Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. (CVE-2023-26021)

Summary IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted SQL query using a LIMIT clause. Vulnerability Details CVEID:CVE-2023-26021 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of servic...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2023-27860)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID:CVE-2023-27860 DESCRIPTION: IBM Maximo Asset Management could disclose sensitive information in an error message. This information could be used in further attacks against the system. CVSS Base...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. (CVE-2023-25930)

Summary IBM® Db2® is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. Vulnerability Details CVEID:CVE-2023-25930 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. (CVE-2023-27559)

Summary IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. Vulnerability Details CVEID:CVE-2023-27559 DESCRIPTION: IBM Db2 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. CVSS Base...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a privilege escalation due to RESTEasy (CVE-2023-0482)

Summary There is a vulnerability in the RESTEasy library used by IBM WebSphere Application Server Liberty when the feature restfulWS-3.0 or restfulWS-3.1 is enabled. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-0482 DESCRIPTION: RESTEasy could allow a...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2022-43866)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID:CVE-2022-43866 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary There is a vulnerability in the Apache Commons FileUpload library used by IBM WebSphere Application Server and used by IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. This has been addressed in the...

Security Bulletin: decode-uri-component is vulnerable to CVE-2022-38900 used in IBM Maximo Application Suite

Summary IBM Maximo Application Suite uses decode-uri-component which is vulnerable to CVE-2022-38900. Vulnerability Details CVEID:CVE-2022-38900 DESCRIPTION: decode-uri-component is vulnerable to a denial of service, caused by improper input validation by the decodeComponents function. By sending...

Security Bulletin: Node.js passport is vulnerable to CVE-2022-25896 used in IBM Maximo Application Suite

Summary There is one vulnerability in passport-0.4.1.tgz used by IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2022-25896 DESCRIPTION: Node.js passport module could allow a remote attacker to hijack a user's session, caused by a session fixation vulnerability. An attacker could...

Security Bulletin: IBM HTTP Server is vulnerable to HTTP request splitting due to the included Apache HTTP Server (CVE-2023-25690)

Summary IBM HTTP Server used by IBM WebSphere Application Server is vulnerable to HTTP request splitting when using modproxy or the Web Server Plug-in due to the included Apache HTTP Server. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-25690 DESCRIPTION...

Security Bulletin: Security vulnerability in IBM Financial Transaction Manager for SWIFT Service

Summary Cross-site scripting vulnerability in IBM Financial Transaction Manager for SWIFT Services Vulnerability Details CVEID:CVE-2022-43871 DESCRIPTION: IBM Financial Transaction Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting in the Admin Console (CVE-2023-26283)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting in the Admin Console CVE-2023-26283 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Maximo Application Suite is vulnerable to CVE-2022-40897 per setuptools dependency

Summary There is one vulnerability in setuptools-65.3.0-py3-none-any.whl used by IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2022-40897 DESCRIPTION: Pypa Setuptools is vulnerable to a denial of service, caused by improper input validation. By sending request with a specially...

Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting in the Admin Console (CVE-2023-26283)

Summary IBM WebSphere Application Server is vulnerable to cross-site scripting in the Admin Console. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-26283 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerabili...

Security Bulletin: Maximo Application Suite is vulnerable to CVE-2022-42003 and CVE-2022-42004 per jackson-databind dependency

Summary There are two vulnerabilities in jackson-databind used by IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in the primitive value deserializers when the...

Security Bulletin: WebSphere Application Server traditional is vulnerable to a remote code execution vulnerability

Summary WebSphere Application Server, used by IBM Tivoli Network Manager ITNM IP Edition, is vulnerable to a remote code execution vulnerability. Vulnerability Details CVEID:CVE-2023-23477 DESCRIPTION: IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execu...

Security Bulletin: Vulnerabilities found within Java collectors used by IBM Tivoli Network Manager (ITNM) IP Edition.

Summary Vulnerabilities found within Java collectors CVE-2016-5725, CVE-2022-2048, CVE-2022-2047 used by IBM Tivoli Network Manager ITNM IP Edition. Vulnerability Details CVEID:CVE-2016-5725 DESCRIPTION: JSch could allow a remote attacker to traverse directories on the system. An attacker could...

Security Bulletin: Vulnerability in Apache Commons FileUpload library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-24998)

Summary Fix is available for vulnerability in Apache Commons FileUpload library affecting Tivoli Netcool/OMNIbus WebGUI CVE-2023-24998. Apache Commons FileUpload is used by Tivoli Netcool/OMNIbus WebGUI to facilitate file upload in Map Resources admin page. The fix includes Apache Commons...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability due to an error within the CCDT and channel synchronization logic (CVE-2022-40237)

Summary An issue was identifed within the MQ channel processing when a channel CCDT file contains invalid or corrupted records. Vulnerability Details CVEID:CVE-2022-40237 DESCRIPTION: IBM MQ is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization...

Security Bulletin: IBM MQ is affected by issues in IBM WebSphere Application Server Liberty (CVE-2022-3509, CVE-2022-3171)

Summary Issues were identified in IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality. Vulnerability Details CVEID:CVE-2022-3509 DESCRIPTION: protobuf-java core and lite are vulnerable to a denial of service, caused by a...