabilities in Node.js (CVE-2022-1434, CVE-2022-1343, CVE-2022-1473)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a man-in-the-middle attack, remote attacker bypassing security restrictions and denial of service due to openSSL vulnerabilities in Node.js CVE-2022-1434, CVE-2022-1343, CVE-2022-1473. IBM App Connect provides a fix/fix...

[SECURITY] Fedora 36 Update: gopass-hibp-1.12.0-2.20220511gitd4baae0.fc36

Gopass haveibeenpwnd.com integration...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2023-05244)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...

simplepush 资源管理错误漏洞

simplepush is a mobile application from the German company simplepush. Push notifications can be sent to your device immediately via API or third-party integration. A security vulnerability exists in simplepush that stems from the registration of a fake application using the wrong deviceTokens,...

GitLab EE 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A cross-site scripting vulnerability exists in GitLab EE version 14.5 up to and...

Malicious code in web3-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5faeaf5e592fa854a38c5ee80aeb77b40c09f82cd8fbdaf7fdc37f6b095cb3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7082 Malicious code in web3-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5faeaf5e592fa854a38c5ee80aeb77b40c09f82cd8fbdaf7fdc37f6b095cb3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...