Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to arbitrary code execution due to node.js minimist module ( CVE-2021-44906)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to arbitrary code execution due to the node.js minimist module CVE-2021-44906. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes minimist 1.2.6 Vulnerabilit...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22475)

Summary IBM WebSphere Application Server Liberty is vulnerable to identity spoofing with the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0 or appSecurity-4.0 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server...

Security Bulletin: Denial of Service vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-35618

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a Denial of Service attack. Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a Java StackOverflow exception. By using a lar...

Security Bulletin: IBM Spectrum Protect Server vulnerable to offline dictionary and brute force attacks (CVE-2022-22496, CVE-2022-22487)

Summary The IBM Spectrum Protect Server is vulnerable to an offline dictionary attack when using SESSIONSECURITY=TRANSITIONAL. The IBM Spectrum Protect Storage agent is vulnerable to a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrati...

Security Bulletin: Information Disclosure and Denial of Service Vulnerabilities in IBM Spectrum Protect Backup-Archive Client (CVE-2022-22478, CVE-2022-22474)

Summary The IBM Spectrum Protect back-up archive client is vulnerable to information disclosure as user credentials are stored in memory in plain text. The back-up archive client is also vulnerable to a denial of service due to certain read operations on TCP/IP sockets. Vulnerability Details...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11, v12 & IBM Integration Bus (CVE-2020-7608)

Summary IBM App Connect Enterprise ships with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-7608 DESCRIPTION: Node.js yargs-parser module could allow a remote attacker to execute arbitrary cod...

Security Bulletin: IBM MQ is vulnerable to an issue within Jackson

Summary An issue was identified with the Jackson library that is used within the IBM MQ Console to provide REST API functionality. The Jackson library is only used in IBM MQ Versions 9.2.4 and above. Vulnerability Details IBM X-Force ID: 217968 DESCRIPTION: FasterXML jackson-databind is vulnerabl...

AIX 7.2 TL 5 : lpd (IJ39878)

https://vulners.com/cve/CVE-2022-22444 https://vulners.com/cve/CVE-2022-22444 IBM AIX could allow a local user to exploit a vulnerability in the lpd daemon to cause a denial of service. C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory...

Security Bulletin: IBM DataPower Gateway Virtual Edition uses out of date ICU libraries in open-vm-tools

Summary Open-vm-tools is used only in IBM DataPower Gateway Virtual Edition for communicating with the Hypervisor to perform such tasks as reboot or shutdown of the VM. The limited functionality employed in this use should not expose these CVEs to exploitation; IBM has addressed the CVEs out of a...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary This bulletin covers all applicable Java SE CVEs published by Oracle as part of their April 2022 Critical Patch Update, except for CVE-2022-21426 which will be described in a future bulletin. For more information please refer to Oracle's April 2022 CPU Advisory and the X-Force database...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to Spoofing (CVE-2022-22365)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to Spoofing CVE-2022-22365 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and Versions|...

Security Bulletin: IBM MQ trace can inadvertently trace sensitive data (CVE-2022-22325)

Summary An issue was identified with IBM MQ tracing logic used by queue managers and native C-based MQ clients that meant sensitive data could be captured while IBM MQ trace was running. This data would be stored in plaintext within the IBM MQ trace files. Vulnerability Details CVEID:...

Security Bulletin: IBM MQ can be incorrectly configured to prevent required authorization checks (CVE-2022-22316)

Summary An issue was identified within the IBM MQ queue manager logic that meant improper authorization checks were performed when incorrect settings were configured for IBM MQ Clustering. Vulnerability Details CVEID: CVE-2022-22316 DESCRIPTION: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center Browser's History (CVE-2022-22484)

Summary IBM Spectrum Protect Operations Center may disclose sensitive information in plain text in the brower's application command history. Vulnerability Details CVEID:CVE-2022-22484 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a local attacker to obtain sensitive information,...

Security Bulletin: Deserialization Vulnerability Affects IBM Sterling B2B Integrator (CVE-2019-4728)

Summary IBM Sterling B2B Integrator has addressed the deserialization vulnerability. Vulnerability Details CVEID: CVE-2019-4728 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrust...

Security Bulletin: Cross-Site Scripting Vulnerability Affects the Dashboard User Interface of IBM Sterling B2B Integrator (CVE-2021-20571)

Summary IBM Sterling B2B Integrator has addressed a stored cross-site scriping security vulnerability. Vulnerability Details CVEID: CVE-2021-20571 DESCRIPTION: IBM Sterling B2B Integrator is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...

Security Bulletin: IBM MQ WebConsole and REST API are affected by CVE-2021-39031.

Summary An issue was identified within the IBM WebSphere Application Server Liberty profile that IBM MQ uses to provide web console and REST API functionality. Vulnerability Details CVEID:CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow ...

Security Bulletin: Cross-site scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38893

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a cross-site scripting attack. Vulnerability Details CVEID: CVE-2021-38966 DESCRIPTION: IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2022-22316)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2022-22316 DESCRIPTION: IBM MQ could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. CVSS Base score: 5.3 CVSS...

There is a vulnerability in the AIX pmsvcs kernel extension for VIOS.,There is a vulnerability in the AIX pmsvcs kernel extension.

IBM SECURITY ADVISORY First Issued: Fri Mar 4 08:58:04 CST 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/pmsvcsadvisory.asc https://aix.software.ibm.com/aix/efixes/security/pmsvcsadvisory.asc...