Security Bulletin: IBM Storage Ceph is vulnerable to Race Condition in the RHEL UBI (CVE-2023-3758)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-3758 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-3758 DESCRIPTION: A race condition flaw was found in sssd where the GPO policy is...

Security Bulletin: IBM Storage Ceph is vulnerable to Channel Accessible by Non-Endpoint in the RHEL UBI (CVE-2023-7008)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-7008 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-7008 DESCRIPTION: systemd is vulnerable to a man-in-the-middle attack, caused by a...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Jinja2 (CVE-2024-22195)

Summary Jinja2 is used by IBM Storage Ceph and by the RHEL UBI in multiple components. CVE-2024-22195 This bulletin identifies the steps to take to address the vulnerability in Jinja2. Affected components include nvme, grafana, keepalived, haproxy, promtail. snmp, ansible, fence-agents, rust...

Security Bulletin: IBM Storage Ceph is vulnerable to Use of a Broken or Risky Cryptographic Algorithm in the RHEL UBI (CVE-2024-28834)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2024-28834 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2024-28834 DESCRIPTION: GnuTLS could allow a remote authenticated attacker to obtain...

Security Bulletin: IBM Storage Ceph is vulnerable to Injection in the RHEL UBI (CVE-2023-6004)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-6004 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-6004 DESCRIPTION: libssh could allow a local authenticated attacker to execute...

Security Bulletin: IBM Storage Ceph is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in the RHEL UBI (CVE-2022-4415)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2022-4415 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2022-4415 DESCRIPTION: systemd could allow a local authenticated attacker to obtain...

Security Bulletin: IBM Storage Ceph is vulnerable to Unchecked Return Value in the RHEL UBI (CVE-2023-6918)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-6918 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-6918 DESCRIPTION: A flaw was found in the libssh implements abstract layer for...

Security Bulletin: IBM Storage Ceph is vulnerable to improper handling of JavaScript whitespace in golang in the RHEL UBI (CVE-2023-24540)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-24540 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Not all valid JavaScript whitespace characters are considered ...

Security Bulletin: Vulnerability found in Personal Communications through deployment of arbitrary MSI package.

Summary There is a vulnerability in found in Personal Communications through deployment of arbitrary MSI package. Personal Communications has addressed the applicable CVE-2025-1095. Vulnerability Details CVEID:CVE-2025-1095 DESCRIPTION: IBM Personal Communications includes a Windows service that ...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses express-4.19.2.tgz which is vulnerable to CVE-2024-43796

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses express-4.19.2.tgz which is vulnerable to CVE-2024-43796. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-43796 DESCRIPTION: Express.js minimalist w...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses braces-3.0.2.tgz which is vulnerable to CVE-2024-4068

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses braces-3.0.2.tgz which is vulnerable to CVE-2024-4068. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-4068 DESCRIPTION: The NPM package braces,...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses vite-5.4.12.tgz which is vulnerable to CVE-2025-30208

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses vite-5.4.12.tgz which is vulnerable to CVE-2025-30208. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-30208 DESCRIPTION: Vite, a provider of fronte...

Security Bulletin: Zipp Path Module Denial of Service via Malformed ZIP File

Summary zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path module. By using a specially crafted zip file, a local attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to protobuf-java (CVE-2024-7254)

Summary protobuf-java is vulnerable to a StackOverflow attack. This vulnerability affects IBM Spectrum Control. CVE-2024-7254. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to path-to-regexp (CVE-2024-52798)

Summary path-to-regexp is vulnerable to a backtracking attack. This vulnerability affects IBM Spectrum Control. CVE-2024-52798. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a...

Security Bulletin: Vulnerability in pip package affects IBM Db2 Data Management Console(CVE-2019-20916)

Summary pip dependency package is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2019-20916 DESCRIPTION: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by arbitrary code execution

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by arbitrary code execution CVE-2025-36038 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper enforcement of resource limits in the nftables rules generation process for managed bridge networks. An attacker can exhaust the DHCP pool and disrupt network...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the Command Execution process. An attacker can execute arbitrary commands with the privileges of the server process by leveraging allowed shell commands that can spawn additional commands. This is only...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to SQL injection (CVE-2025-0966)

Summary A SQL injection vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-0966 DESCRIPTION: IBM InfoSphere Information Server vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the...