Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by AIX. AIX has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21930 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition related to the JSS...

Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Tue Jul 11 10:46:27 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/javajul2023advisory.asc Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX...

Security Bulletin: Vulnerabilities in OpenSSL affect Cloud Pak System (CVE-2021-23840, CVE-2021-23841)

Summary Vulnerabilities in OpenSSL affect OS Image for AIX Systems shipped with Cloud Pak System. IBM Cloud Pak System. has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in...

Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX

Summary Multiple vulnerabilities in cURL libcurl affect AIX. AIX uses cURL libcurl as part of LV/PV encryption integration with HPCS. Vulnerability Details CVEID:CVE-2022-43552 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a use-after-free flaw when using an HTTP proxy...

Multiple vulnerabilities cURL libcurl affect AIX

IBM SECURITY ADVISORY First Issued: Thu Jun 29 09:35:59 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory2.asc Security Bulletin: Multiple vulnerabilities cURL libcurl affect AIX...

Security Bulletin: IBM Storage Protect Operations Center is vulnerable to denial of service due to IBM WebSphere Application Server Liberty (CVE-2023-24998 )

Summary IBM WebSphere Application Server Liberty is used by IBM Storage Protect Operations Center and may be affected by this vulnerability. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the...

Security Bulletin: IBM Storage Protect Server is vulnerable to denial of service due to Java SE (CVE-2023-21830, CVE-2023-21843)

Summary Java SE is used by IBM Storage Protect Server and may be affected by this vulnerability. Vulnerability Details CVEID:CVE-2023-21830 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow a remote attacker to cause a denial of service...

Security Bulletin: IBM Storage Protect Operations Center is vulnerable to a privilege escalation due to IBM WebSphere Application Server Liberty (CVE-2023-0482)

Summary IBM WebSphere Application Server Liberty is vulnerable to a privilege escalation due to RESTEasy. IBM Storage Protect Operations Center uses IBM WebSphere Application Server Liberty and may be affected by this vulnerability. Vulnerability Details CVEID:CVE-2023-0482 DESCRIPTION: RESTEasy...

Security Bulletin: IBM Storage Protect is vulnerable to exposure of sensitive information due to Java Technology Edition (CVE-2023-30441 )

Summary Java Technology is used by IBM Storage Protect in many functions. It may be exposed to this vulnerability. Vulnerability Details CVEID:CVE-2023-30441 DESCRIPTION: IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitiv...

Security Bulletin: IBM Storage Protect is vulnerable to a denial of service attack due to Google Gson (CVE-2022-25647)

Summary IBM Spectrum Protect is uses Google Gson for object serialization and is vulnerable to this attack. Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace method, ...

Security Bulletin: IBM Storage Protect server is vulnerable to a denial of service attack due to Golang Go (CVE-2022-41723)

Summary IBM Storage Protect Server component OSSM may be vulnerable in Golang Go, causing denial of service Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the HPACK decoder. By sending a specially-crafted HTTP/2 stream, ...

Security Bulletin: IBM Communications Server for AIX is vulnerable to Timing Oracle in RSA Decryption in GSKit builds prior to 8.0.55.31 ( CVE-2023-32342 )

Summary IBM GSKit is used by IBM Communications Server for AIX as part of the TN3270 Server and TN Redirector features. CVE-2023-32342. Vulnerability Details CVEID:CVE-2023-32342 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side...

appli.ac-aix-marseille.fr Cross Site Scripting vulnerability OBB-3375767

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: A vulnerability exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager (CVE-2022-3676).

Summary A vulnerability CVE-2022-3676 exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

Security Bulletin: [All] Expat - CVE-2022-43680 (Publicly disclosed vulnerability)

Summary Vulnerability CVE-2022-43680 present in libExpat used by IBM Tivoli Network Manager ITNM IP Edition Vulnerability Details CVEID:CVE-2022-43680 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by a use-after free created by overeager destruction of a shared DTD in...

Security Bulletin: A vulnerability exists in the IBM® SDK, Java™ Technology Edition affecting IBM Tivoli Network Manager (CVE-2023-30441).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8.0.7.0 - 8.0.7.11, which is used by IBM Tivoli Network Manager IP Edition v4.2. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: AIX is vulnerable to security restrictions bypass due to curl (CVE-2022-32221)

Summary Vulnerability in cURL libcurl could allow a remote attacker to bypass security restriction CVE-2022-32221. AIX uses cURL libcurl as part of LV/PV encryption integration with HPCS. Vulnerability Details CVEID:CVE-2022-32221 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass...

AIX is vulnerable to security restrictions bypass due to curl

IBM SECURITY ADVISORY First Issued: Fri May 26 09:26:13 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory.asc Security Bulletin: AIX is vulnerable to security restrictions bypass due to curl CVE-2022-32221...

CVE-2023-28382

Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for...

CVE-2023-28382

Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Linux V1.0.0 to V1.4.3, ESS REC Agent Server Edition for...