Security Bulletin: Multiple vulnerabilities affect IBM Sterling External Authentication Server

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server. These vulnerabilities have been addressed in the latest iFix. Vulnerability Details CVEID:CVE-2021-33502 DESCRIPTION: Node.js normalize-url module is vulnerable to a denial of service, caused by a ReDoS regular...

Security Bulletin: IBM Sterling Secure Proxy vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy 6.0.3.0 and are addressed in the latest iFix. Vulnerability Details CVEID:CVE-2022-23437 DESCRIPTION: Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading ...

The vulnerability of the firmware verification process for InHand Networks InRouter302, related to incorrect verification of the cryptographic signature, allows a perpetrator to perform an update of the firmware.

The vulnerability of the firmware verification process for InHand Networks InRouter302 lies in the improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to perform firmware updates through a specially crafted HTTP request...

The vulnerability of Windows operating system-based Cryptographic Services allows attackers to disclose protected information.

The vulnerability of Windows operating system-based Cryptographic Services is related to the exposure of information. Exploiting this vulnerability can allow an attacker to disclose the protected information...

EulerOS Virtualization 3.0.2.2 : libgcrypt (EulerOS-SA-2023-1266)

According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a...

Hardcoded credentials

Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. The credentials are stored in the firmware, encrypted by the crypt function...

CVE-2022-43917

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045...

CVE-2022-43917

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045...

Code injection

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045...

CVE-2022-22462

IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078...

Design/Logic Flaw

IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078...

Researchers Release PoC Exploit for Windows CryptoAPI Bug Discovered by NSA

Proof-of-concept Poc code has been released for a now-patched high-severity security flaw in the Windows CryptoAPI that the U.S. National Security Agency NSA and the U.K. National Cyber Security Centre NCSC reported to Microsoft last year. Tracked as CVE-2022-34689 CVSS score: 7.5, the spoofing...

CVE-2022-22462

CVE-2022-22462 affects IBM Security Verify Governance, Identity Manager virtual appliance component (10.0.1). The issue stems from the use of weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. IBM’s IBM Bulletin confirms the vulne...

CVE-2022-22462 IBM Security Verify Governance, Identity Manager virtual appliance component information disclosure

IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078...

CVE-2022-22462 IBM Security Verify Governance, Identity Manager virtual appliance component information disclosure

IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225078...

CVE-2022-43917

CVE-2022-43917 affects IBM WebSphere Application Server traditional container (versions 8.5 and 9.0). Root cause: use of weaker than expected cryptographic keys in the containerized traditional version, enabling potential information disclosure. Impact per sources: confidentiality may be compromi...

CVE-2022-43917 IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045...

CVE-2022-43917 IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045...

PT-2023-12699 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance, Identity Manager virtual appliance component version 10.0.1 Description: The issue concerns the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive...

PT-2023-14397 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: The issue is related to the use of weaker than expected cryptographic keys in the traditional container of IBM WebSphere Application Server, which could allow an attacker ...