Security Bulletin: IBM Cognos Analytics Cartridge for IBM Cloud Pak for Data 4.7.0 has addressed a security vulnerability (CVE-2023-28953)

Summary A security vulnerability exists in IBM Cognos Analytics Cartridge for IBM Cloud Pak for Data where the security context settings were missing and or configured incorrectly in pod specifications . Security Context has the greatest impact on reducing the attack surface and ignoring the...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

Code injection

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus that stems from the unenforced use of the TLS protocol and the ability of a client to force an option to support a weaker TLS protocol...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

Play With Docker 安全漏洞

Play With Docker is an easy, interactive and fun training ground for learning Docker. A security vulnerability exists in Play With Docker versions prior to 0.0.2 that stems from having an insecure CAPSYSADMIN privilege pattern that causes Docker containers to escape...

CVE-2023-34844

Play With Docker 0.0.2 has an insecure CAPSYSADMIN privileged mode causing the docker container to escape...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to [CVE-2022-23539], [CVE-2022-23540] and [CVE-2022-23541]

Summary Node.js module Auth0 jsonwebtoken is used by IBM App Connect Enterprise Certified Container for generating, parsing and verifying JWTs. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions. This bulletin provides patch information...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to several vulnerabilities in Node.js due to [CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807]

Summary Node.js is used by all IBM App Connect Enterprise Certified Container components as a runtime engine. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, security restriction bypassing, cross-site script attack, cache poisoning, session hijacking,...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to directory traversal due to GHSA-v5gw-mw7f-84px [X-Force 255807]

Summary Python module Starlette is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to directory traversal. This bulletin provides patch information t...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to html injection due to [CVE-2023-24539]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to html injection. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24539 Vulnerability Details CVEID:CVE-2023-24539 DESCRIPTION: Go is vulnerable to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to denial of service due to [CVE-2023-24536]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24536 Vulnerability Details CVEID:CVE-2023-24536 DESCRIPTION: Golang Go is...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to denial of service due to [CVE-2023-24537]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24537 Vulnerability Details CVEID:CVE-2023-24537 DESCRIPTION: Golang Go is...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service due to [CVE-2023-2800]

Summary Hugging Face Transformers is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service. This bulletin provides patch information t...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2023-26920]

Summary Node.js module fast-xml-parser is used by IBM App Connect Enterprise Certified Container for parsing XML data. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator are vulnerable to [CVE-2023-24532]

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to an unspecified error due to an error in the ScalarMult and ScalarBaseMult methods of the P256 Curve in Golang Go. This bulletin provides patch information to address the reported vulnerability in Golang...

Fedora: Security Advisory for kubernetes (FEDORA-2023-c7f63322b5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: A vulnerability in the Oracle Data Provider may affect IBM Robotic Process Automation and result in an attacker gaining elevated privileges (CVE-2023-21893).

Summary Oracle Data Provider is used by IBM Robotic Process Automation as part of SQL Server database connectivity. CVE-2023-21893. Vulnerability Details CVEID:CVE-2023-21893 DESCRIPTION: Oracle Database Server could allow a remote attacker to gain elevated privileges on the system, caused by an...

CVE-2023-22593

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges. IBM X-Force ID: 244074...