Security Bulletin: IBM Workload Scheduler potentially affected by vulnerability in Eclipse Openj9 (CVE-2021-41041)

Summary Eclipse Openj9 is vulnerable to attacks bypassing security restrictions that can potentially affect IBM Workload Scheduler 9.5 and IBM Workload Scheduler 10.1 Vulnerability Details CVEID:CVE-2021-41041 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

Security Bulletin: IBM Workload Scheduler potentially affected by multiple vulnerabilities in jackson-databind (CVE-2022-42003, CVE-2022-42004)

Summary FasterXML jackson-databind is vulnerable to denial of service attacks that can potentially affect IBM Workload Scheduler 9.5 and IBM Workload Scheduler 10.1 Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Workload Scheduler potentially affected by parsing issue with binary data in protobuf-java core (CVE-2022-3171)

Summary A parsing issue with binary data in protobuf-java core can lead to a denial of service attack and potentially affects IBM Workload Scheduler 9.5 and IBM Workload Scheduler 10.1 Vulnerability Details CVEID:CVE-2022-3171 DESCRIPTION: protobuf-java core and lite are vulnerable to a denial of...

Security Bulletin: IBM Workload Scheduler potentially affected by cross-site scripting vulnerability in jQuery UI (CVE-2022-31160)

Summary jQuery UI is vulnerable to cross-site scripting attack that can potentially affect IBM Workload Scheduler 9.5 and IBM Workload Scheduler 10.1 Vulnerability Details CVEID:CVE-2022-31160 DESCRIPTION: jQuery UI is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a buffer overflow due to CVE-2022-42444

Summary IBM App Connect Enterprise contains a buffer overflow vulnerability which could allow a malicious administrator to cause an integration server process to abend. The fix provided resolves the vulnerability Vulnerability Details CVEID:CVE-2022-42444 DESCRIPTION: IBM App Connect Enterprise i...

Security Bulletin: IBM App Connect Enterprise Discovery Connector nodes are vulnerable to a loss of confidentiality due to CVE-2022-42439

Summary IBM App Connect Enterprise contains an unspecified vulnerability in the Discovery Connector nodes which may cause a 3rd party system's credentials to be exposed to a privileged attacker. The fix provided resolves the vulnerability. Vulnerability Details CVEID:CVE-2022-42439 DESCRIPTION: I...

Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect IBM Workload Scheduler.

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition potentially affect IBM Workload Scheduler. These issues were disclosed as part of the Oracle July 2022 Critical Patch Update. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-21541 DESCRIPTION: An...

Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect IBM Workload Scheduler.

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition potentially affect IBM Workload Scheduler. These issues were disclosed as part of the Oracle April 2022 Critical Patch Update. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-21496 DESCRIPTION: An...

Security Bulletin: AIX is vulnerable to a buffer overflow due to X11 (CVE-2022-47990)

Summary A vulnerability in X11 on AIX could allow a non-privileged local user to cause a buffer overflow that could result in a denial of service or arbitrary code execution CVE-2022-47990. Vulnerability Details CVEID:CVE-2022-47990 DESCRIPTION: IBM AIX could allow a non-privileged local user to...

CVE-2021-4314

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

CVE-2021-4314

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

Code injection

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

CVE-2021-4314

The connected PT-2023-12418 entry provides concrete details for CVE-2021-4314: affected software is zOSMF versions 1.16–1.19. The root cause is bypass of JWT token validation when APAR PH12143 is not applied, causing ZAAS client/API ML API queries to accept forged tokens and authenticate as other...

CVE-2021-4314

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

Security Bulletin: Code injection vulnerability affect IBM Business Automation Workflow (CVE-2022-42920)

Summary IBM Business Automation Workflow packages Apache Commons BCEL. A code injection vulnerability affecting BCEL was reported. CVE-2022-42920 Vulnerability Details CVEID:CVE-2022-42920 DESCRIPTION: Apache Commons BCEL could allow a remote attacker to bypass security restrictions, caused by an...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 affects CICS Transaction Gateway

Summary There is a vulnerability which is related to identity spoofing in IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-22475...

Security Bulletin: An issue was identified in IBM WebSphere Application Server Liberty that IBM MQ ships (CVE-2022-34165)

Summary An issue was identified in IBM WebSphere Application Server Liberty that IBM MQ ships to provide MQ Console and MQ REST API functionality. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server...

Security Bulletin: An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Version 8 supplied by IBM MQ (CVE-2021-2163)

Summary An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Versions 7 and 8 supplied by IBM MQ versions. The IBM® Runtime Environment Java™ Technology Edition, Version 8 is used for Java Client, JMS Client, AMQP, MQTT, Blockchain Bridge, Salesforce Bridge, Java AMS, M...

Security Bulletin: AIX is affected by a root privilege escalation vulnerability (CVE-2022-41290)

Summary A vulnerability in the AIX rmmlcachefile user command could allow a non-privileged local user to obtain root privileges CVE-2022-41290. Vulnerability Details CVEID:CVE-2022-41290 DESCRIPTION: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a...

Security Bulletin: IBM DataPower Gateway affected by vulnerability in Java (CVE-2022-21626)

Summary IBM has addressed the CVE, which potentially affects JDBC, IMS Callout and JMS components Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service...