Security Bulletin: A security vulnerability has been identified in OpenSSL in IBM® AIX® shipped with IBM PureData System for Operational Analytics ( CVE-2022-1292)

Summary IBM® AIX® is shipped as a component of IBM PureData System for Operational Analytics. Information about the security vulnerability in OpenSSL affecting IBM AIX has been published in a security bulletin CVE-2022-1292. Vulnerability Details CVEID:CVE-2022-1292 DESCRIPTION: OpenSSL could all...

Security Bulletin: IBM MQ Blockchain bridge is vulnerable to an issue identified in snakeyaml (CVE-2022-41854)

Summary An issue was identified with the snakeyaml package that is used by the fabric gateway package that is used by the IBM MQ Blockchain bridge package to provide Blockchain functionality in IBM MQ. Vulnerability Details CVEID:CVE-2022-41854 DESCRIPTION: snakeYAML is vulnerable to a denial of...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to the ua-parser-js module (CVE-2022-25927)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to the ua-parser-js module in the electron app CVE-2022-25927. Electron is used for Discovery Connectors in IBM App Connect Enterprise. The latest fixpack includes ua-parser-js =v1.0.33 Vulnerability Details...

Security Bulletin: IBM MQ Appliance is vulnerable to an unspecified Java SE vulnerability (CVE-2022-21626)

Summary IBM MQ Appliance has resolved a Java SE vulnerability. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability...

Security Bulletin: TADDM is vulnerable to a denial of service vulnerability in Apache-Log4j (CVE-2023-26464)

Summary Apache-Log4j version 1 is used by IBM Tivoli Application Dependency Discovery Manager and is vulnerable to CVE-2023-26464. Vulnerability Details CVEID:CVE-2023-26464 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by a flaw when using the Chainsaw or SocketAppender...

Security Bulletin: IBM MQ Appliance is vulnerable to cross-site scripting (CVE-2022-32750)

Summary IBM MQ Appliance has resolved a cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2022-32750 DESCRIPTION: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This...

Security Bulletin: Multiple vulnerabilities in the Expat library affect IBM® Db2® Net Search Extender may lead to denial of service or arbitrary code execution.

Summary Multiple vulnerabilities in the Expat library affect IBM® Db2® Net Search Extender may lead to denial of service or arbitrary code execution. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-43680 DESCRIPTION: libexpat is vulnerable to a denial of service,...

Security Bulletin: IBM MQ Blockchain bridge is vulnerable to an issue identified in snakeyaml (CVE-2022-25857)

Summary An issue was identified with the snakeyaml package that is used by the fabric gateway package that is used by the IBM MQ Blockchain bridge package to provide Blockchain functionality in IBM MQ. Vulnerability Details CVEID:CVE-2022-25857 DESCRIPTION: Java package org.yaml:snakeyam is...

Security Bulletin: TADDM affected by multiple vulnerabilities due to IBM Java and its runtime

Summary IBM Tivoli Application Dependency Discovery Manager is vulnerable to denial of service due to use of IBM Java and runtimes CVE-2009-3852, CVE-2011-0311 Vulnerability Details CVEID:CVE-2009-3852 DESCRIPTION: An unspecified error in the IBM Runtimes for Java Technology related to the parsin...

Security Bulletin: IBM MQ could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. (CVE-2022-31772)

Summary IBM MQ could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. Vulnerability Details CVEID:CVE-2022-31772 DESCRIPTION: IBM MQ could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. CVSS Base score: 5....

Security Bulletin: TADDM affected by multiple vulnerabilities due to JRuby and Hyperic HQ

Summary IBM Tivoli Application Dependency Discovery Manager is vulnerable to denial of service due to use of JRuby CVE-2011-4838 and cross site scripting due to use of Hyperic HQ CVE-2009-2907, CVE-2009-2899 Vulnerability Details CVEID:CVE-2009-2907 DESCRIPTION: Hyperic HQ is vulnerable to...

Security Bulletin: An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Version 8 supplied by IBM MQ (CVE-2021-2163)

Summary An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Versions 7 and 8 supplied by IBM MQ versions. The IBM® Runtime Environment Java™ Technology Edition, Version 8 is used for Java Client, JMS Client, AMQP, MQTT, Blockchain Bridge, Salesforce Bridge, Java AMS, M...

Security Bulletin: IBM MQ Appliance is vulnerable to cross-site request forgery (CVE-2022-31773)

Summary IBM MQ Appliance has resolved a cross-site request forgery vulnerability. Vulnerability Details CVEID:CVE-2022-31773 DESCRIPTION: IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz...

Security Bulletin: TADDM affected by vulnerabilities in UnZip.

Summary UnZip.exe is used by IBM Tivoli Application Dependency Discovery Manager and is vulnerable to CVE-2021-4217, CVE-2022-0529, CVE-2022-0530 Publicly disclosed vulnerabilities Vulnerability Details CVEID:CVE-2021-4217 DESCRIPTION: Info-ZIP UnZip could allow a remote attacker to execute...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affects IBM Cloud Application Business Insights CVE-2021-39031

Summary Vulnerabilities in IBM WebSphere Application Server Liberty affects IBM Cloud Application Business Insights CVE-2021-39031 Vulnerability Details CVEID:CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attack...

Security Bulletin: Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights

Summary Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights Vulnerability Details CVEID:CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting i...

Security Bulletin: IBM MQ Blockchain bridge dependencies are vulnerable to issues in SnakeYAML (CVE-2022-38749, CVE-2022-38750, CVE-2022-38751 & CVE-2022-38752)

Summary A denial of service issue was identified within SnakeYAML that is used by Fabric Gateway. Fabric Gateway is used by the IBM MQ blockchain bridge component of IBM MQ to provide connection capability between IBM MQ queue managers and Hyperledger Fabric. Vulnerability Details...

Security Bulletin: TADDM log4j vulnerable to CVE-2021-4104 (Publicly disclosed vulnerability)

Summary Apache log4j version 1 is vulnerable to CVE-2021-4104 Publicly disclosed vulnerability used by IBM Tivoli Application Dependency Discovery Manager Vulnerability Details CVEID:CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: IBM MQ Internet Pass-Thru traces sensitive data (CVE-2022-35719)

Summary An issue was found within IBM MQ Internet Pass-Thru which causes sensitive data to be written to trace files when trace is enabled. Vulnerability Details CVEID:CVE-2022-35719 DESCRIPTION: IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace...

Security Bulletin: Python (Publicly disclosed vulnerability) in IBM Tivoli Application Dependency Discovery Manager (CVE-2022-0391)

Summary A Publicly disclosed vulnerability in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager CVE-2022-0391 Vulnerability Details CVEID:CVE-2022-0391 DESCRIPTION: Python could provide weaker than expected security, cause by a improper input validation by the...