Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Jetty

Summary IBM Sterling Connect:Direct Browser User Interface uses Jetty server. Vulnerability Details IBM X-Force ID: 260681 DESCRIPTION: Eclipse Jetty is vulnerable to an XML external entity injection XXE attack when processing XML data, caused by a weakly configured XML parser. By using specially...

CVE-2022-36777

IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665...

Code injection

IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665...

CVE-2023-25682

IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0–6.0.3.8 and 6.1.0.0–6.1.2.1 store potentially sensitive information in log files readable by local users. Root cause: information disclosure via log handling. Impact: confidentiality of data in logs (high); integrity/availability not a...

CVE-2022-35638

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230824...

CVE-2022-35638 IBM Sterling B2B Integrator cross-site request forgery

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230824...

CVE-2022-35638

IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site request forgery (CVE-2022-35638) in versions 6.0.0.0–6.0.3.8 and 6.1.0.0–6.1.2.1, with the issue arising from the dashboard web interface allowing authenticated users’ trusted actions to be forged. Reported impact includes t...

CVE-2023-40363

IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force ID: 263332...

CVE-2023-38361

IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770...

CVE-2023-38361

CVE-2023-38361 affects IBM CICS TX Advanced 10.1, where weaker cryptographic algorithms could let an attacker decrypt highly sensitive data. The issue is documented across multiple sources (IBM bulletin A557C..., X-Force 260770). Remediation is available: upgrade to the fixed IBM CICS TX Advanced...

CVE-2023-38361 IBM CICS TX Advanced information disclosure

IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 260770...

CVE-2023-40363

The CVE-2023-40363 issue affects IBM InfoSphere Information Server 11.7. Affected component: installation file permissions that permit an authenticated user to change installation files, caused by incorrect file permission settings. Impact stated in sources includes the ability to modify installa...

CVE-2023-40363 IBM InfoSphere Information Server privilege escalation

IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force ID: 263332...

CVE-2023-40363 IBM InfoSphere Information Server privilege escalation

IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force ID: 263332...

CVE-2023-38364

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821...

CVE-2023-38363

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

CVE-2023-38364

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821...

Cross site scripting

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260821...

Authorization

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the...

CVE-2023-38364

CVE-2023-38364 affects IBM CICS TX Advanced 10.1. The vulnerability is a cross-site scripting (XSS) flaw arising from insufficient input handling in the Web UI, enabling an attacker to embed arbitrary JavaScript within a trusted session. The CVSS v3.1 base score is 6.1 (Network attack, user inter...