Security Bulletin: IBM Sterling B2B Integrator affected by multiple vulnerabilities due to snappy-java

Summary IBM Sterling B2B Integrator uses snappy-java. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-34455 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by the use of an unchecked chunk length in the...

Security Bulletin: IBM Sterlng B2B Integrator missing security attribute in cookie (CVE-2023-42016)

Summary IBM Sterling B2B Integrator has addressed a cookie security vulnerability. Vulnerability Details CVEID:CVE-2023-42016 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the...

IBM Sterling B2B Integrator Resource Management Error Vulnerability

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A resource management error...

Exploring Data Privacy and Security in B2B Gaming Data

By Waqas The gaming industry is experiencing unprecedented growth, propelled by technological advancements and shifting consumer preferences. As the paradigm… This is a post from HackRead.com Read the original post: Exploring Data Privacy and Security in B2B Gaming Data...

CVE-2023-42016

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the...

CVE-2023-32341

IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 255827...

CVE-2023-42016

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the...

Code injection

IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 255827...

Authorization

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the...

CVE-2023-42016 IBM Sterling B2B Integrator information disclosure

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the...

CVE-2023-42016

IBM Sterling B2B Integrator Standard Edition v6.0.0.0–6.0.3.8 and v6.1.0.0–6.1.2.3 omits the secure attribute on authorization tokens and session cookies, enabling cookie exposure via http links or injected sites. This aligns with IBM’s Security Bulletin detailing the vulnerability and CVSS ~4.3 ...

CVE-2023-32341

IBM Sterling B2B Integrator suffers a denial-of-service vulnerability (CVE-2023-32341) due to an uncontrolled resource consumption, affecting versions 6.0.0.0–6.0.3.8 and 6.1.0.0–6.1.2.3. The issue is described as a resource management error that could be exploited by an authenticated user to exh...

CVE-2023-32341 IBM Sterling B2B Integrator denial of service

IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 255827...

CVE-2023-32341 IBM Sterling B2B Integrator denial of service

IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 255827...

CVE-2023-32341: Uncontrolled Resource Consumption

IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 255827...

CVE-2023-42016: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the...

Security Bulletin: IBM DataPower Gateway vulnerable to unauthorized access in Redis

Summary Redis is used in gateway peering, B2B and rate-limiting. IBM has updated Redis to address the vulnerability. Vulnerability Details CVEID:CVE-2023-45145 DESCRIPTION: Redis could allow a local authenticated attacker to bypass security restrictions, caused by a race condition when a permissi...

CVE-2023-4703

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation...

Privilege escalation

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation...

WordPress plugin All in One B2B for WooCommerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...