Security Bulletin: Potential denial of service vulnerability in WebSphere Application Server Liberty Core affect CICS Transaction Gateway

Summary Out of Memory Exception can cause denial of service in WebSphere Application Server Liberty Core used by CICS Transaction Gateway affects Web Service requests. CICS Transaction Gateway addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-4046 DESCRIPTION: IBM WebSphere...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2021 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These might affect some configurations of IBM WebSphere Application Server Traditional, IBM WebSphere Application Server Liberty and IBM WebSphere Applicatio...

Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2021-35517, CVE-2021-36090)

Summary There are multiple vulnerabilities in the Apache Commons Compress library that is used by WebSphere Application Server Liberty. This has been addressed. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out ...

Security Bulletin: IBM WebSphere Liberty XML External Entity (XXE) Injection security vulnerability in IBM FileNet Content Manager

Summary IBM FileNet Content Manager Content Platform Engine CPE containers are vulnerable to IBM WebSphere Liberty XML External Entity XXE Injection security vulnerabilities. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server Java Batch is vulnerable to an X...

Security Bulletin: Multiple security vulnerabilities may affect WebSphere Application Server Liberty shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary IBM WebSphere Application Server Liberty is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Information about some security vulnerabilities affecting WebSphere Application Server Liberty has been published in below security bulletin...

Security Bulletin: Vulnerabilities in WebSphere Liberty Profile affect IBM InfoSphere Identity Insight (CVE-2020-4421, CVE-2020-4590, CVE-2020-5258, CVE-2021-26296)

Summary There are multiple vulnerabilities in the WebSphere Liberty Profile used in IBM InfoSphere Identity Insight. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM InfoSphere...

Security Bulletin: Vulnerabilities in Websphere Liberty Profile (WLP) affect Power Management Console (CVE-2015-2017, CVE-2015-1927, CVE-2015-4938)

Summary Websphere liberty Profile is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-4938 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof a servlet. An attacker could exploit this...

CVE-2021-29842

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202...

CVE-2021-29842

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202...

CVE-2021-29842

CVE-2021-29842 affects IBM WebSphere Application Server (traditional and Liberty): WAS 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3–21.0.0.9 allow remote username enumeration due to differing responses for valid vs. invalid login attempts. Remediation per IBM bullets is to upgrade to Liberty 21.0.0_10...

CVE-2021-29842

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202...

Security Bulletin: Multiple Vulnerabilities in Apache Commons Compress affect WebSphere Application Server Liberty (CVE-2021-33517, CVE-2021-36090)

Summary There are multiple vulnerabilities in the Apache Commons Compress library that is used by WebSphere Application Server Liberty. This has been addressed. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out ...

Security Bulletin: WebSphere Application Server is vulnerable to Information Disclosure (CVE-2021-29842)

Summary WebSphere Application Server configured with a federated repository is vulnerable to information disclosure. This has been addressed. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server could allow a remote user to enumerate usernames due to a...

Security Bulletin: Information disclosure vulnerability in WebSphere Application Server Liberty

Summary This security bulletin addresses the Information Disclosure vulnerability that has been found to impact Websphere Liberty in IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request...

Security Bulletin: A vulnerability in WebSphere Application Server Liberty affects TXSeries for Multiplatforms

Summary TXSeries for Multiplatforms has addressed the following vulnerability reported by WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input...

Security Bulletin: Multiple Vulnerabilities in IBM® WebSphere Application Server Liberty affect IBM LKS Administration and Reporting Tool and its Agent

Summary There are multiple vulnerabilities in the IBM® WebSphere Application Server Liberty used by IBM LKS Administration and Reporting Tool and its Agent. A fix has been identified and is being published here. Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable...

Security Bulletin: Novalink is impacted by XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit affects WebSphere Liberty middle vulnerability in WebSphere Application Server Liberty (CVE-2021-20492)

Summary Novalink uses WebSphere Application Server Liberty. There is effect on IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

Security Bulletin: Novalink is impacted by Apache MyFaces affects WebSphere Liberty, middle vulnerability in WebSphere Application Server Liberty (CVE-2021-26296)

Summary Novalink uses WebSphere Application Server Liberty. There is a Apache MyFaces affects WebSphere Liberty , middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is...

Security Bulletin: Dojo vulnerability in WebSphere Liberty affects Collaboration and Deployment Services (CVE-2020-5258)

Summary There is a Dojo vulnerability in WebSphere Liberty used by Collaboration and Deployment Services. This issue has been addressed. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-4590)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability is due to the WebSphere Application Server Liberty which is vulnerable to a denial of service attack. Vulnerability Details CVEID: CVE-2020-4590...