Security Bulletin: Multiple IBM Runtime Environments Java Technology Edition vulnerabilities affect IBM Transformation Extender

Summary There are vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 7 and 8, IBM SDK, Java Technology Edition Version 8 and Eclipse Open J9 that affect IBM Transformation Extender. Vulnerability Details CVEID: CVE-2019-11771 DESCRIPTION: Eclipse OpenJ9 could allow a...

exploit-database

This is a repository of exploits and proof-of-concepts for various software vulnerabilities. The repository is maintained by The Exploit Database, a project sponsored by Offensive Security. The database is a collection of publicly available exploits and corresponding vulnerable software, gathered...

Security Bulletin: IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments are vulnerabile to Logjam (CVE-2015-4000)

Summary IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrurm Protect for Space Management, and IBM Spectrum Protect for Virtual Environments are vulnerable to Logjam CVE-2015-4000. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remot...

Security Bulletin: Vulnerability in NTP affects AIX (CVE-2019-8936)

Summary There is a vulnerability in NTPv3 and NTPv4 that affects AIX. Vulnerability Details CVEID: CVE-2019-8936 DESCRIPTION: NTP is vulnerable to a denial of service, caused by a NULL pointer dereference in ntpcontrol.c. By sending specially crafted mode 6 packets, a remote authenticated attacke...

Security Bulletin: Vulnerabilities in Open Source OpenSSL used in OS Image AIX Systems for Cloud Pak System (CVE-2019-1547, CVE- 2019-1563 )

Summary Vulnerabilities identified in Open Source OpenSSL used in AIX OS Image for Cloud Pak System. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM Cloud Pak System| 2.3.0 and...

Amazon Linux 2 : rsyslog (ALAS-2020-1447)

The version of rsyslog installed on the remote host is prior to 8.24.0-52. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1447 advisory. An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the...

Medium: rsyslog

Issue Overview: An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter in this case, a space or a colon but fails to account for strings that do not...

CVE-2020-4406

IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 Linux and Windows, 8.1.9.0 trough 8.1.9.1 AIX and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 Linux, 8.1.9.0 through 8.1.9.1 AIX web user interfaces could allow a remote attacker to hijack the clicking action of the victim...

Security Bulletin: Vulnerability in Go programming language affects IBM Spectrum Protect Server (CVE-2019-16276)

Summary The Go programming language could allow a remote attacker to bypass security restrictions which affects the IBM Spectrum Protect Server. Vulnerability Details CVEID: CVE-2019-16276 DESCRIPTION: Golang could allow a remote attacker to bypass security restrictions, caused by improper...

Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect Operations Center (CVE-2020-5259, CVE-2020-5258)

Summary Dojo could allow a remote attacker to inject arbitrary code on the system which affects IBM Spectrum Protect Operations Center. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux - January 2020

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 that is used by Rational Developer for i and Version 7 that is used by Rational Developer for AIX and Linux. These issues were disclosed as part of the IBM Java SDK updates in October 2019 CVE-2019-2949,...

Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Netcool Configuration Manager.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Netcool Configuration Manager IP Edition v6.4.1 and v6.4.2, which were disclosed in the Oracle January 2020 Critical Patch Update. Vulnerability Details Refer to the security...

Security Bulletin: Multiple Vulnerabilities in python 2.6.4 used in OS Image for AIX shipped with IBM Cloud Pak System

Summary Multiple vulnerabilities have been identified in python 2.6.4 used in OS Image for AIX Systems and OS Image for RedHat Enterprise Linux Systems shipped with IBM Cloud Pak System. OS Image for AIX for IBM Cloud Pak System has addressed vulnerabilities. OS Image for RedHat Enterprise Linux...

AIX OpenSSH Advisory : openssh_advisory10.asc

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities : - OpenSSH is vulnerable to a denial of service, caused by an error in the kexinputkexinit function. By sending specially crafted data during the key exchange process, a remote attacker could...

AIX OpenSSH Advisory : openssh_advisory12.asc

The remote AIX host has a version of OpenSSH installed that is affected by a vulnerability that allows a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. By sending a specially crafted request, an attacker could exploit...

AIX OpenSSH Advisory : openssh_advisory11.asc

The version of OpenSSH installed on the remote AIX host is affected by a vulnerability in the processopen function of sftp-server.c in OpenSSH in that it does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. %NASLMINLEVEL 70300 C Tenable...

Security Bulletin: Publicly disclosed vulnerability found by vFinder in IBM eDiscovery Analyzer

Summary Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct...

rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter in this case, a space or a colon but fails to account for strings that do not satisfy this...

Negative charge in shopping cart in Shopizer

Impact Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. Patches Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0 Workarounds Without...

GHSA-W8RC-PGXQ-X2CJ Negative charge in shopping cart in Shopizer

Impact Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. Patches Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0 Workarounds Without...