Security Bulletin: There is a vulnerability in Eclipse Jetty used by IBM Maximo Asset Management (CVE-2022-2047)

Summary There is a vulnerability in Eclipse Jetty used by IBM Maximo Asset Management. Vulnerability Details CVEID:CVE-2022-2047 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw in the HttpURI class. By sending a...

Security Bulletin: IBM HTTP Server is vulnerable to a denial of service (CVE-2023-26281)

Summary IBM HTTP Server, which is used by IBM WebSphere Application Server, is vulnerable to a denial of service using a specially crafted URL. This has been addressed in the remediation section below. Vulnerability Details CVEID:CVE-2023-26281 DESCRIPTION: IBM HTTP Server used by IBM WebSphere...

Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition affect IBM Operations Analytics Predictive Insights

Summary Multiple vulnerabilities in IBM SDK, Java Technology Edition affect IBM Operations Analytics Predictive Insights 1.3.6 or earlier. The following vulnerabilities, CVE-2022-21619, CVE-2022-21624, CVE-2022-21626, CVE-2022-21628 allowing unauthorized access of unauthenticated attacker with...

Security Bulletin: Ineffective Cross Site Request Forgery (CSRF) protection in IBM Business Process Manager (BPM) (CVE-2017-1769)

Summary The optional Cross Site Request Forgery CSRF protection feature using Referer header allow listing is ineffective in IBM BPM V8.6.0.0. The check is effectively skipped. Vulnerability Details CVEID: CVE-2017-1769 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-site request...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to server-side request forgery due to Apache CXF CVE-2022-46364 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM CICS TX Standard is vulnerable to a remote attacker hijacking the clicking action of a victim (CVE-2022-34162).

Summary IBM CICS TX could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. The...

Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go.

Summary IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go. The fix removes these vulnerabilities from IBM CICS TX Standard. Vulnerability Details CVEID:CVE-2022-27191 DESCRIPTION: Go ssh package is vulnerable to a denial of service, caused by an unspecified flaw in certa...

Security Bulletin: IBM CICS TX Standard is vulnerable to attackers being able to get cookie values (CVE-2022-34307).

Summary IBM CICS TX could allow attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. The fix...

Security Bulletin: IBM CICS TX Standard is vulnerable to an Open Container Initiative Distribution Specification vulnerability (CVE-2021-41190).

Summary IBM CICS TX Standard is vulnerable to an Open Container Initiative Distribution Specification vulnerability CVE-2021-41190. The fix removes this vulnerability from IBM CICS TX Standard. Vulnerability Details CVEID:CVE-2021-41190 DESCRIPTION: Open Container Initiative Distribution...

Security Bulletin: IBM CICS TX Standard is vulnerable to a back and refresh attack (CVE-2022-33955)

Summary IBM CICS TX could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. The fix removes this vulnerability CVE-2022-33955 from IBM CICS TX Standard. Vulnerability Details CVEID:CVE-2022-33955 DESCRIPTION: IBM CICS TX could allow...

Security Bulletin: IBM CICS TX Standard is vulnerable to an attacker decrypting highly sensitive information . (CVE-2022-34310) .

Summary IBM CICS TX Standard could allow an attacker to decrypt highly sensitive information . The fix removes this vulnerability CVE-2022-34310 from IBM CICS TX Standard. Vulnerability Details CVEID:CVE-2022-34310 DESCRIPTION: IBM CICS TX uses weaker than expected cryptographic algorithms that...

Security Bulletin: IBM CICS TX Standard is vulnerable to information disclosure due to IBM WebSphere Application Server Liberty (CVE-2022-22393)

Summary WebSphere Application Server Liberty is used by IBM CICS TX Standard to provide a web based administration console. The fix removes the information disclosure vulnerability CVE-2022-22393 from Liberty. Vulnerability Details CVEID:CVE-2022-22393 DESCRIPTION: IBM WebSphere Application Serve...

Security Bulletin: IBM CICS TX Advanced is vulnerable to no confidentiality impact, high integrity impact, and no availability impact (CVE-2021-2163)

Summary IBM CICS TX Advanced could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact. The fix removes this vulnerability CVE-2021-2163 from IBM CICS TX Advanced. Vulnerability Details CVEID:CVE-2021-2163 DESCRIPTION: An...

Security Bulletin: IBM CICS TX Advanced is vulnerable to an attacker decrypting highly sensitive information (CVE-2022-34319).

Summary IBM CICS TX Advanced could allow an attacker to decrypt highly sensitive information. The fix removes this vulnerability CVE-2022-34319 from IBM CICS TX Advanced. Vulnerability Details CVEID:CVE-2022-34319 DESCRIPTION: IBM CICS TX uses weaker than expected cryptographic algorithms that...

Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to information disclosure (CVE-2021-38924)

Summary IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to information disclosure. Vulnerability Details CVEID:CVE-2021-38924 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker to obtain sensitive information whe...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache James MIME4J (CVE-2022-45787)

Summary There is a vulnerability in the Apache James MIME4J library used by IBM WebSphere Application Server Liberty when the feature restfulWS-3.0 is enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-45787 DESCRIPTION: Apache James MIME4J could allow a local authenticated...

Security Bulletin: IBM® Db2® Connect Server is vulnerable due to the use of Apache HttpComponents. (CVE-2014-3577)

Summary IBM® Db2® Connect Server is vulnerable due to the use of Apache HttpComponents. Vulnerability Details CVEID:CVE-2014-3577 DESCRIPTION: Apache HttpComponents could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain...

Security Bulletin: Vulnerability in IBM WebSphere Liberty affects IBM InfoSphere Global Name Management (CVE-2022-34165)

Summary The IBM WebSphere Liberty used in IBM InfoSphere Global Name Management is vulnerable to HTTP header injection when processing web requests. This problem is addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM...

Security Bulletin: Denial of Service vulnerability affects IBM Business Automation Workflow - CVE-2022-25887

Summary IBM Business Automation Workflow is vulnerable to a Denial of Service attack. Vulnerability Details CVEID:CVE-2022-25887 DESCRIPTION: Node.js sanitize-html module is vulnerable to a denial of service, caused by insecure global regular expression replacement logic of HTML comment removal. ...

Security Bulletin: Multiple vulnerabilities in Apache Axis affect IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite

Summary There are multiple vunerabilities in Apache Axis that are used by IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2018-8032 DESCRIPTION: Apache Axis is vulnerable to cross-site scripting, caused by improper...