Security Bulletin: Google Guava component is vulnerable to CVE-2023-2976 is used by IBM Jazz Reporting Services.

Summary IBM Jazz Reporting Service Application Suite uses Google Guava package which is vulnerable to CVE-2023-2976. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp directory creation...

Security Bulletin: Multiple Vulnerabilities in Apache HttpClient, HttpComponents and HttpCommons affect IBM Engineering Lifecycle Optimization - Publishing

Summary There are multiple vulnerabilities in Apache HttpClient, HttpComponents and HttpCommons libraries. This has been addressed. Vulnerability Details CVEID:CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to apply a configured connection...

Security Bulletin: Vulnerability with Python affect IBM Cloud Object Storage Systems (Sept2023v2)

Summary Vulnerability with Python CVE-2023-40217 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details CVEID:CVE-2023-40217 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a race condition in the SSLSocket module...

The vulnerability of the module module.constructor.createRequire() in the Node.js software platform allows a hacker to circumvent established security restrictions.

The vulnerability of the module module.constructor.createRequire in the Node.js software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to circumvent established security restrictions remotely...

Huawei HarmonyOS Security Restriction Bypass Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security restriction bypass vulnerability that originates from an input validation error provided by the AMS module to the...

Huawei HarmonyOS Security Restriction Bypass Vulnerability (CNVD-2023-70289)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security restriction bypass vulnerability that stems from the use of insecure signatures in the ServiceWifiResources module,...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restriction bypass due to [CVE-2023-24329]

Summary Python is used by IBM App Connect Enterprise Certified Container for mapping assistance, and is present in the images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to security restriction bypass. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and security restriction bypass due to [CVE-2023-2283], [CVE-2023-1667]

Summary libssh is found in the IBM App Connect Enterprise Certified Container images as part of the base operating system. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service and security restriction bypass. This bulletin provides patch information to addre...

Security Bulletin: VMware Tanzu Spring Framework is vulnerable to CVE-2023-20860 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring Framework which is vulnerable to CVE-2023-20860. IBM has addressed this vulnerability. Vulnerability Details CVEID:CVE-2023-20860 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass...

Security Bulletin: Vulnerabilities in httpclient library affects IBM Engineering Test Management (ETM) (CVE-2020-13956)

Summary This Security Vulnerablity has been addressed in IBM Engineering Test Management. A fix is available to address the vulnerability. Vulnerability Details CVEID:CVE-2020-13956 DESCRIPTION: Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by the imprope...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot (CVE-2023-20873)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot, caused by a flaw with wildcard pattern matching when deployed on Cloud Foundry CVE-2023-20873. VMware Tanzu Spring Boot is used as part of our Speech...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to several vulnerabilities in Node.js due to [CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807]

Summary Node.js is used by all IBM App Connect Enterprise Certified Container components as a runtime engine. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, security restriction bypassing, cross-site script attack, cache poisoning, session hijacking,...

Google Chrome Security Updates (stable-channel-update-for-desktop_26-2023-06) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Security Bulletin: IBM MQ is affected by vulnerabilities in libcURL (CVE-2023-23916, CVE-2023-27535)

Summary Multiple issues were identified within the libcurl library that affect IBM MQ. IBM MQ uses libcurl to provide HTTPURL functionality which is only used to download remote CCDT files and is not used to send or receive messages. Vulnerability Details CVEID:CVE-2023-23916 DESCRIPTION: cURL...

Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC

Summary There are multiple vulnerabilities in Curl that affect PowerSC. Vulnerability Details CVEID:CVE-2023-27534 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a SFTP path resolving discrepancy flaw. By sending a specially crafted request usin...

Security Bulletin: cURL as used by IBM QRadar WinCollect Agent contains multiple vulnerabilities

Summary cURL as used by IBM QRadar WinCollect Agent contains multiple vulnerabilities. IBM has addressed the relevant vulnerabilities. Vulnerability Details CVEID:CVE-2023-27533 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a TELNET option IAC...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run designer flows containing Box nodes are vulnerable to security restriction bypass due to [CVE-2023-32313]

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in designer flows. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run designer flows containing Box nodes are vulnerable to security...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.7.2 Vulnerability Details CVEID:CVE-2023-20863 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted SpEL...

Security Bulletin: AIX is vulnerable to security restrictions bypass due to curl (CVE-2022-32221)

Summary Vulnerability in cURL libcurl could allow a remote attacker to bypass security restriction CVE-2022-32221. AIX uses cURL libcurl as part of LV/PV encryption integration with HPCS. Vulnerability Details CVEID:CVE-2022-32221 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass...

Security Bulletin: IBM Operational Decision Manager April 2023 - Multiple CVEs

Summary This Security Bulletin addresses the security vulnerabilities that have been fixed within the IBM Operational Decision Manager. This product now includes fixes for the following security vulnerabilities. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote...