Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Business Service Manager (CVE-2020-5258)

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Business Service Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server terminates abnormally when executing a specifically crafted select statement. (CVE-2021-29702)

Summary IBM® Db2® is vulnerable to a denial of service as the server terminates abnormally when executing a specifically crafted select statement. Vulnerability Details CVEID: CVE-2021-29702 DESCRIPTION: Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of...

Security Bulletin: IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2020-1968)

Summary IBM MQ Appliance has resolved and OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections...

Security Bulletin: WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability (CVE-2021-29754)

Summary WebSphere Application Server is vulnerable to a privilege escalation vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-29754 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trus...

Cross site scripting

Cross-site scripting XSS vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter...

PT-2021-18047

Name of the Vulnerable Software and Affected Versions: Liferay DXP versions 7.0 through 7.0 before fix pack 99 Liferay DXP versions 7.1 through 7.1 before fix pack 23 Liferay DXP versions 7.2 through 7.2 before fix pack 12 Liferay DXP versions 7.3 through 7.3 before fix pack 1 Description: A...

SUSE: Security Advisory (SUSE-SU-2018:3920-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2018:3921-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:14588-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM DataPower Gateway is affected by a vulnerability (CVE-2018-1665)

Summary IBM DataPower Gateway has addressed the following vulnerability: CVE-2018-1665 Vulnerability Details CVEID: CVE-2018-1665 DESCRIPTION: IBM DataPower Gateways uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base...

Security Bulletin: IBM DataPower Gateway is affected by vulnerabilities in OpenSSL

Summary IBM DataPower Gateway has addressed the following vulnerabilities: CVE-2018-0734 CVE-2018-5407 Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature...

Security Bulletin: WebSphere Application Server ND is vulnerable to Directory Traversal vulnerability (CVE-2021-20517)

Summary WebSphere Application Server ND is vulnerable to a directory traversal vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20517 DESCRIPTION: IBM WebSphere Application Server Network Deployment could allow a remote authenticated attacker to traverse directories. ...

Security Bulletin: IBM MQ Appliance is affected by a Java SE vulnerability (CVE-2020-14781)

Summary IBM MQ Appliance has resolved a Java SE vulnerability. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality...

Security Bulletin: IBM MQ is vulnerable to an issue in IBM® Runtime Environment Java™ Technology Edition. (CVE-2020-14779)

Summary An issue was identified within IBM® Runtime Environment Java™ Technology Edition that is shipped with and used by IBM MQ. Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated...

PT-2021-18042

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.3.5 Liferay DXP 7.0 before fix pack 97 Liferay DXP 7.1 before fix pack 21 Liferay DXP 7.2 before fix pack 10 Liferay DXP 7.3 before fix pack 1 Description: A cross-site scripting XSS issue exists in the...

Security Bulletin: Multiple Vulnerabilities in Apache HttpComponents and HttpCommons affect WebSphere Application Server

Summary There are multiple vulnerabilities in Apache HttpComponents and HttpCommons libraries which affect WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Commons Codec

Summary A vulnerability in Apache Commons Codec that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details Third Party Entry: 177835 DESCRIPTION: Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of...

Security Bulletin: Information disclosure vulnerability may affect IBM Robotic Process Automation Anywher - CVE-2020-4901

Summary IBM Robotic Process Automation Anywhere is vulnerable to an information disclosure attack Vulnerability Details CVEID: CVE-2020-4901 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow an attacker on the network to obtain sensitive information or cause a denia...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise V11 are affected by vulnerabilities in Node.js (CVE-2020-28500)

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise V11 are affected by vulnerabilities in Node.js (CVE-2020-8265)

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-8265 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a...