Security Bulletin: IBM PowerVM Novalink is vulnerable to allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system due to Apache Log4j (CVE-2021-44832)

Summary IBM PowerVM Novalink, which consumes Apache Log4j, is subject to CVE-2021-44832, which allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appender with a data sour...

Security Bulletin: Novalink is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Novalink, which consumes Apache Log4j, is subject to CVE-2021-45105, which could cause a denial of service, and CVE-2021-45046, which could cause the leak of sensitive information and remote code execution in some environments and local code execution in all environments. IBM strongly...

Security Bulletin: Due to Apache Log4j vulnerability, Novalink could allow a remote attacker to execute arbitrary code on the system. (CVE-2021-44228)

Summary Novalink uses Apache Log4j 2 for logging system/application events for diagnostics. This bulletin provides a remediation for the vulnerability CVE-2021-44228 by updating PowerVM Novalink. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker t...

Security Bulletin: Novalink is impacted by Vulnerabilities in Apache Commons Compress affect WebSphere Application Server (CVE-2021-35517, CVE-2021-36090)

Summary Novalink uses WebSphere Application Server Liberty. There is an Apache Commons Compress affect vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error wh...

Security Bulletin: Novalink Vulnerability to allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. (CVE-2021-29842)

Summary Novalink uses WebSphere Application Server Liberty. Which could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 a...

Security Bulletin: Novalink is impacted by XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit affects WebSphere Liberty middle vulnerability in WebSphere Application Server Liberty (CVE-2021-20492)

Summary Novalink uses WebSphere Application Server Liberty. There is effect on IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

Security Bulletin: Novalink is impacted by Apache MyFaces affects WebSphere Liberty, middle vulnerability in WebSphere Application Server Liberty (CVE-2021-26296)

Summary Novalink uses WebSphere Application Server Liberty. There is a Apache MyFaces affects WebSphere Liberty , middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is...

Security Bulletin: Novalink is impacted by Vulnerability in Hibernate Validator affects WebSphere Application Server Liberty (CVE-2020-10693)

Summary Novalink uses WebSphere Application Server Liberty. There is a Vulnerability in Hibernate Validator affects WebSphere Application Server Liberty Vulnerability Details CVEID: CVE-2020-10693 DESCRIPTION: Hibernate Hibernate Validator could allow a remote attacker to bypass security...

Security Bulletin: Novalink is impacted running oauth-2.0 or openidConnectServer-1.0 server features vulnerability in WebSphere Application Server Liberty (CVE-2020-4590)

Summary Novalink uses WebSphere Application Server Liberty. There is a running oauth-2.0 or openidConnectServer-1.0 server features vulnerability in WebSphere Application Server Liberty CVE-2020-4590 Vulnerability Details CVEID: CVE-2020-4590 DESCRIPTION: IBM WebSphere Application Server Liberty...

Security Bulletin: Novalink is impacted by denial of service high vulnerability in WebSphere Application Server Liberty CVE-2019-4720

Summary Novalink uses WebSphere Application Server Liberty. There is a denial of service in high vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, an...

Security Bulletin: Novalink is impacted by Apache CXF affects WebSphere Liberty JAX-WS middle vulnerability in WebSphere Application Server Liberty (CVE-2019-17573)

Summary Novalink uses WebSphere Application Server Liberty. There is a Apache CXF affects WebSphere Liberty JAX-WS middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-17573 DESCRIPTION: Apache CXF is vulnerable...

Security Bulletin: Novalink is impacted Apache CXF affects middle vulnerability in WebSphere Application Server Liberty (CVE-2019-12406)

Summary Novalink uses WebSphere Application Server Liberty. There is Apache CXF affects middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service,...

Security Bulletin: Novalink is impacted by Publicly disclosed vulnerability in IBM Java SDK/JRE (CVE-2019-4732)

Summary Novalink uses IBM Java SDK/JRE . There is a Publicly disclosed vulnerability in IBM Java SDK/JRE. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, an...

Security Bulletin: Novalink is impacted by Swagger vulnerability affects WebSphere Application Server Liberty

Summary Novalink uses WebSphere Application Server Liberty. There is a Swagger vulnerability that affects WebSphere Application Server Liberty. This affects the mpOpen-1.x and openAPI-3.x features. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION:...

Security Bulletin: Novalink is impacted by Man in the middle vulnerability in WebSphere Application Server Liberty (CVE-2014-3603)

Summary Novalink uses WebSphere Application Server Liberty. There is a man in the middle vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: Shibboleth Identity Provider IdP and OpenSAML Java could...

Security Bulletin: Novalink is impacted by WebSphere Application Server Liberty is vulnerable to Cross-site Scripting (CVE-2019-4663)

Summary Novalink uses WebSphere Application Server Liberty. There is a cross-site scripting vulnerability in the Admin Center. This has been addressed. Vulnerability Details CVEID: CVE-2019-4663 DESCRIPTION: IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This...

Security Bulletin: Novalink is impacted by Denial of service vulnerability in WebSphere Application Server Liberty

Summary Novalink uses WebSphere Application Server Liberty. There is a denial of service vulnerability in WebSphere Application Server Liberty. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of...

Security Bulletin: Novalink is impacted by Multiple vulnerabilities in WebSphere Application Server Liberty

Summary Novalink uses WebSphere Application Server Liberty. There is an information disclosure and a bypass security vulnerability in WebSphere Application Server Liberty. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: WebSphere Liberty susceptible to HTTP2 implementation vulnerabilities

Summary WebSphere Liberty susceptible to HTTP2 implementation vulnerabilities Vulnerability Details CVEID: CVE-2019-9515 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a Settings Flood attack. By sending a stream of SETTINGS frames to the peer, a remote attacker...