Security Bulletin: Potential spoofing attack in WebSphere Application Server may affect IBM InfoSphere Global Name Management (CVE-2018-1695)

Summary There is a potential spoofing attack in WebSphere Application Server shipped as part of IBM InfoSphere Global Name Management. This also affects IBM InfoSphere Global Name Management Enterprise Name Search installations. Vulnerability Details CVEs: CVE-2018-1695 Link to security bulletin:...

Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in the included Expat 3rd party library (CVE-2022-23852 and CVE-2022-23990)

Summary IBM® Db2® is affected by multiple vulnerabilities in the included Expat 3rd party library. This fix provides an upgrade to the Expat library. Vulnerability Details CVEID: CVE-2022-23852 DESCRIPTION: Expat aka libexpat could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Insecure Permissions (CVE-2019-4446)

Summary IBM Maximo Asset Management is vulnerable to Insecure Permissions. Vulnerability Details CVEID: CVE-2019-4446 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user perform actions they are not authorized to by modifying request parameters. CVSS Base score: 5.4 CVSS...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Security/Authentication Bypass (CVE-2019-4591)

Summary IBM Maximo Asset Management is vulnerable to Security/Authentication Bypass. Vulnerability Details CVEID: CVE-2019-4591 DESCRIPTION: IBM Maximo Asset Management does not invalidate session after logout which could allow a local user to impersonate another user on the system. CVSS Base...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Java Deserialization (CVE-2020-4521)

Summary IBM Maximo Asset Management is vulnerable to Java Deserialization. Vulnerability Details CVEID:CVE-2020-4521 DESCRIPTION: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sendin...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Information Disclosure (CVE-2019-4478)

Summary IBM Maximo Asset Management is vulnerable to Information Disclosure. Vulnerability Details CVEID: CVE-2019-4478 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to obtain highly sensitive information that they should not normally have access to. CVSS Base score:...

Security Bulletin: IBM Maximo Asset Management is vulnerable to reverse tabnabbing (CVE-2020-4409)

Summary IBM Maximo Asset Management is vulnerable to reverse tabnabbing. Vulnerability Details CVEID: CVE-2020-4409 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted We...

Security Bulletin: Multiple Vulnerabilities in Jackson Core affect IBM Maximo Asset Management

Summary Multiple Vulnerabilities in Jackson Core affect IBM Maximo Asset Management Vulnerability Details CVEID: CVE-2016-7051 DESCRIPTION: jackson-dataformat-xml is vulnerable to server-side request forgery, caused by a flaw in the XmlMapper. By using vectors related to a DTD, an attacker could...

Security Bulletin: IBM WebSphere Application Server, which is bundled as part of IBM Cloud Pak for Applications, is vulnerable to remote code execution due to Dojo (CVE-2021-23450)

Summary IBM WebSphere Application Server is vulnerable to remote code execution due to Dojo CVE-2021-23450 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and Versions | Affecting Products and Versions...

Security Bulletin: Cross-site scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38893

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a cross-site scripting attack. Vulnerability Details CVEID: CVE-2021-38966 DESCRIPTION: IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: Due to use of Apache Log4j, IBM Cloud PAK for Watson AI Ops is vulnerable to arbitrary code execution (CVE-2021-45046) and denial of service (CVE-2021-45105)

Summary Apache Log4j is used by IBM Cloud PAK for Watson AI Ops as part of its logging infrastructure. The CVE numbers are: CVE-2021-45105 and CVE-2021-45046. Vulnerabilities were identified within the Apache Log4j library that is used by IBM Cloud Pak for Watson AIOps. These vulnerabilities have...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Watson AIOps (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Cloud Pak for Watson AIOps. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to spoofing attacks and clickjacking due to swagger-ui (CVE-2018-25031, CVE-2021-46708)

Summary There are multiple vulnerabilities in the swagger-ui library used by IBM WebSphere Application Server Liberty with mpOpenAPI-1.0, mpOpenAPI-1.1, mpOpenAPI-2.0, mpOpenAPI-3.0, openapi-3.0 or the openapi-3.1 feature enabled. These vulnerabilities could allow spoofing attacks or clickjacking...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to remote code execution due to Dojo (CVE-2021-23450)

Summary There is a vulnerability in the Dojo library used by IBM WebSphere Application Server traditional in the Admin Console and used by the IBM WebSphere Application Server Liberty with the adminCenter-1.0 feature enabled that allows arbitrary code to be executed in the browser. This has been...

Security Bulletin: CVE-2021-44228 log4j affects MAS Monitor 8.4, 8.5 and 8.6

Summary A new vulnerability with log4j has been detected. MAS Monitor uses log4j in all releases and interim fixes are now available for our 8.4, 8.5 and 8.6 releases. More details of the vulnerability are available here: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Vulnerability Details CVEID...

Security Bulletin: IBM Maximo Asset Management is vulnerable to weak password requirements (CVE-2021-38935)

Summary IBM Maximo Asset Management does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2021-38935 DESCRIPTION: IBM Maximo Asset Management does not require that users should have...

Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0732)

Summary There is a vulnerability in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during key agreement in a TLS handshake. By spending...

Security Bulletin: Information disclosure vulnerability affects IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-CVE-2021-39046

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to an information disclosure attack. Vulnerability Details CVEID: CVE-2021-39046 DESCRIPTION: IBM Business Automation Workflow stores user credentials in plain clear text which can be read by a lprivileged...

Security Bulletin: WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability and affects Content Collector for Email

Summary WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability Vulnerability Details CVEID: CVE-2021-38951 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote...

Security Bulletin: Cross-Site Scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38893

Summary Process Admin Console in IBM Business Process Manager and IBM Business Automation Workflow is vulnerable to a Cross-Site Scripting attack. Vulnerability Details CVEID: CVE-2021-38893 DESCRIPTION: IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20....