Security Bulletin: Enterprise Content Manager System Monitor For March 2024 - Multiple CVE adressed

Summary Enterprise Content Manager System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

Security Bulletin: Improper Restriction of XML External Entity Reference in liquibase prior to 4.8.0 Affects IBM Partner Engagement Manager (CVE-2022-0839)

Summary IBM Sterling Partner Engagement Manager uses Liquibase that is vulnerable to XML external entity processing, caused by improper validation of user-supplied input by the XMLChangeLogSAXParser function. A remote attacker could exploit this vulnerability to input a malicious XML reference to...

au.net.causal.shoelaces:shoelaces-liquibase (2.0), au.net.causal.shoelaces:shoelaces-liquibase-integration-tests-common (2.0) +319 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.6.3)

org.liquibase:liquibase-core MAVEN version 3.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - au.net.causal.shoelaces:shoelaces-liquibase 2.0 -...

be.yildiz-games:module-database (2.0.6), be.yildiz-games:module-database-derby (1.0.6) +174 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.0)

org.liquibase:liquibase-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database 2.0.6 - be.yildiz-games:module-database-derby 1.0.6 -...

org.infrastructurebuilder.data:ibdata-avrotosql (0.3.4), org.infrastructurebuilder.data:ibdata-database-dialect-base (0.3.4) +11 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.3)

org.liquibase:liquibase-core MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.infrastructurebuilder.data:ibdata-avrotosql 0.3.4 -...

com.atlassian.connect:atlassian-connect-spring-boot-jpa-starter (2.0.4), com.hack23.cia:service.data.impl (2020.1.14) +35 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.5)

org.liquibase:liquibase-core MAVEN version 3.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-jpa-starter 2.0.4 - com.hack23.cia:service.data.imp...

be.yildiz-games:module-database-updater (1.0.1), com.atlassian.connect:atlassian-connect-spring-boot-jpa-starter (>=2.0.5, <=2.0.6) +19 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.8)

org.liquibase:liquibase-core MAVEN version 3.8.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database-updater 1.0.1 -...

au.net.causal.shoelaces:shoelaces-liquibase (2.1.1), cn.nkpro.elcube:bigdata (2.0) +147 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.9)

org.liquibase:liquibase-core MAVEN version 3.8.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - au.net.causal.shoelaces:shoelaces-liquibase 2.1.1 - cn.nkpro.elcube:bigdata 2.0 -...

be.yildiz-games:module-database-updater (1.0.2), com.codeborne.replay:liquibase (1.7) +32 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.9.0)

org.liquibase:liquibase-core MAVEN version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database-updater 1.0.2 - com.codeborne.replay:liquibase 1.7 -...

cn.ibizlab.plugin:ibiz-plugin-centralstudio-core (>=8.1.0.286, <=8.1.0.567.22), cn.ibizlab.plugin:ibiz-plugin-centralstudio-freemarker (>=8.1.0.286, <=8.1.0.567.22) +86 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.10.3)

org.liquibase:liquibase-core MAVEN version 3.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - cn.ibizlab.plugin:ibiz-plugin-centralstudio-core =8.1.0.286, =8.1.0.286, =8.1.0.286, =8.1.0.286,...

africa.absa:inception-application (>=1.0.0, <=1.2.0), africa.absa:inception-test (>=1.0.0, <=1.2.0) +507 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (>=4.0.0-beta1, <=4.7.1)

org.liquibase:liquibase-core MAVEN version =4.0.0-beta1, =1.0.0, =1.0.0, =2.0.1, =1.0.4, =1.0, =1.3.29.8, =1.3.30, =1.0.35, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.2.4, =2.0.1, =2.2.8 and more Source cves: CVE-2022-0839 Source advisory: OSV:GHSA-JVFV-HRRC-6Q72...

com.edugility:liquibase-extensions (1.0.4), com.edugility:liquiunit (1.0.6) +81 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.4.1)

org.liquibase:liquibase-core MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.edugility:liquibase-extensions 1.0.4 - com.edugility:liquiunit 1.0.6 - com.edugility:maven-liquibas...

com.hack23.cia:service.data.impl (2019.7.23), com.hack23.cia:service.impl (2019.7.23) +26 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.7.0)

org.liquibase:liquibase-core MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.hack23.cia:service.data.impl 2019.7.23 - com.hack23.cia:service.impl 2019.7.23 -...

com.github.evantill:liquibase-utils (>=0.0.3, <=0.2.0), com.konnectkode:quarkus-liquibase (1.0.0.cr2) +16 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.1)

org.liquibase:liquibase-core MAVEN version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.github.evantill:liquibase-utils =0.0.3, =3.5.30, =3.5.30, =3.10.15, =3.5.30, =3.5.30, =3.5.30,...

com.hack23.cia:service.data.impl (2019.12.21), com.hack23.cia:service.impl (2019.12.21) +13 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.4)

org.liquibase:liquibase-core MAVEN version 3.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - com.hack23.cia:service.data.impl 2019.12.21 - com.hack23.cia:service.impl 2019.12.21 -...

be.yildiz-games:module-database-updater (1.0.0), com.github.vzakharchenko:dynamic-orm-core (>=1.1.1, <=1.2.2) +50 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.8.7)

org.liquibase:liquibase-core MAVEN version 3.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database-updater 1.0.0 - com.github.vzakharchenko:dynamic-orm-core =1.1.1, =1.1....

be.yildiz-games:module-database-updater (1.0.3), com.github.adangel.liquibase.ext:liquibase-percona (1.7.0) +36 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (3.10.1)

org.liquibase:liquibase-core MAVEN version 3.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - be.yildiz-games:module-database-updater 1.0.3 - com.github.adangel.liquibase.ext:liquibase-percona 1.7...

africa.absa:inception-application (>=1.0.0, <=1.2.0), africa.absa:inception-test (>=1.0.0, <=1.2.0) +507 more potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (>=4.0.0-beta1, <=4.7.1)

org.liquibase:liquibase-core MAVEN version =4.0.0-beta1, =1.0.0, =1.0.0, =2.0.1, =1.0.4, =1.0, =1.3.29.8, =1.3.30, =1.0.35, =2.0.1, =2.0.1, =2.0.1, =2.0.1, =2.2.4, =2.0.1, =2.2.8 and more Source cves: CVE-2022-0839 Source advisory: GHSA-JVFV-HRRC-6Q72...

org.liquibase:liquibase-plugin (1.9.4.0) potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (1.9.4)

org.liquibase:liquibase-core MAVEN version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase:liquibase-plugin 1.9.4.0 Source cves: CVE-2022-0839 Source advisory: OSV:GHSA-JVFV-HRRC-6...

org.liquibase:liquibase-plugin (1.8.1.0) potentially affected by CVE-2022-0839 via org.liquibase:liquibase-core (1.8.1)

org.liquibase:liquibase-core MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.liquibase:liquibase-core and may be impacted: - org.liquibase:liquibase-plugin 1.8.1.0 Source cves: CVE-2022-0839 Source advisory: OSV:GHSA-JVFV-HRRC-6...