Security Bulletin: Mulitple Apache Log4j vulnerabilities impact IBM Tivoli System Automation Application Manager (CVE-2021-45105, CVE-2021-45046)

Summary There are multiple vulnerabilities identified within the Apache Log4j library used by a component of IBM Tivoli System Automation Application Manager. The fix includes Apache Log4j 2.17.0. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of...

CVE-2021-43948

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0...

CVE-2021-43943

Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The...

Exploit for Cross-Site Request Forgery (CSRF) in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46080 Exploit Title: Vehicle Service Management...

Exploit for Unrestricted Upload of File with Dangerous Type in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46078 Exploit Title: Vehicle Service Management...

Exploit for Unrestricted Upload of File with Dangerous Type in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46076 Exploit Title: Vehicle Service Management...

Exploit for Missing Authorization in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46075 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46074 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46073 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46072 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46071 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46070 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46069 Exploit Title: Vehicle Service Management...

Exploit for Cross-site Scripting in Vehicle_Service_Management_System_Project Vehicle_Service_Management_System

CVE-2021-46068 Exploit Title: Vehicle Service Management...

Security Bulletin: Tivoli Netcool/OMNIbus WebGUI is vulnerable to Apache log4j vulnerability (CVE-2021-44228)

Summary Tivoli Netcool/OMNIbus WebGUI may be impacted by the vulnerability Apache Log4j CVE-2021-44228 through the use of Log4j-api. Also, Tivoli Netcool/OMNIbus WebGUI uses IBM Jazz for Service Management and Websphere Application Server WAS component/product which are affected. Vulnerability...

Security Bulletin: Tivoli Netcool/OMNIbus WebGUI has multiple vulnerabilities in Apache log4j (CVE-2021-4104, CVE-2021-45046)

Summary Some version of Tivoli Netcool/OMNIbus WebGUI uses Apache log4j-api library which has multiple vulnerabilities to CVE-2021-4104 and CVE-2021-45046, recommendation is to remove it if exists. Also, Tivoli Netcool/OMNIbus WebGUI uses IBM Jazz for Service Management and Websphere Application...

Security Bulletin: Vulnerability in Apache Log4j affects WebSphere Application Server (CVE-2021-44228) shipped with IBM Workload Scheduler

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Workload Scheduler, which results in IBM Workload Scheduled being impacted by this vulnerability. Information about security vulnerabilities affecting WAS have been published in security bulletins, and IBM recommends th...

Object import configuration details are leaked via the Create Object type mapping feature - CVE-2021-43951

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerability in the Create Object type mapping feature. The affected versions are before version 4.21.0...

Import source configuration information is leaked via the Insight Import Source feature - CVE-2021-43950

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0...

Names of private objects are leaked to unauthorized users via the "Move objects" feature - CVE-2021-43948

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0. Affected versions:...