[SECURITY] Fedora 40 Update: plexus-containers-2.2.0-3.fc40

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

[SECURITY] Fedora 40 Update: plexus-i18n-1.0-0.31.b10.4.fc40

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

[SECURITY] Fedora 40 Update: plexus-archiver-4.9.1-3.fc40

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

BIT-DISCOURSE-2021-43850 Denial of Service in discourse

Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the /message-bus/diagnostics path. The impact of this vulnerability is greater on multisite Discourse instances where multiple forums are served from a singl...

BIT-REDMINE-2021-31863

Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process...

IBM WebSphere Application Server Liberty Encryption Issue Vulnerability

IBM WebSphere Application Server Liberty is a Java application server from International Business Machines IBM built on top of the Open Liberty project. A cryptographic issue vulnerability exists in IBM WebSphere Application Server Liberty that stems from a failure to adhere to user configuration...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Service Registry and Repository due to January 2024 CPU

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, used by WebSphere Service Registry and Repository. These issues were disclosed as part of the IBM Java SDK updates in January 2024. These issues are also addressed by WebSphere Application Server shipped with WebSphere...

CVE-2023-50312

CVE-2023-50312 affects IBM WebSphere Application Server Liberty. The issue is that outbound TLS connections could have weaker-than-expected security due to a failure to honor user configuration. Affected versions are Liberty 17.0.0.3 through 24.0.0.2. The connected documents reiterate the same de...

Security Bulletin: IBM Maximo Application Predict Component uses WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache Santuario which is vulnerable to CVE-2023-44483

Summary IBM Maximo Application Predict Component uses WebSphere Application Server Liberty is vulnerable to information disclosure due to Apache Santuario which is vulnerable to CVE-2023-44483 This bulletin contains information regarding the vulnerability and it's fixture Vulnerability Details...

Security Bulletin: IBM Operational Decision Manager for February 2024 - Multiple CVEs addressed

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-46158...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to January 2024 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Vulnerabilities fixed in IBM WebSphere Application Server

IBM has fixed vulnerabilities in WebSphere. The vulnerabilities are located in the Java component of WebSphere and allow a malicious party to carry out attacks that could lead to loss of data integrity and confidentiality. IBM did not release any other detailed information. A more precise risk...

Security Bulletin: IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty (CVE-2023-44487)

Summary IBM Match 360 is vulnerable to vulnerable to a denial of service due to HTTP/2 Rapid Reset within IBM WebSphere Application Server Liberty. Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending numerous...

Security Bulletin: IBM Match 360 is vulnerable to Apache Santuario used within IBM WebSphere Application Server Liberty (CVE-2023-44483)

Summary IBM Match 360 is vulnerable to Apache Santuario used within IBM WebSphere Application Server Liberty. Apache Santuario could allow a remote authenticated attacker to obtain sensitive information, caused by the storage of a private key in the log files when using the JSR 105 API. By gainin...

SAP NetWeaver AS Java Multiple Vulnerabilities (Feb 2024)

SAP NetWeaver Application Server for Java is affected by multiple vulnerabilities, including the following: - The User Admin application of SAP NetWeaver AS for Java insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This resul...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty may affect IBM Storage Scale (CVE-2023-46158, CVE-2023-44487)

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty, used by IBM Storage Scale, which could provide weaker than expected security due to improper resource expiration handling. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM WebSphere Application Server Libert...

CVE-2024-24740 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel)

SAP NetWeaver Application Server ABAP - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of t...

CVE-2024-24740

CVE-2024-24740 affects SAP NetWeaver Application Server (ABAP) — specifically kernel versions 7.53–7.94 and KRNL64UC 7.53. The issue is an information-disclosure vulnerability caused by insufficient protection of internal data, allowing an attacker to access information that could be restricted. ...

SAP NetWeaver AS Cross-Site Scripting Vulnerability

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides web services, but is also the basic platform for SAP software. A cross-site scripting vulnerability exists in SAP NetWeaver AS for Java version 7.50, which stems from incorrect validation and encoding of incoming...

Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security. (CVE-2023-46158)

Summary IBM PowerVM Novalink is vulnerable because BM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM...