Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is Impacted by Multiple Vulnerabilities

Summary IBM Watson OpenScale on Cloud Pak for Data has addressed Node.js npm-registry-fetch, npm CLI module vulnerabilities. Vulnerability Details Third Party Entry: 184667 DESCRIPTION: Node.js npm-registry-fetch module information disclosure CVSS Base score: 7.5 CVSS Temporal Score: See:...

SEO Panel Temporal SQL Blind Betting Vulnerability

SEO Panel is a free, open source SEO optimization software. A temporal SQL blind injection vulnerability exists in the ordercol parameter in archive.php in Seo Panel version 4.8.0. An attacker can exploit this vulnerability to retrieve all databases...

Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is impacted by CVE-2020-25659

Summary IBM Watson OpenScale on Cloud Pak for Data has addressed CVE-2020-25659. Vulnerability Details CVEID: CVE-2020-25659 DESCRIPTION: python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack. By sending a specially-crafted...

Security Bulletin: A security vulnerability in Node.js nodemailer module affects IBM Cloud Automation Manager.

Summary A security vulnerability in Node.js nodemailer module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2020-7769 DESCRIPTION: Nodejs could allow a remote attacker to execute arbitrary commands on the system, caused by improper input validation by the recipient email...

Security Bulletin: CVE-2020-14782 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-14782 was disclosed as part of the Oracle October 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality...

PT-2021-27651

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which occurs in specific functions. The functions involved are derive collocated motion vectors,...

Security Bulletin: Vulnerabilities in Node.js and FasterXML jackson-databind affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in Node.js and FasterXML jackson-databind may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly....

Security Bulletin: IBM Content Manager is affected by a potential information disclosure vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. A potential vulnerability in the Apache Commons Codec module could allow information disclosure. Vulnerability Details Third Party Entry: 177835 DESCRIPTION: Apache Commons Codec information disclosure CVSS Base score: 7.5...

Security Bulletin: Rational Synergy vulnerability (CVE-2014-0453, CVE-2014-0411)

Summary A possible security vulnerability has been reported in the Rational Synergy. There have been no reported exploits of this possible vulnerability, which is located in the JSSE component of IBM Java shipped with the tool and its agent. Vulnerability Details | Subscribe to My Notifications t...

Security Bulletin: Spring Framework vulnerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson Speech Services for Cloud Pak for Data 1.2)

Summary Spring Framework vulnerabilities, listed below, affect IBM Watson Text to Speech and Speech to Text IBM Watson Speech Services for Cloud Pak for Data 1.2 Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security...

Security Bulletin: Authentication mechanism vulnerability affects IBM Connect:Direct for UNIX (CVE-2020-4747)

Summary IBM Connect:Direct for UNIX can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. Vulnerability Details CVEID: CVE-2020-4747 DESCRIPTION: IBM Connect:Direct for UNIX can allow a local or remote user to obtain an authenticated CLI...

InfluxDB authentication bypass vulnerability

InfluxDB is an open source temporal database developed by InfluxData. An authentication bypass vulnerability exists in the authenticate function in services/httpd/handler.go in versions prior to InfluxDB 1.7.6. The vulnerability stems from the fact that JWT tokens may have an empty SharedSecret. ...

Security Bulletin: Information Disclosure Vulnerability Affects EBICS Client of IBM Sterling B2B Integrator (CVE-2020-4475)

Summary IBM Sterling B2B Integrator has addressed the information disclosure vulnerability affecting EBICS Client. Vulnerability Details CVEID: CVE-2020-4475 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information when a detailed...

Security Bulletin: CSV Injection Security vulnerability in ACCE in FileNet Content Manager

Summary Administration Console for Content Platform Engine ACCE CSV Injection Security vulnerability exists in FileNet Content Manager Vulnerability Details CVEID: CVE-2020-4759 DESCRIPTION: IBM FileNet Content Manager is potentially vulnerable to CVS Injection. A remote attacker could execute...

Security Bulletin: IBM Security Guardium is affected by a kernel vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-11599 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a race condition in the coredump implementation. By using a specially-crafted system call, a local...

Security Bulletin: Security vulnerabilities in OpenSSH and OpenSSL shipped with IBM Security Access Manager Appliance (CVE-2018-15473, CVE-2019-1559)

Summary The OpenSSH and OpenSSL packages are shipped with IBM Security Access Manager Appliances. These vulnerabilities have been fixed. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by different responses to...

COVID-19 and Acedia

Note: This isnt my usual essay topic. Still, I want to put it on my blog. Six months into the pandemic with no end in sight, many of us have been feeling a sense of unease that goes beyond anxiety or distress. Its a nameless feeling that somehow makes it hard to go on with even the nice things we...

Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities

Summary IBM Security Privileged Identity Manager has addressed an issue for nss-softokn as follows. Vulnerability Details CVEID: CVE-2019-11745 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)

Summary There are multiple vulnerabilities identified in IBM Guardium Data Encryption GDE .These vulnerabilities have been fixed in GDE 4.0.0.3. Please apply the latest version for the fixes. Vulnerability Details CVEID: CVE-2019-4697 DESCRIPTION: IBM Guardium Data Encryption GDE stores user...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 -CVE-2020-2590 affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. CVE-2020-2590 was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerability...