Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2021-44531 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of URI Subject Alternative Na...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2022-32215 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly handle multi-line Transfer-Encoding headers by t...

CVE-2022-22493

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449...

Cross site request forgery (csrf)

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449...

CVE-2022-22493

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449...

CVE-2022-22493

CVE-2022-22493 affects IBM WebSphere Automation for Cloud Pak for Watson AIOps up to version 1.4.2, where cross-site request forgery arises from improper cookie attribute settings. Remediation per IBM bulletin is to upgrade to 1.4.3 or higher; no exploitation details are provided in the connected...

IBM WebSphere Automation 跨站请求伪造漏洞

IBM WebSphere Automation is an operations platform from International Business Machines IBM. automates operational activities to proactively mitigate security risks and accelerate threat remediation. A cross-site request forgery vulnerability exists in IBM WebSphere Automation for IBM Cloud Pak f...

PT-2022-15471 · Ibm · Ibm Websphere Automation For Ibm Cloud Pak For Watson Aiops

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation for Cloud Pak for Watson AIOps version 1.4.2 Description: The issue is related to cross-site request forgery, caused by improper cookie attribute setting. Recommendations: For IBM WebSphere Automation for Cloud Pak fo...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary The following CVEs are fixed in 3.5: CVE-2019-11777, CVE-2022-22475 Vulnerability Details CVEID:CVE-2019-11777 DESCRIPTION: Eclipse Paho Java client could allow a remote attacker to bypass security restrictions, caused by the failure to check the result when connecting to an MQTT server...

Security Bulletin: Multiple Vulnerabilities in Cloud Pak for Watson AIOPs

Summary 3.5 Fixes the following vulnerabilities: CVE-2022-1154, CVE-2018-25032, CVE-2020-29582, CVE-2022-24329, CVE-2022-29217, CVE-2022-22476, CVE-2022-1271, CVE-2022-0778 Vulnerability Details CVEID:CVE-2022-1154 DESCRIPTION: Vim is vulnerable to a heap-based buffer overflow, caused by a...

Security Bulletin: A security vulnerability in Node.js dicer affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Managed Services

Summary A security vulnerability in Node.js dicer affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Managed Services Vulnerability Details CVEID:CVE-2022-24434 DESCRIPTION: Node.js dicer module is vulnerable to a denial of service. By sending a specially-crafted form to server, a...

Security Bulletin: Due to use of pac4j, IBM Cloud PAK for Watson AI Ops is vulnerable to token bypass (CVE-2021-44878)

Summary If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none"...

Security Bulletin: Due to Apache Log4j, IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps is vulnerable to arbitrary code execution (CVE-2021-45046) and denial of service (CVE-2021-45105)

Summary There are vulnerabilities in the Apache Log4j open source library. The library is used by IBM CloudPak foundational services which is a dependency of IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps. The fix includes upgrade to Apache Log4j v2.17. Vulnerability Details CVEID:...

My Takeaways from the Gartner I&O Conference

By Renata Budko, Wallarm Last week I spent a few days in Las Vegas with the great folks at the Gartner IT Infrastructure, Operations & Cloud Strategies Conference. Gathered for the conference there were experts around the world from analysts to VPs to infrastructure and operations leaders to...