Security Bulletin: IBM i is vulnerable to an attacker executing CL commands due to an exploitation of DDM architecture (CVE-2023-30990)

Summary IBM i is vulnerable to a remote attacker executing CL commands due to an exploitation of DDM architecture as described in the vulnerability details section. IBM i has addressed the vulnerability in the DDM architecture as described in the remediation/fixes section. Vulnerability Details...

i-tools-dc2.net Cross Site Scripting vulnerability OBB-3512677

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-29449

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles Admin and Superadmin. Administrative privileges should be typically granted ...

CVE-2023-29449

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles Admin and Superadmin. Administrative privileges should be typically granted ...

CVE-2023-29449

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles Admin and Superadmin. Administrative privileges should be typically granted ...

Code injection

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles Admin and Superadmin. Administrative privileges should be typically granted ...

i-divadlo.cz Cross Site Scripting vulnerability OBB-3511172

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-29449

CVE-2023-29449 affects Zabbix frontend components related to JavaScript preprocessing, webhooks and global scripts. The issue is described as causing uncontrolled CPU, memory, and disk I/O utilization when these features are configured or tested, with access restricted to Administrative roles (Ad...

A Bootiful Podcast: Spring Framework and Spring Boot legend Stéphane Nicoll on a Bootiful Podcast

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment, Josh Long talk to Spring team legend Stéphane Nicoll @snicoll about Spring Boot, Apache Maven and Gradle, his journey to the Spring team, and so much more. This episode was recorded live from beautiful...

tezuka-i-h.jp Cross Site Scripting vulnerability OBB-3506449

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Unbreakable Enterprise kernel security update

5.4.17-2136.321.4 - tick/common: Align tick period during schedtimer setup Thomas Gleixner Orabug: 35520079 - net/rds: Fix endless rdssendxmit loop if cpindex 0 Gerd Rausch Orabug: 35510149 5.4.17-2136.321.3 - selinux: don't use make's grouped targets feature yet Paul Moore - lib: cpurmap: Fix...

i-sam.co.jp Cross Site Scripting vulnerability OBB-3502005

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

AZL-43816 CVE-2023-34432 affecting package sox 14.4.2.0-34

A heap buffer overflow vulnerability was found in sox, in the lsxreadbuf function at sox/src/formatsi.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure...

CVE-2023-30990

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 254036...

Code injection

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 254036...

CVE-2023-30990

CVE-2023-30990 affects IBM i 7.2–7.5. The flaw allows a remote attacker to execute CL commands as QUSER due to exploitation of the DDM architecture, with impact on confidentiality, integrity, and availability noted in the CVSS metrics. IBM documents that the vulnerability is fixed by applying PTF...

CVE-2023-30990 IBM i command execution

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 254036...

PT-2023-23101

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.5 Description: The issue allows a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. Approximately 856 devices are potentially affected. Recommendations: For IBM i...

Fedora: Security Advisory for sysstat (FEDORA-2023-ac947ec260)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

s-i-l-o.fr Cross Site Scripting vulnerability OBB-3477563

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...