Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to multiple vulnerabilities in IBM Java SDK

Summary There are multiple vulnerabilities in IBM Java SDK, Java Technology Edition used by IBM App Connect Enterprise and IBM Integration Bus. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An unspecified...

BIT-MYSQL-CLIENT-2020-2760

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2024-25614

CVE-2024-25614 describes an arbitrary file deletion vulnerability in the ArubaOS CLI. Exploitation could delete arbitrary files on the underlying OS, with potential denial-of-service and integrity impacts to Aruba controllers. Connected sources confirm ArubaOS CLI is the affected component and th...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx6 bundle imx61.0.7-2, which originated from a vulnerability that could allow an unauthenticated, remote attacker to access and obtain critical information, with other unspecified impacts on...

Cross site scripting

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities listed herein. Vulnerability Details CVEID:CVE-2023-51074 DESCRIPTION: json-path is vulnerable to a denial of service, caused by a stack-based buffer overflow in the Criteria.parse method. By sending a...

CVE-2023-52369

Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may affect service availability and integrity...

CVE-2023-52361

The VerifiedBoot module has a vulnerability that may cause authentication errors.Successful exploitation of this vulnerability may affect integrity...

CVE-2023-52360

Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity...

CVE-2024-20947

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Design/Logic Flaw

Vulnerability in Oracle Audit Vault and Database Firewall component: Firewall. Supported versions that are affected are 20.1-20.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Audit Vault and Database Firewall. Successful...

Design/Logic Flaw

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.21 and 21.3-21.12. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise...

CVE-2024-20925

CVE-2024-20925 is a vulnerability affecting Oracle Java SE (JavaFX) and Oracle GraalVM Enterprise Edition (JavaFX). Affected versions include Oracle Java SE 8u391 and GraalVM EE 20.3.12 / 21.3.8. The issue is described as difficult to exploit, requiring network access via multiple protocols and u...

CVE-2024-20927

CVE-2024-20927 affects Oracle WebLogic Server (Core) in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.1.0.0. The issue allows an unauthenticated attacker with network access via HTTP to compromise WebLogic Server, potentially leading to unauthorized creation, deletion or mod...

CVE-2024-20919

CVE-2024-20919 affects Oracle Java SE and GraalVM family (Hotspot component). Affected: Oracle Java SE 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; GraalVM for JDK 17.0.9, 21.0.1; GraalVM Enterprise 20.3.12, 21.3.8, 22.3.4. Vulnerability allows unauthenticated network access via multiple protocols...

PT-2024-14551 · Unknown · Verifiedboot

Name of the Vulnerable Software and Affected Versions: VerifiedBoot affected versions not specified Description: The VerifiedBoot module has a vulnerability that may cause authentication errors. Successful exploitation of this vulnerability may affect integrity. Recommendations: At the moment,...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition for Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint

Summary CVE-2023-22081 and CVE-2023-22067 were disclosed in the Oracle October 2023 Critical Patch Update. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality impact...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...