Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Plugin Framework for Java (PF4J)

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Plugin Framework for Java PF4J. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-40828 DESCRIPTION: Plugin Framework for Java PF4J coul...

Linux Distros Unpatched Vulnerability : CVE-2023-40827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter...

org.pf4j:pf4j-spring (0.4.0) potentially affected by CVE-2023-40827 via org.pf4j:pf4j (2.0.0)

org.pf4j:pf4j MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - org.pf4j:pf4j-spring 0.4.0 Source cves: CVE-2023-40827 Source advisory: OSV:GHSA-RVM8-J2CP-J592...

com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40827 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40827 Source advisory:...

com.bitplan.dragtop:com.bitplan.dragtop (>=0.0.1, <=0.0.2), com.bitplan.pdfextractor:com.bitplan.pdfextractor (0.0.1) +4 more potentially affected by CVE-2023-40827 via org.pf4j:pf4j (2.4.0)

org.pf4j:pf4j MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.bitplan.dragtop:com.bitplan.dragtop =0.0.1, =5.0.0, =5.0.0, =1.0.2.release, =1.0.6.release Source cves: CVE-2023-40827 Source...

CVE-2023-40827

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter...

CVE-2023-40827

CVE-2023-40827 concerns the Plugin Framework for Java (PF4J) before 3.9.1, where a remote attacker can abuse the loadpluginPath parameter to obtain sensitive information and execute arbitrary code. Connected docs corroborate: PF4J v3.9.0 and earlier are affected; exploitation involves crafted arc...