Security Bulletin: Apache CXF (Publicly disclosed vulnerability)

Summary CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a U...

Security Bulletin: CVE-2020-14781 (deferred from Oracle Oct 2020 CPU for Java 8)

Summary Under certain circumstances, encrypted LDAP connections can be downgraded to unencrypted connections. The fix ensures that encrypted LDAP connections cannot be downgraded in this way. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related ...

Security Bulletin: XStream (Publicly disclosed vulnerability)

Summary Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a allowlist limited to the minimal...

Security Bulletin: CVE-2020-2773 (deferred from Oracle Apr 2020 CPU)

Summary Two XML Digital Signature APIs implemented in the XMLDSigRI provider throw unexpected Exception types. An attacker could exploit this to inflict a DoS. The fix ensures that all Exceptions thrown from these APIs are wrapped in instances of javax.xml.crypto.MarshalException. Vulnerability...

Security Bulletin: IBM Maximo Asset Management is vulnerable to privilege escalation (CVE-2019-4449)

Summary IBM Maximo Asset Management could allow an authenticated user to escalate their permissions. Vulnerability Details CVEID: CVE-2019-4449 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to escalate their permissions. CVSS Base score: 5 CVSS Temporal Score: See: fo...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server July 2021 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These might affect some configurations of IBM WebSphere Application Server Traditional, IBM WebSphere Application Server Liberty and IBM WebSphere Applicatio...

CVE-2021-29880

IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disclosure between tenants by routing SIEM data to the incorrect domain. IBM X-Force ID: 206979...

IBM QRadar SIEM 信息泄露漏洞

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. An information...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. (CVE-2021-29703)

Summary IBM® Db2® is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. Vulnerability Details CVEID: CVE-2021-29703 DESCRIPTION: Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service...

Security Bulletin: Under special circumstances, Db2 is vulnerable to a denial of service during drop table (CVE-2021-29777)

Summary Under special circumstances, when a table is dropped while being accessed in another session, IBM® Db2® could allow an authenticated user to cause a denial of service Vulnerability Details CVEID: CVE-2021-29777 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server,...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure (CVE-2021-20579)

Summary IBM® Db2® is vulnerable to an information disclosure as it could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTOREVAL is set to DEFFEREDFORCE. Vulnerability Details CVEID: CVE-2021-20579 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise V11 are affected by vulnerabilities in Node.js (CVE-2021-22884, CVE-2021-22883)

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-22884 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by ...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise V11 are affected by vulnerabilities in Node.js (CVE-2021-27290)

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-27290 DESCRIPTION: Node.js ssri module is vulnerable to a denial of service...

CVE-2021-33327

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibilit...

CVE-2021-33328

Cross-site scripting XSS vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the 1...

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset tok...

PT-2021-20103 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.0 and earlier Liferay DXP versions 7.0 before fix pack 96 Liferay DXP versions 7.1 before fix pack 18 Liferay DXP versions 7.2 before fix pack 5 Description: The issue allows remote attackers to change a user's...

PT-2021-20111 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.3.2 Liferay DXP versions 7.2 before fix pack 9 Description: The issue allows access to Cross-origin resource sharing CORS protected resources if the user is only authenticated using the portal session...

Security Bulletin: WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability (CVE-2021-29736)

Summary WebSphere Application Server is vulnerable to a privilege escalation vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-29736 DESCRIPTION: IBM WebSphere Application Server could allow a remote user to gain elevated privileges on the system. CVSS Base score: 5 CV...

Security Bulletin: IBM MQ is vulnerable to an issue within Pacemaker. (CVE-2020-25654)

Summary An issue was identified with Pacemaker which is used by IBM MQ to supply RDQM functionality. Vulnerability Details CVEID: CVE-2020-25654 DESCRIPTION: ClusterLabs Pacemaker could allow a local attacker to bypass security restrictions, caused by an access control list bypass flaw. By sendin...