Security Bulletin: Vulnerability in systemd affects Power Hardware Management Console (CVE-2019-6454)

Summary systemd is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE Vulnerability Details CVEID: CVE-2019-6454 DESCRIPTION: The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides...

Security Bulletin: Vulnerability in kernel affects Power Hardware Management Console (CVE-2018-14633)

Summary Power Hardware Management Console is affected by security vulnerabilities in the Linux Kernel. Power Hardware Management Console has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-14633 DESCRIPTION: A security flaw was found in the chapservercomputemd5 function in the...

Security Bulletin: Vulnerabilities in OpenSSL affect Power Hardware Management Console (CVE-2017-3737, CVE-2017-3736)

Summary OpenSSL is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-3737 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by a flaw in the "error state" mechanism when directly...

Security Bulletin: Vulnerabilities in NTP affect Power Hardware Management Console (CVE-2017-6464, CVE-2017-6463)

Summary NTP is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-6464 DESCRIPTION: NTP is vulnerable to a denial of service. A remote authenticated attacker could exploit this vulnerability using a malformed mode configurati...

Security Bulletin: Vulnerabilities in Kerberos affect Power Hardware Management Console (CVE-2017-11368, CVE-2017-7562)

Summary Kerberos is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-11368 DESCRIPTION: MIT Kerberos 5 is vulnerable to a denial of service, caused by a KDC assertion failure. By sending a specially-crafted request, a remot...

Security Bulletin: Vulnerability in GnuTLS affects Power Hardware Management Console ( CVE-2018-10845 CVE-2018-10844)

Summary It was found that GnuTLS's implementation of HMAC-SHA-384 and HMAC-SHA-256 was vulnerable to a Lucky Thirteen-style attack. A remote attacker could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets...

Security Bulletin: Vulnerability in Kernel affects Power Hardware Management Console (CVE-2018-5391)

Summary Linux Kernel is vulnerable to a denial of service, caused by the improper handling of the reassembly of fragmented IPv4 and IPv6 packets by the IP implementation. By sending specially crafted IP fragments with random offsets, a remote attacker could exploit this vulnerability to exhaust a...

Security Bulletin: Information Disclosure Vulnerabilities Affect IBM Sterling B2B File Gateway User Interface (CVE-2021-20485, CVE-2021-20563)

Summary IBM Sterling B2B File Gateway has addressed the security vulnerabilities. Vulnerability Details CVEID: CVE-2021-20485 DESCRIPTION: IBM Sterling File Gateway could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th...

Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms

Summary IBM TXSeries for Multiplatforms has addressed the following vulnerability reported by IBM® Runtime Environment Java™ Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker t...

Security Bulletin: A vulnerability in Bouncy Castle affect IBM Watson Machine Learning Accelerator

Summary A vulnerability exists in the Bouncy Castle version used by IBM Watson Machine Learning Accelerator. Bouncy Castle upgrade to version 1.69 which resolves these vulnerabilities, is available on IBM Fix Central. Vulnerability Details CVEID: CVE-2020-15522 DESCRIPTION: Bouncy Castle BC Java,...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11, V12 (CVE-2021-2161)

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition, used by IBM Integration Bus & IBM App Connect Enterprise v11, V12. These issues were disclosed as part of the IBM Java SDK updates in April 2021 Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Ja...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2021-29744)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2021-29744 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2021-3712)

Summary Security vulnerability have been disclosed on 24th August 2021 by the OpenSSL Project. OpenSSl is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTION: OpenSSL could...

Security Bulletin: A Vulnerability in IBM Java Runtime Affects IBM Sterling Connect:Direct FTP+

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 8.0.6.15 and 8.0.5.35, used by IBM Sterling Connect:Direct FTP+ on AIX, Linux, Solaris, Windows, and HP-UX platforms. IBM Sterling Connect:Direct FTP+ has addressed the applicable CVE. Vulnerability Details CVEID:...

Security Bulletin: Vulnerabilities in IBM Java Runtime Affect IBM Sterling Secure Proxy (CVE-2020-27221, CVE-2020-14782)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling Secure Proxy. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a stack-based buffer...

Security Bulletin: vulnerabilities in Nginx affect IBM Watson Machine Learning Accelerator 2.3.1

Summary Vulnerabilities existing in the Nginx version used by IBM Watson Machine Learning Accelerator 2.3.1. nginx upgraded to version 1.20.1 which resolves these vulnerabilities, are available on IBM Fix Central. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fix...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11, v12 (CVE-2020-27221)

Summary Vulnerabilities in IBM® SDK Java™ Technology ,used by IBM Integration Bus & IBM App Connect Enterprise v11, v12. These issues were disclosed as part of the IBM Java SDK updates in January 2021. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a...

Security Bulletin: Castor Vulnerability Affects IBM Control Center (CVE-2014-3004)

Summary Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2014-3004 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information...

Security Bulletin: Vulnerability in SSLv3 affects IBM InfoSphere Optim Performance Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM InfoSphere Optim Performance Manager OPM. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: IBM InfoSphere Optim Performance Manager...

Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by security vulnerabilities (CVE-2015-4974, CVE-2015-4981)

Summary Security vulnerabilities have been identified in the current levels of IBM Spectrum Scale V4.1.1, IBM GPFS V4.1 and V3.5: - could allow a local non privileged attacker to execute commands with root privileges CVE-2015-4974 - could allow a local non privileged attacker to read system...