CVE-2023-30449: Improper Input Validation

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439...

CVE-2023-30448: Improper Input Validation

IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437...

PT-2023-5540

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1 and 11.5 Description The issue is related to insufficient input validation in the database management system, which can be exploited by a remote attacker to cause a...

PT-2023-5543

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1 and 11.5 Description The issue is related to insufficient audit logging and incorrect clearance or release of resources in the database management system. This could...

PT-2023-5542

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.5, 11.1, and 11.5 Description The issue is related to insufficient input validation in the IBM DB2 and DB2 Connect Server, which can be exploited by a remote attacker ...

Security Bulletin: Multiple vulnerabilities in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional have addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-28709 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an incomplete fix for CVE-2023-24998 related to the failure to limit the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects App Connect Professional.

Summary There are multiple vulnerabilities in the IBM SDK Java Technology used by App Connect Professional. These issue were disclosed as part of the IBM Java SDK updates in April 2022, App Connect Professional have addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21426...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects App Connect Professional.

Summary There are multiple vulnerabilities in the IBM SDK Java Technology used by App Connect Professional. These issue were disclosed as part of the IBM Java SDK updates in April 2023, App Connect Professional have addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21930...

Security Bulletin: Multiple vulnerabilities in Apache Tomcat affects App Connect Professional.

Summary App Connect Professional have addressed the following vulnerabilities reported in Apache Tomcat. Vulnerability Details CVEID:CVE-2023-34981 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a flaw when a response did not have any HTTP...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects App Connect Professional.

Summary There are multiple vulnerabilities in the IBM SDK Java Technology used by App Connect Professional. These issue were disclosed as part of the IBM Java SDK updates in Jan 2023, App Connect Professional have addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21830...

Connect-CMS Privilege Escalation Vulnerability

Impact（影響） There is a Privilege Escalation Vulnerability on the management system of Connect-CMS. Affercted Version : Connect-CMS 1.7.1, 2.3.1 and earlier Patches（修正バージョン） version 1.7.2, 2.3.1 Workarounds（運用回避手段） Upgrade Connect-CMS to latest version...

GHSA-QXH3-JGVH-X55J Connect-CMS Privilege Escalation Vulnerability

Impact（影響） There is a Privilege Escalation Vulnerability on the management system of Connect-CMS. Affercted Version : Connect-CMS 1.7.1, 2.3.1 and earlier Patches（修正バージョン） version 1.7.2, 2.3.1 Workarounds（運用回避手段） Upgrade Connect-CMS to latest version...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker and denial of service due to Guava (CVE-2020-8908, CVE-2018-10237).

Summary IBM App Connect Enterprise toolkit and IBM Integration Bus toolkit are vulnerable to a remote attacker and denial of service due to Guava CVE-2020-8908, CVE-2018-10237. The resolving fix includes Guava version =31.1 Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow ...

PT-2023-33055 · Unknown · Connect-Cms

Name of the Vulnerable Software and Affected Versions: Connect-CMS versions 1.7.1 and earlier Connect-CMS versions 2.3.1 and earlier Description: There is a Privilege Escalation issue on the management system of Connect-CMS. Recommendations: For Connect-CMS versions 1.7.1 and earlier, upgrade to...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operand is vulnerable to DOS/loss of integrity/confidentiality [CVE-2023-21930 CVE-2023-21937 CVE-2023-21938 CVE-2023-21939 CVE-2023-21954 CVE-2023-21967 CVE-2023-21968]

Summary OpenJDK Java is used by IBM App Connect Enterprise Certified Container for running code related to mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service, loss of integrity and loss of...

GHSA-3P62-6FJH-3P5H Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers org.keycloak.protocol.saml. Affected versions of this package are vulnerable to Cross-site Scripting XSS. AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a server-side request forgery due to Node.js Request module (CVE-2023-28155).

Summary IBM App Connect Enterprise is vulnerable to a server-side request forgery due to Node.js Request module CVE-2023-28155. Vulnerability Details CVEID:CVE-2023-28155 DESCRIPTION: Node.js Request module is vulnerable to server-side request forgery, caused by a cross-protocol redirect bypass...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to the Angular JS (CVE-2023-26116, CVE-2023-26117, CVE-2023-26118)

Summary The Discovery Connectors in IBM App Connect Enterprise are vulnerable to a denial of service due to the Angular JS CVE-2023-26116, CVE-2023-26117, CVE-2023-26118. The fix removes Angular JS. Vulnerability Details CVEID:CVE-2023-26117 DESCRIPTION: AngularJS is vulnerable to a denial of...

Security Bulletin: Multiple vulnerabilities in IBM SDK Java affect IBM App Connect Enterprise and IBM Integration Bus

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM App Connect Enterprise and IBM Integration Bus. CVE-2022-21426, CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619, CVE-2022-3676, CVE-2023-21930, CVE-2023-21967, CVE-2023-21954, CV2-2023-21939,...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js (CVE-2023-0842)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to the module xml2js CVE-2023-0842. The latest Fix Pack includes xml2js version 5.0 Vulnerability Details CVEID:CVE-2023-0842 DESCRIPTION: xml2js could allow a remote attacker to execute arbitrary...