CVE-2021-39019

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. Guava, Red Hat Single Sign-On, Springfox and Spring Security could allow a remote attacker to bypass security restrictions...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2021-39038, CVE-2021-23450) may impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary IBM Engineering Lifecycle Management ELM products based on IBM Jazz technology may integrate with IBM WebSphere Application Server Liberty WAS Liberty. Please review the following WAS Liberty Bulletins covering CVE-2021-39038, CVE-2021-23450 and take corrective actions. Vulnerability...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to Clickjacking when X-Frame-Options, Content-Security-Policy headers are not included in the HTTP response.(CVE-2021-29865)

Summary Summary guidance: - The Jazz Team Server is vulnerable to Clickjacking. Vulnerability Details CVEID: CVE-2021-29865 DESCRIPTION: IBM Jazz Foundation could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to execute scripts to access the cookie JSA_CSRF when set without the HttpOnly flag.(CVE-2021-38879)

Summary Summary guidance: - The Jazz Team Server is vulnerable to execute scripts to access the cookie and transmitted it to another site when JSACSRF cookie is set without the HttpOnly flag. Vulnerability Details CVEID:CVE-2021-38879 DESCRIPTION: IBM Jazz Foundation could allow a remote attacker...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable(Server-Side Request Forgery vulnerability) when requesting resource over an API endpoint to verify URls from target application server.(CVE-2021-20421)

Summary Summary guidance: - There is Server-Side Request Forgery vulnerability when requesting resource over an API endpoint to verify URLs from target application server. Vulnerability Details CVEID:CVE-2021-20421 DESCRIPTION: IBM Jazz Foundation is vulnerable to server-side request forgery SSRF...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to induce the application to perform server-side HTTP and HTTPS requests to arbitrary domains.(CVE-2021-20544)

Summary Summary guidance: External service interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server. The ability to trigger arbitrary external service interactions does not constitute a vulnerability in its own...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to cross-site scripting when receive data in HTTP request in unsafe way.(CVE-2021-38871)

Summary Summary guidance: - The Jazz Team Server is vulnerable to cross-site scripting when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way, in this case, the parameter cryptojs is vulnerable to this type of attack. Vulnerabili...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to Cross-site Scripting (XSS). (CVE-2021-39059)

Summary Summary guidance: - The Jazz Team Server is vulnerable to cross-site scripting. Vulnerability Details CVEID:CVE-2021-39059 DESCRIPTION: IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to execute local scripts to access the cookie(s) when set without the HttpOnly flag.(CVE-2021-20355)

Summary Summary guidance: - The Jazz Team Server is vulnerable to execute local scripts to access the cookies and transmitted it to another site when cookies is set without the HttpOnly flag. Vulnerability Details CVEID:CVE-2021-20355 DESCRIPTION: IBM Jazz Foundation could allow a remote attacker...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to HTML injection.(CVE-2021-20543)

Summary Summary guidance: The Jazz Team Server allows administrators to install custom process templates. These custom templates can optionally have custom HTML or JavaScript code in them. This is a feature that many customers use, but it is not without risk. We strongly encourage administrators ...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to some browser which may store a local cached copy of content received from web servers.(CVE-2021-20551)

Summary Summary guidance: Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this...

Fedora: Security Advisory for containerd (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability of the WWebView component of MCE Systems’ mobile device lifecycle management system allows attackers to enhance their privileges.

The vulnerability of MCE Systems’ WWebView component in mobile device lifecycle management systems is related to errors in handling links before accessing a file. Exploiting this vulnerability can allow attackers to enhance their privileges by introducing malicious code...

PT-2022-4930

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform LCM versions 420, 430 Description The issue allows an attacker with admin privileges to read and decrypt the LCMBIAR file's password under certain conditions. This enables the attacker to modi...

The vulnerability of the WWebView component of MCE Systems’ mobile device lifecycle management system allows a hacker to execute arbitrary commands.

The vulnerability of MCE Systems’ WWebView component in mobile device lifecycle management systems lies in the lack of measures taken to neutralize special elements used by the operating system when processing the value parameter. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the Lifecycle Management component of the Hyperion Infrastructure Technology management solution allows a perpetrator to gain read access to data and modify it.

The vulnerability of the Lifecycle Management component of the Hyperion Infrastructure Technology exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to read, modify, add, or delete data using the HTT...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2022-21496 and CVE-2022-21299)

Summary WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2022-21496 and CVE-2022-21299)

Summary WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2022-22365)

Summary WebSphere Application Server is shipped as a component of IBM Security Guardium Key Lifecycle Manager SKLM/GKLM. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulleti...