Security Bulletin: Multiple vulnerabilities in Product IMS Enterprise Suite SOAP Gateway (CVE-2012-5785, CVE-2013-0483)

Abstract IMS™ Enterprise Suite SOAP Gateway V1.1, V2.1, and V2.2 security vulnerabilities in SSL connections and login processes. Content Security Bulletin: Multiple vulnerabilities exist in IMS Enterprise Suite SOAP Gateway CVE-2012-5785, CVE-2013-0483 SUMMARY: IMS™ Enterprise Suite SOAP Gateway...

Security Bulletin: Information regarding security vulnerability in IBM SDK for Java that is shipped with IBM WebSphere Application Server and addressed by Oracle CPU April 2013 (CVE-2013-0169)

Abstract Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM WebSphere Application Server and included in the products that are listed in this document. Content VULNERABILITY DETAILS: DESCRIPTION: This Security Bulletin addresses the security vulnerabilities...

Security Bulletin: IBM Tivoli Directory Integrator for z/OS (TDI) Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool used by TDI contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link...

Security Bulletin: IBM WebSphere Extended Deployment Compute Grid Vulnerability (CVE-2013-4039)

Abstract Potential security vulnerability fixed in IBM WebSphere Extended Deployment Compute Grid V8.0.0.3 Content VULNERABILITY DETAILS: CVE ID:CVE-2013-4039PM84760 DESCRIPTION: WebSphere Extended Deployment Compute Grid could allow a remote attacker to obtain sensitive information and exploit...

Security Bulletin: Tivoli Management Framework affected by vulnerabilities in OpenSSL 1.0.1c

Abstract OpenSSL versions before 1.0.1d do not follow best security practices and need to upgrade. On Linux Intel or z/OS platform, the components of Tivoli Management Framework 4.1.1 may include the files in OpenSSL which version is 1.0.1c or lower. Content VULNERABILITY DETAILS: CVE ID:...

Security Bulletin: Security vulnerability in IBM InfoSphere Guardium S-TAP for DB2 on z/OS (CVE-2013-0490)

Abstract An unspecified vulnerability in IBM InfoSphere Guardium S-TAP for DB2 on z/OS v8.1 could allow local attackers to execute arbitrary commands via unknown vectors. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0490 CVSS: CVSS Base Score: 7.2 CVSS Temporal Score: See...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Certified Edition 11 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-34169 DESCRIPTION: The Apache Xalan Java XSLT library could allow a remote attacker to execute...

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

Server side request forgery (ssrf)

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

CVE-2022-40357

Z-BlogPHP

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

PT-2022-25359 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.7.3 Description: A security issue was discovered that allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter, due to a Server-Side...

Z-BlogPHP 代码问题漏洞

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. A security vulnerability exists in Z-BlogPHP 1.7.2 and earlier versions, which stems from a server-side request forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file that allows a remote...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server, which is shipped with IBM Business Process Manager (BPM): CPU Utilization (CVE-2014-0963)

Summary IBM WebSphere Application Server is shipped as a component of IBM Business Process Manager. Information about a security vulnerability, which affects IBM WebSphere Application Server, has been published in a security bulletin. Vulnerability Details For vulnerability details, see the...

Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2019-1563. Vulnerability Details CVEID:CVE-2019-1563 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7dataDecode and...

Important: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 Train director operator containers, with several Important security fixes, are available for technology preview. Release osp-director-operator images Security Fixes: CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read important CVE-2021-41103...

Important: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 Train director operator containers, with several Important security fixes, are available for technology preview. Release osp-director-operator images Security Fixes: go-getter: unsafe download issue 1 of 3 Important CVE-2022-30321 go-getter: unsafe download issue 2...

apache-commons-compress: infinite loop when reading a specially crafted 7Z archive

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allows the mounting of a denial of service attack against services that use Compress' SevenZ package...