Security Bulletin: WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, contains a vulnerability in Apache MyFaces (CVE-2021-26296)

Summary WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, contains a vulnerability in Apache MyFaces CVE-2021-26296 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Affected...

Security Bulletin: WebSphere Application Server, which is a component of IBM Cloud Pak for Aplications, is vulnerable to a Directory Traversal vulnerability (CVE-2020-5016)

Summary WebSphere Application Server is shipped as a component of IBM Cloud Pak for Applications. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Vulnerabilities in Java affects IBM Cloud Application Business Insights

Summary Vulnerabilities in Java affects IBM Cloud Application Business Insights Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using...

Security Bulletin: CVE-2020-14782 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-14782 was disclosed as part of the Oracle October 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020 - Includes Oracle Oct 2020 CPU minus CVE-2020-14781 and CVE-2020-14782 affects Liberty for Java for IBM Cloud

Summary Multiple vulnerabilities in IBM® Java SDK affect Liberty for Java October 2020 CPU. Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service...

Security Bulletin: CVE-2020-2773 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-2773 was disclosed as part of the Oracle April 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a denial of servic...

Security Bulletin: CVE-2020-14781 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2020-14781 was disclosed as part of the Oracle October 2020 Critical Patch Update. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information...

Security Bulletin: Vulnerability in Apache MyFaces affects WebSphere Application Server in IBM Cloud (CVE-2021-26296)

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server in IBM Cloud. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins list...

Security Bulletin: WebSphere Application Server in IBM Cloud is vulnerable to a Server-side Request Forgery vulnerability (CVE-2021-20480)

Summary WebSphere Application Server is shipped as a component of IBM WebSphere Application Server in IBM Cloud. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins list...

Security Bulletin: Multiple Vulnerabilities in Windows Server supporting products bundled with Cloud Pak Systems

Summary Multiple Vulnerabilities identified in MS Windows Server platforms. Information about vulnerabilities has been published in the provider security update guide. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Main...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Thrift

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Thrift. Vulnerability Details CVEID: CVE-2020-13949 DESCRIPTION: Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote...

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Summary IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.6.15 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.6.15 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.6.15 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates. Vulnerability Details CVEID:...

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Summary IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overly long argument, an attacker could...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2017-16086 Vulnerability Details CVEID: CVE-2017-16086 DESCRIPTION: Node.js ua-parser module is vulnerable to a denial of service. By sending a specially crafted UserAgent header, a remote attacker could exploit this...

IBM Cloud Pak for Automation XML External Entity Injection Vulnerability

IBM Cloud Pak for Automation is an enterprise container cloud intelligence automation software platform that supports business users in building and running automation applications using containers on Kubernetes. An XML external entity injection vulnerability exists in IBM Cloud Pak for Automatio...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2020-15168 Vulnerability Details CVEID: CVE-2020-15168 DESCRIPTION: Node.js node-fetch module is vulnerable to a denial of service, caused by the failure to honor the size option after following a redirect. By using ...