Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to the October 2023 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

CVE-2023-30954

The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to information disclosure due to Apache Santuario (CVE-2023-44483)

Summary There is a vulnerability in the Apache Santuario library used by IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, when the wsSecurity-1.1, wsSecuritySaml-1.1 or samlWeb-2.0 feature is enabled. Vulnerability Details Refer to the security bulleti...

CVE-2023-30954

The CVE describes a race condition in the Gotham video-application-server where ACLs for new videos may not be applied if the source system has not initialized. Affected component: Gotham video-application-server; underlying issue is a race condition affecting access control application during vi...

CVE-2023-30954 Gotham Video Broken Authentication

The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not yet initialized...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a denial of service (CVE-2023-44487)

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service with the servlet-3.1, servlet-4.0, servlet-5.0, or servlet-6.0 feature with the HTTP/2 protocol enabled. Vulnerability Details CVEID: CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of...

PT-2023-24526 · Aveva · Application Server +14

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: This issue allows a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where the products are installed...

PT-2023-25082 · Aveva · Application Server +14

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: This issue could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where the products ar...

PT-2023-23083 · Unknown · Gotham Video-Application-Server

Name of the Vulnerable Software and Affected Versions: Gotham video-application-server affected versions not specified Description: The issue is related to a race condition in the Gotham video-application-server service. This condition causes the service to fail in applying certain access control...

CVE-2023-41366

CVE-2023-41366 affects SAP NetWeaver Application Server ABAP and ABAP Platform. Affected components/versions: KERNEL 722, KERNEL 7.53, 7.77, 7.85, 7.89, 7.54, 7.91, 7.92, 7.93, 7.94 and KERNEL64UC 7.22/7.22EXT, KERNEL64NUC 7.22/7.22EXT, KERNEL64UC 7.53. The issue arises from a lack of restriction...

PT-2023-27929 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP versions KERNEL 7.22 through KERNEL 7.94, KERNEL64UC 7.22 through KERNEL64UC 7.53, KERNEL64NUC 7.22 through KERNEL64NUC 7.22EXT Description: The issue allows an unauthenticated attacker to access unintend...

SAP NetWeaver Application Server Security Vulnerability

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server ABAP. An attacker could exploit the vulnerability to access sensitive data...

IBM WebSphere Application Server Liberty 23.0.0.9 < 23.0.0.11 Security Weakness (7058356)

The IBM WebSphere Application Server Liberty running on the remote host is 23.0.0.9 prior to 23.0.0.11. It may, therefore, provide weaker than expected security due to improper resource expiration handling. Note that Nessus has not tested for this issue but has instead relied only on the...

IBM WebSphere Application Server Liberty Resource Management Error Vulnerability

IBM WebSphere Application Server Liberty is a Java application server from International Business Machines IBM built on top of the Open Liberty project. A resource management error vulnerability exists in IBM WebSphere Application Server Liberty that stems from improper handling of resources afte...

Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty is vulnerable to a denial of service. (CVE-2023-38737)

Summary IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory...

Security Bulletin: IBM HTTP Server is vulnerable to information disclosure due to the included Apache HTTP Server (CVE-2023-31122)

Summary IBM HTTP Server is vulnerable to information disclosure when using the modmacro module due to the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2023-31122 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by an out-of-boun...

Design/Logic Flaw

IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - July 2023 - Includes Oracle July 2023 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 that are used by Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities a...

CVE-2023-46158

CVE-2023-46158 affects IBM WebSphere Application Server Liberty (versions 23.0.0.9–23.0.0.10). The issue arises from improper resource expiration handling, leading to weaker than expected security (CWE-613: Insufficient Session Expiration). IBM X-Force ID 268775; CVSS base 4.9 (IBM X-Force assess...

CVE-2023-46158 IBM WebSphere Application Server session fixation

IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775...