Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass [CVE-2024-24789]

Summary Golang Go is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operator and operands are vulnerable to security restrictions bypass. This bulletin provides patch information to address the reported vulnerability in Golang Go package...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to priviledge escalation [CVE-2022-43915]

Summary IBM App Connect Enterprise Certified Container operands are vulnerable to privilege escalation due to not limiting the unshare command. This bulletin provides patch information to address the reported vulnerability. CVE-2022-43915 Vulnerability Details CVEID:CVE-2022-43915 DESCRIPTION: IB...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2024-37168] [CVE-2024-34890]

Summary Node.js is used by IBM App Connect Enterprise Certified Container as a runtime engine. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Node.js modules ws and gRPC...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use MQ are vulnerable to denial of service [CVE-2024-25016]

Summary IBM MQ is used by IBM App Connect Enterprise Certified Container for MQ communications and for state storage by Toolkit flows that contain MQ, Aggregation and Collector nodes. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable t...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to denial of service [CVE-2023-45288]

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to denial of service due to a Golang vulnerability. This bulletin provides patch information to address the reported vulnerability in the net/http and x/net/http2 packages. CVE-2023-45288 Vulnerability...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 5.0.19 LTS, 12.0.1 LTS and 12.2.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to arbitrary code execution [CVE-2022-48622] [CVE-2023-23931] [CVE-2024-35195] [CVE-2024-39689]

Summary The IBM App Connect Enterprise Certified Container image that provides the mapping assistance capability to the DesignerAuthoring operand includes several Python based Red Hat packages that contain vulnerabilites. IBM App Connect Enterprise Certified Container DesignerAuthoring operands...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and the IntegrationServer and IntegrationRuntime operands are vulnerable to networking errors [CVE-2024-24790]

Summary IBM App Connect Enterprise Certified Container operator and the IntegrationServer and IntegrationRuntime operands contain Golang binaries that are vulnerable to networking errors. This bulletin provides patch information to address the reported vulnerability. CVE-2024-24790 Vulnerability...

CVE-2024-39746

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the...

CVE-2024-39745

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2024-39744

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-39745

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2024-28658 · Ibm · Ibm Sterling Connect:Direct Web Services

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3 Description: The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to a cross-site request forgery...

IBM Sterling Connect:Direct Web Services 安全漏洞

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, and 6.3 that stems from a failure to properly enable HTTP...

AZL-51847 CVE-2024-43841 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: avoid reporting connection success with wrong SSID When user issues a connection with a different SSID than the one virtwifi has advertised, the cfg80211connectresult will trigger the warning: WARNONbssnotfound. T...

DEBIAN-CVE-2024-43841

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: avoid reporting connection success with wrong SSID When user issues a connection with a different SSID than the one virtwifi has advertised, the cfg80211connectresult will trigger the warning: WARNONbssnotfound. T...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js module ws (CVE-2024-37890)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js module ws. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-37890 DESCRIPTION: Node.js ws module is vulnerable to a denial of service, caused by a NU...

CVE-2024-35152

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. IBM X-Force ID: 292639...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2024:2896-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2896-1 advisory. The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were...