Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool. These issues were disclosed as part of the IBM Java SDK updates in Jul 2020. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. These issues were disclosed as part of Java SE issues disclosed in the Oracle July 2020 Critical Patch Update plus CVE-2019-17639...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2020 - Includes Oracle Jul 2020 CPU plus one additional vulnerability

Summary Steps to update Java for QMF Workstation & QMF Vision Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Software Architect and Rational Software Architect for WebSphere Software

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 that are used by IBM Rational Software Architect and Rational Software Architect for WebSphere Software has addressed the applicable CVEs CVE-2018-3180, CVE-2018-3139. Vulnerability Details CVEID:...

CVE-2020-6320

SAP Marketing Servlet, version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is required for an attacker to exploit the vulnerability and perform tasks related to contact and interaction data which impacts Confidentiali...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms Oct 2019 CPU (CVE-2019-2964, CVE-2019-2989 )

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 used by IBM Tivoli System Automation for Multiplatforms 4.1.0.0 to 4.1.0.3. These issues were disclosed as part of the IBM Java SDK updates in Oct 2019. There are multiple vulnerabilities in IBM SDK Java...

Downloads Resources over HTTP in adamvr-geoip-lite

Affected versions of adamvr-geoip-lite insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions b...

Security Bulletin: Multiple Java vulnerabilities affect IBM Spectrum Protect Plus (CVE-2020-2805, CVE-2020-2803, CVE-2020-2830, CVE-2020-2781, CVE-2020-2800. CVE-2020-2757, CVE-2020-2756, CVE-2020-2755, CVE-2020-2754)

Summary Multiple Java vulnerabilities were disclosed as part of the Java updates in April 2020, The Java vulnerabilities listed below may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-2805 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE...

Security Bulletin: Publicly disclosed vulnerability in Oracle Outside In Technology used by IBM FileNet Content Manager

Summary Multiple vulnerabilities may affect Oracle Outside In Technology OIT Version 8.5.3 used by IBM FileNet Content Manager. Oracle OIT issues disclosed in the Oracle October 2018 Critical Patch Update. Vulnerability Details CVEID: CVE-2018-18224 DESCRIPTION: An unspecified vulnerability in...

The vulnerability of the GlobalProtect for Windows and GlobalProtect for MacOS software lies in the ability to disclose information through event log files, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the GlobalProtect for Windows and GlobalProtect for MacOS software lies in the exploitation of information disclosure through event log files. Exploiting this vulnerability allows attackers to compromise the confidentiality and integrity of the protected information...

The vulnerability of Google Chrome’s online payment mechanism, which allows a violator to compromise data integrity

The vulnerability of Google Chrome’s online payment mechanism is related to the lack of a standard permission mechanism. Exploiting this vulnerability allows a malicious actor to affect data integrity through a specially created HTML page...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary Java SE issues disclosed in the Oracle July 2020 Critical Patch Update plus CVE-2019-17639. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause low...

Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Fri Jul 31 09:56:48 CDT 2020 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javaapr2020advisory.asc https://aix.software.ibm.com/aix/efixes/security/javaapr2020advisory.asc...

The vulnerability of the Grub.cfg configuration file of Grub2 operating system loaders, related to memory buffer overflow, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Grub.cfg configuration file of Grub2 operating systems is related to errors in eliminating certain elements. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

CVE-2020-14308

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts...

amq-on: CSRF (in graphQL requests)

A flaw was found in the AMQ Online console, where it is vulnerable to a Cross-Site Request Forgery attack CSRF, which is exploitable in cases where preflight checks are not instigated or bypassed. This flaw allows an attacker to target authorized users using an older browser with Adobe Flash. The...

jackson-databind: Serialization gadgets in commons-jelly:commons-jelly

A flaw was found in jackson-databind 2.x. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Security Bulletin: A Vulnerability in IBM Java Runtime Affects IBM Sterling Connect:Direct FTP+

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.10 used by IBM Sterling Connect:Direct FTP+. This issue was disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Secure Proxy

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling Secure Proxy. These issues were disclosed as part of the IBM Java SDK updates in July and October 2018. Vulnerability Details CVEID: CVE-2018-1517 DESCRIPTION: A flaw in the java.math...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling External Authentication Server

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling External Authentication Server. IBM Sterling External Authentication Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified...