Security Bulletin: Vulnerabilities in IBM Java SE affect IBM InfoSphere Identity Insight (CVE-2020-14782)

Summary In the Java used in IBM InfoSphere Identity Insight 9.0 and 9.1, an unspecified vulnerability related to the Libraries component could allow an unauthenticated attacker to cause low integrity impact. This vulnerability has no confidentiality impact or availability impact. Vulnerability...

Security feature bypass

Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the readonly set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x...

CVE-2021-27608

CVE-2021-27608 describes an unquoted service path in SAPSetup, version 9.0, that could allow local privilege escalation during the installation process when an executable is registered. This could lead to complete compromise of confidentiality, integrity, and availability. Connected redhat and nv...

Security Bulletin: WebSphere Application Server is vulnerable to a Directory Traversal vulnerability (CVE-2020-5016)

Summary WebSphere Application Server is vulnerable to a directory traversal vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2020-5016 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to traverse directories on the system. When application securi...

CVE-2021-20353

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882...

CVE-2020-14221

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users...

Drupal 7.x < 7.74 / 8.x < 8.8.11 / 8.9.x < 8.9.9 / 9.0.x < 9.0.8 RCE (SA-CORE-2020-012)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.74, 8.x prior to 8.8.11, 8.9.x prior to 8.9.9, or 9.0.x prior to 9.0.8. It is, therefore, affected by a remote code execution vulnerability in its file upload functionality due to a...

Security Bulletin: Vulnerability in Java SE libraries could allow unauthenticated attacker to cause denial of service

Summary An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. Vulnerability Details Refer to the security bulletins listed in the...

IBM WebSphere Application Server 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.18 / 9.0.x < 9.0.5.5 SSRF (CVE-2019-17566)

The IBM WebSphere Application Server running on the remote host is version 8.0.0.0 through 8.0.0.15, 8.5.0.x prior to 8.5.5.18, or 9.0.x prior to 9.0.5.5. It is, therefore, affected by a server-side request forgery vulnerability due to improper input validation by the xlink:href attributes. An...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.14 / 9.0.x < 9.0.0.8 Information Disclosure (CVE-2012-5783)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x through 7.0.0.45, 8.0.0.x through 8.0.0.15, 8.5.0.x prior to 8.5.5.14 or 9.0.x prior to 9.0.0.8. It is, therefore, affected by an information disclosure vulnerability in the Apache Commons HttpClient subcomponent d...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to remote code execution vulnerability (CVE-2020-4589)

Summary WebSphere Application Server is vulnerable to a remote code execution vulnerability. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- Jazz for Service...

Microsoft Dynamics 365 Cross-Site Scripting Vulnerability (CNVD-2020-57794)

Microsoft Dynamics 365 is Microsoft's next-generation intelligent business application that helps enterprises grow and digitally transform through the perfect integration of CRM and ERP. A cross-site scripting vulnerability exists in Microsoft Dynamics 365 version 9.0. The vulnerability stems fro...

IBM WebSphere MQ 8.0.0.x < 8.0.0.7 / 9.0.0.x < 9.0.0.2 / 9.0.x < 9.0.4 Multiple Vulnerabilities

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is version 8.0.0.x prior to 8.0.0.7, 9.0.x prior to 9.0.4 or 9.0.0.x prior to 9.0.0.2. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability. An...

Security Bulletin: WebSphere Application Server Admin Console is vulnerable to cross-site scripting (CVE-2020-4578)

Summary WebSphere Application Server Admin Console is vulnerable to cross-site scripting. This has been addressed. Vulnerability Details CVEID: CVE-2020-4578 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Microsoft Dynamics 365 Cross-Site Scripting Vulnerability (CNVD-2020-52906)

Microsoft Dynamics 365 is Microsoft's next-generation intelligent business application that helps enterprises grow and digitally transform through the perfect integration of CRM and ERP. A cross-site scripting vulnerability exists in Microsoft Dynamics 365 Local Edition 8.2, 9.0. The vulnerabilit...

CVE-2020-2038

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

Security Bulletin: WebSphere Application Server ND is vulnerable to cross-site scripting (CVE-2020-4575)

Summary WebSphere Application Server ND is vulnerable to cross-site scripting. This has been addressed. Vulnerability Details CVEID: CVE-2020-4575 DESCRIPTION: IBM WebSphere Application Server ND is vulnerable to cross-site scripting when High Availability Deployment Manager is configured. CVSS...

Microsoft Dynamics 365 Cross-Site Scripting Vulnerability (CNVD-2020-50255)

Microsoft Dynamics 365 is Microsoft's next-generation cloud-based intelligent business application that helps enterprises grow and digitally transform through the perfect integration of CRM and ERP. A cross-site scripting vulnerability exists in Microsoft Dynamics 365 9.0. The vulnerability stems...

KLA11933 XSS vulnerability in Microsoft Dynamics

A cross-site-scripting vulnerability was found in Microsoft Dynamics.Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2020-1591 Related products Microsoft-Dynamics-365 CVE list CVE-2020-1591 high KB list 4541722 Solution Install necessary updates fro...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server WAS is used by the IBM Rational ClearQuest server and web components. Information about security vulnerabilities affecting WAS have been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...