Security Bulletin: IBM Data Replication Java SDK Update

Summary This bulletin covers common Java SDK vulnerability findings in the IBM Java SDK packaged with this offering. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JSSE component could allow ...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM StoredIQ for Legal

Summary There are multiple vulnerabilities in IBM Db2 that affect IBM StoredIQ for Legal. These have been addressed in Fix Pack 2.0.3.13 of StoredIQ for Legal Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11...

Security Bulletin: IBM Cloud Private is vulnerable to Go vulnerabilities (CVE-2021-3114, CVE-2021-3115)

Summary IBM Cloud Private is vulnerable to Go vulnerabilities Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector. CVSS Base score: 4 CVSS Temporal Score...

Security Bulletin: IBM Cloud Private is vulnerable to a Python vulnerability (CVE-2020-25659)

Summary IBM Cloud Private is vulnerable to a Python vulnerability Vulnerability Details CVEID: CVE-2020-25659 DESCRIPTION: python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack. By sending a specially-crafted request using the...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2020-28362)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2020-28362 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation by the math/big.Int methods. By sending a specially-crafted inputs, a remote attacker could...

Security Bulletin: IBM Cloud Private is vulnerable to a Java vulnerability (CVE-2020-14782)

Summary IBM Cloud Private is vulnerable to a Java vulnerability Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251)

Summary IBM Cloud Private is vulnerable to Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-8201 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to a MongoDB vulnerability (CVE-2020-7923)

Summary IBM Cloud Private is vulnerable to a MongoDB vulnerability Vulnerability Details CVEID: CVE-2020-7923 DESCRIPTION: MongoDB is vulnerable to a denial of service, caused by a flaw in geoNear invariant. By sending specially crafted queries, a remote authenticated attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2020-16845)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2020-16845 DESCRIPTION: Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted input, a remote...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2020-15586)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2020-15586 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a data race in some net/http servers. By sending specially-crafted HTTP requests, a remote attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to a Node.js lodash vulnerability (CVEID: 183560)

Summary IBM Cloud Private is vulnerable to a Node.js lodash vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 for the current...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - OpenSSL (CVE-2019-1551)

Summary A Security Vulnerability affects IBM Cloud Private Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By...

Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC.

Summary Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC. Vulnerability Details CVEID: CVE-2020-28366 DESCRIPTION: Golang Go could allow a remote attacker to execute arbitrary code on the system, caused by a code injection flaw in go...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2021:0512-1)

This update for java-171-ibm fixes the following issues : Update to Java 7.1 Service Refresh 4 Fix Pack 80 bsc1182186, bsc1181239, CVE-2020-27221, CVE-2020-14803 - CVE-2020-27221: Potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8...

Security Bulletin: IBM Maximo Data Loader (maxloader) shipped with IBM Maximo for Civil Infrastructure is vulnerable to cross-site scripting and missing or insecure "X-XSS-Protection" header

Summary There is missing or insecure "X-XSS-Protection" header in Maximo Data Loader maxloader which is shipped with IBM Maximo for Civil Infrastructure. It may be possible to gather sensitive information about the web application. Vulnerability Details CVEID: CVE-2021-20446 DESCRIPTION: IBM Maxi...

Security Bulletin: IBM Maximo Data Loader (maxloader) shipped with IBM Maximo for Civil Infrastructure is vulnerable to autocomplete HTML Attribute not disabled for password field

Summary There is autocomplete HTML attribute not disabled for password field in Maximo Data Loader maxloader which is shipped with IBM Maximo for Civil Infrastructure. It may be possible to bypass the web application's authentication mechanism. Vulnerability Details CVEID: CVE-2021-20445...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM DataQuant for Workstation (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM DataQuant for Workstation. The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentia...

Security Bulletin: Security vulnerability in Java SE affects Rational Build Forge (CVE-2020-2590)

Summary Java SE that is used by IBM Rational Build Forge has a security vulnerability. IBM Rational Build Forge has addressed the applicable CVE. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Version...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple IBM DB2 Server security vulnerabilities affect IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checkin...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Emptoris Supplier Lifecycle Mgmt

Summary Multiple IBM DB2 Server Security vulnerabilities affect IBM Emptoris Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2020-4701 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by...