Security Bulletin: Security vulnerability in WebSphere Application Server Liberty shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises (CVE-2021-39031)

Summary IBM WebSphere Application Server Liberty is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. WebSphere Application Server Liberty is vulnerable to Identity Spoofing CVE-2022-22475. Vulnerability Details Refer to the security bulletins...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Certified Edition 11 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-34169 DESCRIPTION: The Apache Xalan Java XSLT library could allow a remote attacker to execute...

Security Bulletin: IBM WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the Admin Console (CVE-2022-34336)

Summary IBM WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the Admin Console CVE-2022-34336 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Information leakage in IBM Business Process Manager (CVE-2017-1765)

Summary Sensitive information about the application server is revealed during snapshot export in IBM Business Process Manager. Vulnerability Details CVEID: CVE-2017-1765 DESCRIPTION: IBM Business Process Manager could allow an authenticated user with special privileges to reveal sensitive...

Security Bulletin: An information disclosure security vulnerability has been identified with the embedded Content Navigator component shipped with IBM Business Automation Workflow (CVE-2019-4679)

Summary Some application server information the operating system name and version, for example is included in the response when users log into IBM Content Navigator. Vulnerability Details CVEID:CVE-2019-4679 DESCRIPTION: IBM Content Navigator 3.0CD could allow an authenticated user to gain...

Security Bulletin: Multiple security vulnerabilities in Swagger UI affect IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Summary IBM Business Process Manager and IBM Business Automation Workflow are affected by multiple security vulnerabilities found in Swagger UI. Vulnerability Details CVEID:CVE-2012-6708 DESCRIPTION: jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput functio...

Security Bulletin: An Apache Commons Compress vulnerability has been identified with the embedded IBM FileNet P8 Content Platform Engine component in IBM Business Process Manager and IBM Business Automation Workflow

Summary An Apache Commons Compress vulnerability has been identified with the embeded IBM FileNet P8 Content Platform Engine component, specifically with the Administration Console for Content Platform Engine application, in IBM Business Process Manager and IBM Business Automation Workflow...

Security Bulletin: Information leakage in IBM Business Automation Workflow (CVE-2018-1999)

Summary An information leakage vulnerability in IBM Business Automation Workflow has been found. Vulnerability Details CVEID: CVE-2018-1999 DESCRIPTION: IBM Business Process Manager could reveal sensitive version information about the server from error pages that could aid an attacker in further...

Security Bulletin: Spoofing vulnerability in IBM Business Automation Workflow (CVE-2019-4045)

Summary A Spoofing vulnerability has been found in IBM Business Automation Workflow. Vulnerability Details CVEID: CVE-2019-4045 DESCRIPTION: IBM Business Automation Workflow and IBM Business Process Manager provide embedded document management features. Because of a missing restriction in an API,...

Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2019-1563. Vulnerability Details CVEID:CVE-2019-1563 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a padding oracle attack in PKCS7dataDecode and...

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are vulnerable to HTTP header injection (CVE-2022-34165)

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are vulnerable to HTTP header injection CVE-2022-34165 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

Security Bulletin: Potential security exposure with IBM HTTP Server 8.0 and earlier (PM46234) (CVE-2011-3192)

Summary Crafted range requests can result in potential denial of service with IBM HTTP Server IHS. Vulnerability Details Potential denial of service from attack using crafted range requests CVE Reference: CVE-2011-3192. Affected Products and Versions Affected: IBM HTTP Server IHS Versions 2.0...

Security Bulletin: Potential Denial of service vulnerability in IBM HTTP Server (CVE-2013-6329)

Summary A potential denial of service vulnerability in SSL handshake processing in IBM HTTP Server IHS. Vulnerability Details CVEID: CVE-2013-6329 Description: Potential denial of service in SSL handshake processing. CVSS Base Score: 7.1 CVSS Temporal Score: See...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind (CVE-2020-36518)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to a denial of service due to jackson-databind, caused by a Java StackOverflow exception. The fix includes jackson-databind 2.13.3 Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is...

Security Bulletin: Potential denial of service vulnerability in WebSphere Application Server can affect IBM SPSS Analytic Server (CVE-2019-4046)

Summary There is a potential denial of service vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2019-4046 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to Identity Spoofing (CVE-2022-22475)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to Identity Spoofing CVE-2022-22475 Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are...

Security Bulletin: IBM WebSphere MQ Clients connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa. (CVE-2018-1374)

Summary A client connecting to a IBM MQ or IBM WebSphere MQ Queue Manager could cause a SIGSEGV in the channel process amqrmppa. Vulnerability Details CVEID: CVE-2018-1374 DESCRIPTION: A IBM WebSphere MQ Client connecting to a Queue Manager could cause a SIGSEGV in the Channel process amqrmppa...

Security Bulletin: Tivoli Storage Productivity Center affected by vulnerabilities in OpenSSL (CVE-2013-0169, CVE-2012-2686, CVE-2013-0166)

Summary A number of security vulnerabilities have been discovered in the OpenSSL libraries included in Tivoli Storage Productivity Center. These libraries are used for communications with the Storage Resource agent and some storage systems. Vulnerability Details VULNERABILITY DETAILS: DESCRIPTION...

Security Bulletin: IBM Workload Scheduler is potentially vulnerable to denial of service due to CVE-2022-0778 affecting OpenSSL component

Summary OpenSSL vulnerability CVE-2022-0778 has been disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Schedulerfor secure communications between the components. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw i...

Security Bulletin: IBM DataPower Gateway affected by vulnerability in Java Runtime Environment (CVE-2021-35561)

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2021-35561 DESCRIPTION: An unspecified vulnerability in Java SE related to the Utility component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack...