Security Bulletin: A security vulnerability inPostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management

Summary A security vulnerability inPostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management Vulnerability Details CVEID:CVE-2021-23222 DESCRIPTION: PostgreSQL is vulnerable to a man-in-the-middle attack, caused by improper validation of user-supplied input by libpq. A...

Security Bulletin: A security vulnerability in Node.js jsonpointer affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js jsonpointer affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2021-23807 DESCRIPTION: Node.js jsonpointer module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype...

Security Bulletin: A security vulnerability in Nodejs yup affects IBM Cloud Pak for Multicloud Management Infrastructure Management [ID: 221916]

Summary A security vulnerability in Nodejs yup affects IBM Cloud Pak for Multicloud Management Infrastructure Management ID: 221916 Vulnerability Details IBM X-Force ID: 221916 DESCRIPTION: Node.js yup module, could allow a remote attacker to execute arbitrary code on the system, caused by a...

PT-2022-6310 · Ibm · Ibm Cloud Pak For Multicloud Management Monitoring

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management Monitoring versions 2.0 through 2.3 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to elevate...

Security Bulletin: A security vulnerability in Nodejs follow-redirects affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs follow-redirects affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-0536 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused b...

Security Bulletin: A security vulnerability in GO crypto affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in GO crypto affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2021-43565 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an input validation flaw in golang.org/x/crypto's readCipherPacket...

Security Bulletin: A security vulnerability in Nodejs unset-value affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs unset-value affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 220063 DESCRIPTION: Node.js unset-value module is vulnerable to a denial of service, caused by a prototype pollution flaw in the unset...

Security Bulletin: A security vulnerability in Nodejs uglify-js affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs uglify-js affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 218243 DESCRIPTION: The Node.js uglify-js module is vulnerable to a denial of service, caused by an error in the stringtemplate and the...

Security Bulletin: A security vulnerability in Nodejs node-fetch affects IBM Cloud Pak for Multicloud Management Managed Services

Summary Security Bulletin: A security vulnerability in Nodejs node-fetch affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-0235 DESCRIPTION: Node.js node-fetch could allow a remote authenticated attacker to obtain sensitive information, caused b...

Security Bulletin: A security vulnerability in Nodejs marked affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs marked affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-21681 DESCRIPTION: Node.js marked module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in...

Security Bulletin: A security vulnerability in react-scripts affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in react-scripts affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 217312 DESCRIPTION: Node.js istanbul-reports module could allow a remote attacker to obtain sensitive information, caused by a reverse tabnabbin...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-24772 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to information disclosure due to its use of Apache Hadoop (CVE-2017-15713)

Summary Vulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history serv...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to information leakage due to its use of Java (CVE-2022-35550)

Summary Java is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to interact with the operating system and for functional utilities. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to a denial server due to its use of Google's Gson

Summary GSON is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to serialize/deserialize data. Vulnerability Details IBM X-Force ID: 217225 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to a DoS attack due to its use of Apache Parquet (CVE-2021-41561)

Summary Apache Parquet is used by its spark component in IBM Cloud Pak for Multicloud Management Monitoring in support of the predictive insights function. This vulnerability is limited to a malicous insider with access to the spark component. Vulnerability Details CVEID:CVE-2021-41561 DESCRIPTIO...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is potentially vulnerable to execution of arbitrary code due to its use of Apache Log4j (CVE-2022-23305)

Summary Apache Log4j is used by IBM Cloud Pak for Multicloud Management Monitoring as part of its logging infrastructure. Apache Log4j v1.2 has been removed and replaced by Log4j v2.17.1. Components that use Apache Log4j v1.2 are not exposed outside the cluster and are not configured to use the...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has multiple vulnerabilities associated with the Go runtime (CVE-2021-29923, CVE-2021-31525, CVE-2021-33194, CVE-2021-33195, CVE-2021-33196, CVE-2021-33197, CVE-2021-33198)

Summary The Go runtime is used by several components in IBM Cloud Pak for Multicloud Management Monitoring to interact with the operating system and provide utility functions. Vulnerability Details CVEID:CVE-2021-34558 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by the...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is potentially vulnerable to execution of arbitrary code due to its use of Apache Log4j (CVE-2022-23302)

Summary Apache Log4j is used by IBM Cloud Pak for Multicloud Management Monitoring as part of its logging infrastructure. Apache Log4j v1.2 has been removed and replaced by Log4j v2.17.1. Components that use Apache Log4j v1.2 are not exposed outside the cluster and are not configured to use the...