There is a vulnerability in the AIX nimsh daemon for VIOS.,There is a vulnerability in the AIX nimsh daemon.

IBM SECURITY ADVISORY First Issued: Fri Mar 4 08:54:35 CST 2022 |Updated: Thu Mar 24 15:53:49 CDT 2022 |Update: New iFixes provided for all levels. The new iFixes resolve a | technical failure with the previous iFixes when running NIM commands | of extended length, resulting in a...

Security Bulletin: IBM DataPower affected by vulnerabilities in Node.js

Summary IBM has addressed the following CVEs that affect the APIC Gateway Service. Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attacker could send a specially-crafted request...

There is a vulnerability in BIND that affects AIX for VIOS.,There is a vulnerability in BIND that affects AIX.

IBM SECURITY ADVISORY First Issued: Tue Mar 1 08:41:32 CST 2022 |Updated: Wed Mar 16 11:31:17 CDT 2022 |Update: New iFixes provided for all AIX and VIOS levels. | The previous iFixes were not cumulative, and the new iFixes are | intended to supplant the previous fixes. The most recent version of...

There is a vulnerability in the AIX audit user commands for VIOS.,There is a vulnerability in the AIX audit user commands.

IBM SECURITY ADVISORY First Issued: Mon Feb 28 16:34:28 CST 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/auditadvisory.asc https://aix.software.ibm.com/aix/efixes/security/auditadvisory.asc...

Security Bulletins for WebSphere Application Server

Abstract This security bulletin for WebSphere Application Server is a way for you to obtain security risk assessment information for APARs that are considered Security Integrity. If there is any potential risk of exposure, the APAR is marked as Security Integrity. Some APARs are marked as Securit...

Security Bulletin: GNU C library (glibc) vulnerability affects Tivoli Storage Productivity Center (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects Tivoli Storage Productivity Center. Vulnerability Details Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION:The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By...

Security Bulletin: Multiple security vulnerabilities with IBM FileNet Content Manager component in IBM Business Automation Workflow -CVE-2021-31811, CVE-2021-31812, CVE-2021-23926, CVE-2021-38965

Summary The embedded IBM FileNet Content Manager component, that is shipped with IBM Business Automation Workflow is vulnerable to multiple vulnerabilities. Vulnerability Details CVEID: CVE-2021-38965 DESCRIPTION: IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote...

Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by an issue within the channel process.(CVE-2021-39034)

Summary An issue was identified in the IBM MQ Version 9.1 queue manager channel process on Solaris platforms, that could be exploited by an attacker to cause a denial of service attack. Vulnerability Details CVEID: CVE-2021-39034 DESCRIPTION: IBM MQ is vulnerable to a denial of service attack...

Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38900

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a information disclosure attack, potentially revealing sensitive information to an administrator. Vulnerability Details CVEID: CVE-2021-38900 DESCRIPTION: IBM Business Process Manager 8.5 and 8.6 and IBM...

Security Bulletin: Denial of Service vulnerability in sanitize-html affects IBM Business Automation Workflow (CVE-2021-23382)

Summary A denial of service vulnerability in sanitize-html affects IBM Business Automation Workflow Workflow Center. Vulnerability Details CVEID: CVE-2021-23382 DESCRIPTION: Node.js postcss module is vulnerable to a denial of service, caused by a regular expression denial of Service ReDoS flaw in...

Security Bulletin: Vulnerability in Java Batch affects WebSphere Application Server Liberty (CVE-2021-20492)

Summary WebSphere Application Server Java Batch is vulnerable to an XML External Entity Injection XXE vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to an Information Disclosure (CVE-2022-22310)

Summary IBM WebSphere Application Server Liberty is vulnerable to an Information Disclosure. This has been addressed. Vulnerability Details CVEID: CVE-2022-22310 DESCRIPTION: IBM WebSphere Application Server Liberty could provide weaker than expected security. A remote attacker could exploit this...

Security Bulletin: Cross-site scripting vulnerability affects IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-4516

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a cross-site scripting attack. Vulnerability Details CVEID: CVE-2020-4516 DESCRIPTION: IBM Business Process Manager and IBM Business Automation Workflow is vulnerable to cross-site scripting. This...

Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow - CVE-2020-4757, PSIRT-ADV0028011, CVE-2020-4934

Summary The embedded IBM Content Navigator, that is shipped with IBM Business Automation Workflow is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2020-4934 DESCRIPTION: IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by IBM WebSphere Application Server. This has been addressed. IBM HTTP Server is affected by CVE-2021-44224 for IBM HTTP Server configurations with "ProxyRequests ON" in the IBM HTTP Server configuration file httpd.conf by...

Security Bulletin: Apache Log4j vulnerabilities impact z/Transaction Processing Facility (z/TPF) and TPF Operations Server (CVE-2021-45105, CVE-2021-45046)

Summary The Apache Log4j vulnerabilities affect the z/Transaction Processing Facility z/TPF system and TPF Operations Server. Several Java applications on the z/TPF system depend on Apache Log4j capabilities. Additionally, the 64-bit Java support in TPF Operations Server uses Apache Log4j...

Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-45105) affects IBM Workload Scheduler 9.5

Summary Apache Log4j 2.16, that is affected by CVE-2021-45105, is installed with IBM Workload Scheduler 9.5.0.5 in jdbc driver for informix/Onedb rdbms. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by the failure to protect fro...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Elastic Storage System (CVE-2021-44228)

Summary A vulnerability in Apache Log4j CVE-2021-44228 could allow an attacker to execute arbitrary code on the system. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale for logging and it is bundled in IBM Elastic Storage System ESS. This vulnerability may affect IBM...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Scale for IBM Elastic Storage Server (CVE-2021-44228)

Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale for IBM Elastic Storage Server for logging . This vulnerability may affect IBM Spectrum Scale for IBM Elastic...

Security Bulletin: The Apache Log4j (CVE-2021-44228) vulnerability affects z/TPF and TPF Operations Server

Summary The Apache Log4j vulnerability CVE-2021-44228 affects the z/Transaction Processing Facility z/TPF system and TPF Operations Server. Several Java applications on the z/TPF system depend on Apache Log4j capabilities. Additionally, the 64-bit Java support in TPF Operations Server uses Apache...