CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

PT-2021-5193 · Apache · Apache Storm

Name of the Vulnerable Software and Affected Versions: Apache Storm versions 1.x prior to 1.2.4 Apache Storm versions 2.x prior to 2.2.1 Description: The issue is related to a Command Injection vulnerability in the getTopologyHistory service of Apache Storm. This vulnerability can be exploited by...

TIBCO Security Advisory: October 26, 2021 - TIBCO Nimbus -2021-35499

TIBCO Nimbus Stored Cross-site Scripting XSS vulnerabilities Original release date: October 26, 2021 Last revised: CVE-2021-35499 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus versions 10.4.0 and below The following component is affected: Web Reporting Description The component listed...

TIBCO Security Advisory: October 26, 2021 - TIBCO Nimbus -2021-35499

TIBCO Nimbus Stored Cross-site Scripting XSS vulnerabilities Original release date: October 26, 2021 Last revised: CVE-2021-35499 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus versions 10.4.0 and below The following component is affected: Web Reporting Description The component listed...

com.antheminc.oss:nimbus-core (>=1.1.7 <=1.2.0.M5), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7 <=1.2.0.M5) +110 more potentially affected by CVE-2021-35043 via org.owasp.antisamy:antisamy (>=1.5.7 <=1.6.3)

org.owasp.antisamy:antisamy MAVEN version =1.5.7, =1.1.7, =1.1.7, =1.1.7, =1.1.7, =1.1.7, =1.2.1, =1.2.1, =1.2.1, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =1.5.14, =1.5.14, =1.5.14, =1.5.26 and more Source cves: CVE-2021-35043 Source advisory: OSV:GHSA-9C8W-JRW3-Q2C3...

Security Bulletin: Multiple vulnerabilites affect IBM Jazz Foundation and IBM Engineering products.

Summary There are multiple vulnerabilities that are used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Requirements Management DOORS Next DOORS Next, IBM Engineering Workflow Management EWM, IBM...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2015-5237 DESCRIPTION: Google Protocol Buffers could allow a remote attacker to execute arbitrary code on the system, caused by ...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2018-1288 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to bypass security restrictions. By using a manually created fetch request interfering with data replication, an attacker cou...

Security Bulletin: vulnerabilities in Nimbus JOSE+JWT affect IBM Watson Machine Learning Accelerator 1.2.1

Summary Vulnerabilities existing in the Nimbus JOSE+JWT version used by IBM Watson Machine Learning Accelerator 1.2.1. An interim fix that provides instructions on upgrading the Nimbus JOSE+JWT package to version 7.9 which resolves these vulnerabilities, are available on IBM Fix Central...

Important: Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor

Summary There are three vulnerabilities in Nimbus JOSE+JWT 3.1.2 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3.0. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3 have addressed the applicable CVEs...

The vulnerability of the Nimbus JOSE + JWT Java library lies in insufficient checks for unusual or exceptional states, allowing attackers to trigger service failures or gain unauthorized access to protected information.

The vulnerability of the Nimbus JOSE + JWT Java library is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures or gain unauthorized access to protected information...

Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product

Summary DB2 contains several vulnerabilities which can affect the IBM Performance Management product. Some of the information about security vulnerabilities affecting DB2 has been published in security bulletins. Vulnerability Details CVEID: CVE-2017-12973 DESCRIPTION: Connect2id Nimbus JOSE+JWT...

Security Bulletin: Multiple vulnerabilities in Nimbus-JOSE-JWT affect IBM Spectrum Symphony

Summary Multiple vulnerabilities exist in the Nimbus-JOSE-JWT used by IBM Spectrum Symphony V7.3 and V7.2.1. Interim fixes that provide instructions on upgrading the nimbus-jose-jwt package to version 8.10 are available on IBM Fix Central. Vulnerability Details CVEID: CVE-2017-12974 DESCRIPTION:...

Oracle Primavera Gateway (Apr 2020 CPU)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerabilities as referenced in the April 2020 CPU advisory: - In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing...

CVE-2020-8010 Nimbus protocol allows unauth read/write/execute

CA Unified Infrastructure Management Nimsoft/UIM 9.20 and below contains an improper ACL handling vulnerability in the robot controller component. A remote attacker can execute commands, read from, or write to the target system. Recent assessments: busterb at August 04, 2020 5:44pm UTC reported:...

The vulnerability of the Bitdefender BOX 2 device, related to errors in processing URL addresses via the API /api/download_image, allows a perpetrator to execute arbitrary commands on the target system.

The vulnerability of the Bitdefender BOX 2 device for protecting devices and gadgets is related to errors in processing URL addresses using the API /api/downloadimage. Exploiting this vulnerability allows a hacker to execute arbitrary commands on the target system by sending the malicious file...

CVE-2019-17195

A flaw was found in Connect2id Nimbus JOSE+JWT prior to version 7.9. While processing JSON web tokens JWT, nimbus-jose-jwt can throw various uncaught exceptions resulting in an application crash, information disclosure, or authentication bypass. The highest threat from this vulnerability is to da...

Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash potential information disclosure or a potential authentication bypass...

CVE-2019-17195

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash potential information disclosure or a potential authentication bypass...