Security Bulletin: Vulnerability in zlib affect OS Image for AIX Systems shipped with IBM Cloud Pak System [CVE-2018-25032]

Summary Vulnerability in zlib affect OS Image for AIX Systems shipped with IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote...

Security Bulletin: IBM Integration Bus is vulnerable to HTTP request smuggling and a denial of service due to Apache Tomcat. (CVE-2023-46589, CVE-2023-42794)

Summary IBM Integration Bus is vulnerable to HTTP request smuggling and a denial of service due to Apache Tomcat. Vulnerability Details CVEID:CVE-2023-46589 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP trailer headers. By sending a...

PT-2023-27412 · Centralsquare · Centralsquare Click2Gov Building Permit

Name of the Vulnerable Software and Affected Versions: CentralSquare Click2Gov Building Permit versions prior to October 2023 Description: An issue was discovered in CentralSquare Click2Gov Building Permit, where lack of access control protections allows remote attackers to arbitrarily delete...

OESA-2023-1948 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and...

The vulnerability of Hitachi Energy RTU500 CMU series programmable logic controllers’ web servers allows attackers to perform cross-site scripting attacks.

The vulnerability of the Hitachi Energy RTU500 CMU series programmable logic controllers’ web servers is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted RUNSTATS command. (CVE-2023-40687)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted RUNSTATS command on an 8TB or larger table. Vulnerability Details CVEID:CVE-2023-40687 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially...

Fedora 38 : unrealircd (2023-239f057b33)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-239f057b33 advisory. UnrealIRCd 6.1.3 The main focus of this release is adding countermeasures against large scale spam/drones. Upstream does this by offering a central API which...

Improper Authentication

bluez is vulnerable to Improper authentication. The vulnerability due to permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. It leads to allow an attacker get access to inject a malicious message...

Security Bulletin: WebSphere Application Server Liberty is vulnerable to denial of service (CVE-2023-38737)

Summary IBM Spectrum Protect for Workstations Central Administration Console requires the dependent product IBM WebSphere Application Server Liberty. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. Refer to t...

Slackware Linux 15.0 / current bluez Vulnerability (SSA:2023-348-01)

The version of bluez installed on the remote host is prior to 5.71. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-348-01 advisory. - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connectio...

CVE-2023-47579

Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system...

CVE-2023-47579

Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system...

PT-2023-30514 · Relyum · Rely-Pcie

Name of the Vulnerable Software and Affected Versions: Relyum RELY-PCIe version 22.2.1 Description: The issue is related to a system group misconfiguration in Relyum RELY-PCIe devices, which allows read access to the central password hash file of the operating system. Recommendations: For Relyum...

PT-2023-7608 · Siemens · Simatic S7-1500 Cpu Family

Name of the Vulnerable Software and Affected Versions: Siemens SIMATIC S7-1500 CPU Family affected versions not specified Description: The issue is related to a use-after-free vulnerability in the software of programmable logic controllers. This could allow a remote attacker to cause a denial of...

Security Bulletin: Vulnerability in Java IBM SDK (CVE-2023-22049) affects Power HMC

Summary Java IBM SDK is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-22049 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attacker to cause low integrity...

CVE-2023-45866

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such...

Security Bulletin: IBM RackSwitch firmware products are affected by a vulnerability in the Kernel (CVE-2020-12464)

Summary IBM RackSwitch firmware products have addressed the following Kernel vulnerability. Vulnerability Details CVEID: CVE-2020-12464 DESCRIPTION: Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the usbsgcancel function in...

Security Bulletin: IBM Flex System switch firmware products are affected by a vulnerability in libcurl (CVE-2019-5436)

Summary IBM Flex System switch firmware products have addressed the following vulnerability in libcurl. Vulnerability Details CVEID: CVE-2019-5436 DESCRIPTION: cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftpreceivepacket function. By...

Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in PHP (CVE-2019-6978, CVE-2019-6977)

Summary The following vulnerabilities in PHP have been addressed by IBM Flex System Chassis Management Module CMM. Vulnerability Details CVEID: CVE-2019-6978 DESCRIPTION: The GD Graphics Library aka LibGD 2.2.5 has a double free in the gdImagePtr functions in gdgifout.c, gdjpeg.c, and gdwbmp.c...

Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in Network Time Protocol (NTP)

Summary The following vulnerabilities in Network Time Protocol NTP have been addressed by IBM Flex System Chassis Management Module CMM. Vulnerability Details CVEID: CVE-2020-11868 DESCRIPTION: NTP is vulnerable to a denial of service, caused by a flaw in ntpd. By sending a server mode packet wit...