Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities in Expact library.

Summary IBM QRadar Network Security has addressed following vulnerabilities Expact library. CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827, CVE-2022-23852, CVE-2022-25235, CVE-2022-25236, CVE-2022-25315 Vulnerability...

The vulnerability of the IBM QRadar Network Security intrusion prevention system, related to insufficient protection of operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the IBM QRadar Network Security intrusion prevention system is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

[SECURITY] Fedora 35 Update: golang-github-path-network-mmproxy-2.1-3.fc35

go-mmproxy is a standalone application that unwraps HAProxy's PROXY protocol also adopted by other projects such as NGINX so that the network connection to the end server comes from client's - instead of proxy server's - IP address and port number...

SAP S/4HANA Licensing Issue Vulnerability

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP Germany. SAP S/4HANA is vulnerable to an authorization issue that stems from the application business partner extension component not performing the required authorization checks for...

EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2022-2053)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for...

EulerOS Virtualization 2.10.0 : gzip (EulerOS-SA-2022-2089)

According to the versions of the gzip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - gzip: arbitrary-file-write vulnerability CVE-2022-1271 Note that Tenable Network Security has extracted the preceding description...

EulerOS Virtualization 2.10.0 : polkit (EulerOS-SA-2022-2033)

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed...

EulerOS Virtualization 2.10.1 : python-pillow (EulerOS-SA-2022-2065)

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - pathgetbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. CVE-2022-22815 - pathgetbbox in path.c ...

EulerOS Virtualization 2.10.1 : freetype (EulerOS-SA-2022-2108)

According to the versions of the freetype package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function...

EulerOS Virtualization 2.10.1 : openssl (EulerOS-SA-2022-2060)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of...

EulerOS Virtualization 2.10.0 : openssl (EulerOS-SA-2022-2032)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of...

CVE-2022-31592

The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on...

Authentication flaw

Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible...

CVE-2022-35228

SAP BusinessObjects Central Management Console (CMC) is affected by CVE-2022-35228. The issue allows an unauthenticated attacker to retrieve token information over the network under conditions where a legitimate user accesses the application and a local compromise (e.g., sniffing or social engine...

CVE-2020-4159

IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the system. IBM X-Force ID: 174339...

CVE-2020-4157

IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174337...

CVE-2020-4159

IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the system. IBM X-Force ID: 174339...

Hardcoded credentials

IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174337...

Design/Logic Flaw

IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the system. IBM X-Force ID: 174339...

CVE-2020-4159

IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the system. IBM X-Force ID: 174339...