Security Bulletin: Vulnerabilities in Golang Go and Linux Kernel may affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Golang Go and Linux Kernel may affect IBM Spectrum Copy Data Management. Vulnerabilities include: denial of service, elevation of privileges, obtaining sensitive information, HTTP request smuggling, and directory traversal. Vulnerability Details CVEID:CVE-2022-32149...

Security Bulletin: IBM QRadar Network Packet Capture includes components with multiple known vulnerabilities.

Summary The product includes multiple vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the relevant CVEs. Vulnerability Details CVEID:CVE-2022-29154 DESCRIPTION: Rsync could allow a remote attacker to bypass security...

Security Bulletin: Vulnerabilities in IBM Java affect IBM FlashSystem models FS900 and V9000

Summary Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition affect the product's management GUI. The Command Line Interface is unaffected. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak Linux kernel is used by IBM Robotic Process Automation for Cloud Pak as part of base container images. CVE-2022-1012, CVE-2022-32250. OpenSSL is used by IBM Robotic Process Automation for Cloud Pak f...

Security Bulletin: IBM InfoSphere Information Server may be affected by vulnerabilities in Apache log4j 1.x version

Summary Apache Log4j 1.x vulnerabilities may impact IBM InfoSphere Information Server which uses Apache Log4j for logging. Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: Apache Log4j could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe...

Security Bulletin: Multiple Vulnerabilities in node.js

Summary Security Vulnerabilities in node.js affect IBM Voice Gateway. Vulnerability Details CVEID:CVE-2022-32214 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to strictly use the CRLF sequence to delimit HTTP requests by the llhttp parser in the http module. ...

Intel® Processors Return Stack Buffer Underflow Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-29901 Description: Non-transparent sharing of branch predictor targets...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Standards Processing Engine and IBM Transformation Extender Advanced (CVE-2015-4872)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 7 and 8, that is used by IBM Standards Processing Engine and IBM Transformation Extender Advanced. This issue was disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-48...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality due to CVE-2022-0536

Summary Node.js module follow-redirects is used by IBM App Connect Enterprise Certified Container operands when making network calls in a Node.js process. IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality. This bulletin provides patch information...

Security Bulletin: Multiple Vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the following fix for IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID: CVE-2021-38561 DESCRIPTION: Golang Go Text is vulnerable to a denial of...

Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2016-2124)

Summary A Samba vulnerability affects IBM Spectrum Scale SMB protocol access method that could cause man-in-the-middle attack . A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2016-2124 DESCRIPTION: Samba SMB1 client is vulnerable to a man-in-the-middle attack, caused ...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center)

Summary A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementati...

Security Bulletin: Financial Transaction Manager is affected by a vulnerability in Apache log4j (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Financial Transaction Manager to provide logging functionality. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to...

Security Bulletin: IBM® Db2® could allow a local user to read and write specific files due to weak file permissions (CVE-2020-4976)

Summary IBM® Db2® could allow a local user to read and write specific files due to weak file permissions Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and wri...

Security Bulletin: IBM Data Replication Java SDK Update

Summary This bulletin covers common Java SDK vulnerability findings in the IBM Java SDK packaged with this offering. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain...

Security Bulletin: Multiple vulnerabilities in Rational DOORS Next Generation with potential for Cross-Site Scripting attack

Summary Multiple vulnerabilities in Rational DOORS Next Generation with potential for Cross-Site Scripting attack. Vulnerability Details CVEID: CVE-2017-1593 DESCRIPTION: IBM DOORS Next Generation DNG/RRC is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20453)

Summary WebSphere Application Server is vulnerable to an XML External Entity XXE Injection vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20453 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a XML External Entity Injection XXE attack when processing...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager Jan 2021 CPU (CVE-2020-27221)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. These issues were disclosed as part of the IBM Java SDK updates in Jan 2021. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerabl...

Security Bulletin: IBM Cloud Private is vulnerable to a Node.js lodash vulnerability (CVEID: 183560)

Summary IBM Cloud Private is vulnerable to a Node.js lodash vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 for the current...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway (CVE-2020-14803, CVE-2020-27221)

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Version 8.0 used by IBM MessageGateway These issues were disclosed as part of the IBM Java SDK updates in January, 2021. Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability in Java SE coul...