Security Bulletin: IBM Sterling Control Center is vulnerable to User Enumeration

Summary User Enumeration is affecting v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-35114 DESCRIPTION: IBM Sterling Control Center could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. CWE:CWE-204: Observable Response Discrepancy...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024

Summary IBM SDK, Java Technology Edition Quarterly CPU - Apr 2024 is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause no...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2024 - Includes OpenJDK Apr 2024 CPU

Summary IBM Semeru Runtime Quarterly CPU - Apr 2024 is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-21085 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impacts...

Security Bulletin: IBM CICS TX Advanced web pages are vulnerable to cross-site scripting and cross-site request forgery attacks.

Summary Webpages that are shipped as part of IBM CICS TX Advanced are vulnerable to cross-site scripting and cross-site request forgery attacks. Updates to IBM CICS TX Advanced have been released to address these vulnerabilities. Vulnerability Details CVEID:CVE-2024-41745 DESCRIPTION: IBM CICS TX...

PT-2025-2867 · Qualcomm · Snapdragon +22

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption that occurs when reading CPU state data during the suspension of a guest virtual machine. This corruption happens...

Security Bulletin: IBM CICS TX Standard is vulnerable to Cross-site Scripting (Reflected) and Cross-Site Request Forgery (CSRF).

Summary Webpages that are shipped as part of IBM CICS TX Standard are vulnerable to Cross-site Scripting Reflected and Cross-Site Request Forgery CSFR. Updates to IBM CICS TX Standard have been released to address this vulnerability. Vulnerability Details CVEID:CVE-2024-41745 DESCRIPTION: IBM CIC...

PT-2024-41132 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central affected versions not specified Description: The issue is related to insufficient validation of incoming requests in Trend Micro Apex Central, a security monitoring and management tool. This can be exploited by a remo...

The vulnerability of the software for centralized device management in Fortinet FortiManager allows a hacker to disclose protected information.

The vulnerability of the software for centralized device management in Fortinet FortiManager lies in the lack of protection for operational data. Exploiting this vulnerability can allow attackers to disclose sensitive information through generated HTTP requests...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest iFixes Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause no...

Security Bulletin: Multiple Vulnerabilities in VMware vCenter affect Cloud Pak System [CVE-2024-22274, CVE-2024-22275, CVE-2024-37087]

Summary Vulnerabilities in Broadcom VMware vCenter affect IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2024-22274 DESCRIPTION: Broadcom VMware vCenter Server and Cloud Foundation could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an...

Security Bulletin: IBM Master Data Management vulnerable to remote attack and denial of service from vulnerabilites in OpenSSL (CVE-2022-4304, CVE-2023-0215, CVE-2023-0286)

Summary IBM Master Data Management v11.6, and v12.0 are vulnerable to remote attack and denial of service from vulnerabilites found in OpenSSL. OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By...

Security Bulletin: IBM Master Data Management vulnerable to denial of service from Apache Commons FileUpload (CVE-2023-24998)

Summary IBM Master Data Management v11.6, v12.0, and v14.0 are vulnerable to a denial of service caused by not limiting the number of requests processed in the file upload function in Apache Commons FileUpload. Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by...

Security Bulletin: IBM Master Data Management is vulnerable to specially crafted certificate chains in OpenSSL leading to a denial of service (CVE-2023-0464)

Summary IBM Master Data Management v11.6, and v12.0 are vulnerable to denial of service from specially crafted certificate chains in OpenSSL leading to a denial of service. OpenSSL is vulnerable to a denial of service, caused by an error related to the verification of X.509 certificate chains tha...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973 CVE-2024-24790: Fixed unexpected behavior from Is...

File Upload Vulnerability in the Center Management Server System of Guangdong Paulan Electronics Co.

Guangzhou Paulun Electronic Co., Ltd. is a company mainly engaged in public broadcasting, campus broadcasting, conference system, paperless system, recording and broadcasting system, intelligent campus, stage lighting, LED big screen, landscape lighting and other projects. A file upload...

Security Bulletin: vulnerability in OpenSSL affects IBM Workload Automation.

Summary IBM Workload Automation is potentially affected by a vulnerability in OpenSSL that can cause denial of service CVE-2024-0727 Vulnerability Details CVEID:CVE-2024-0727 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to...

Cisco UCS Central Software Configuration Backup Information Disclosure (cisco-sa-ucsc-bkpsky-TgJ5f73J)

According to its self-reported version, Cisco UCS Central Software Configuration Backup Information Disclosure is affected by a vulnerability. - A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information...

Security Bulletin: IBM Sterling Control Center is affected by multiple container-level vulnerabilities

Summary IBM Sterling Control Center container includes a vulnerable version of glibc at the OS level, affected by a denial of service Vulnerability Details CVEID:CVE-2024-33602 DESCRIPTION: glibc is vulnerable to a denial of service, caused by a memory corruption by the Name Service Cache Daemon'...

The vulnerability of the Central Web Authentication (CWA) component of the Cisco IOS XE operating system allows a hacker to bypass the authentication process and gain access to the protected network segment.

The vulnerability of the Central Web Authentication CWA component in the Cisco IOS XE operating system is related to logical errors in the implementation of the access control list ACL. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and gain access to t...

CVE-2024-20280

A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used fo...