Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Rational ClearCase (CVE-2021-20453, CVE-2021-26296, CVE-2020-5016, CVE-2021-20480, CVE-2021-20454, CVE-2020-5258)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Rational ClearCase. Information about security vulnerabilities affecting WAS have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Dojo Toolkit

Summary Multiple vulnerabilities in Dojo Toolkit used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Access Manager for e-business

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Access Manager for e-business. Information about security vulnerabilities affecting IBM WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Vulnerability in Dojo affects WebSphere Application Server (CVE-2020-5258)

Summary There is a vulnerability in the Dojo library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-5258)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server is vulnerability in Dojo affects WebSphere Application Server (CVE-2020-5258)

Summary There is a vulnerability in the Dojo library used by WebSphere Application Server. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, contains a vulnerability in Dojo (CVE-2020-5258)

Summary WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, contains a vulnerability in Dojo CVE-2020-5258 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Affected Products and...

Security Bulletin: Vulnerability in Dojo affects WebSphere Application Server shipped with IBM WebSphere Application Server Patterns (CVE-2020-5258)

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server Patterns. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed i...

Security Bulletin: Vulnerabilities identified in IBM WebSphere Application Server shipped with IBM WebSphere Service Registry and Repository (CVE-2021-20480, CVE-2021-26296 and CVE-2020-5258)

Summary IBM WebSphere Application Server is shipped as a component of IBM WebSphere Service Registry and Repository. Information about security vulnerabilities affecting IBM WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulleti...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Business Monitor (CVE-2020-5258)

Summary IBM WebSphere Application Server is shipped as a component of Business Monitor. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixe...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services is affected by a potential code injection vulnerability (CVE-2020-5268)

Summary The third party Dojo library could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, an attacker could exploit this vulnerability to overwrite, or pollute, a JavaScript application object prototype of the base...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2020-5258)

Summary IBM WebSphere® Application Server is shipped with IBM® Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A Security vulnerability in the IBM Dojo Toolkit affects InfoSphere Big Insights (CVE-2014-8917)

Summary IBM Dojo Toolkit is a component that is used by InfoSphere BigInsights. The IBM Dojo Toolkit that is shipped with InfoSphere BigInsights includes resource files that contain cross-site scripting vulnerability. Vulnerability Details CVEID: CVE-2014-8917 DESCRIPTION: IBM Dojo Toolkit is...

Security Bulletin: Multiple vulnerabilities in dojo may affect IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Summary IBM Business Process Manager and IBM Business Automation Workflow use dojo for some user interface components. Vulnerabilities have been reported for the version in use. Vulnerability Details CVEID: CVE-2019-10785 DESCRIPTION: Dojox is vulnerable to cross-site scripting, caused by imprope...

Security Bulletin: IBM InfoSphere Information Server is affected by an unescaped string injection in Dojo Toolkit

Summary An unescaped string injection vulnerability in Dojo Toolkit that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by...

IBM WebSphere Application Server 8.0.0.x < 8.0.0.11 / 8.5.x < 8.5.5.6 XSS (CVE-2014-8917)

The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.11 or 8.5.0.x prior to 8.5.5.6. It is, therefore, affected by a cross-site scripting vulnerability in the Dojo Toolkits subcomponent due to improper sanitization of user-supplied input. An...

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to using component with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2018-8009 DESCRIPTION: Apache Hadoop could could allow a remote attacker to traverse directories on the system. By persuading a...

Cross-Site Scripting in dojo

Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.2.0 or later...

Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Software Architect and Rational Software Architect for Websphere Software

Summary The dojox/form/resources/fileuploader.swf, dojox/form/resources/uploader.swf, dojox/av/resources/audio.swf, and dojox/av/resources/video.swf files exhibit an cross-site scripting XSS vulnerability. Any web application using the IBM Dojo Toolkit and providing those files might be subject t...

GHSA-39CX-XCWJ-3RC4 Cross-Site Scripting in dojo

Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized. Recommendation Update to version 1.1.0 or later...