PT-2023-9007

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description The issue is related to the restoration of untrusted data in memory in the RMI service of the InfoSphere Information Server platform, which can lead to remote code execution. This allo...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in libcurl (CVE-2022-32221)

Summary A vulnerability in libcurl used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-32221 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security restrictions, caused by a flaw when using the read callback CURLOPTREADFUNCTION to ask for...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to stored cross-site scripting (CVE-2023-28529)

Summary A stored cross-site scripting vulnerability in InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-28529 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Oracle products ( CVE-2020-2934, CVE-2022-21363)

Summary Multiple vulnerabilities in Oracle products used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2020-2934 DESCRIPTION: An unspecified vulnerability in multiple Oracle products could allow an unauthenticated attacker to cause low confidentiality impact, lo...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Hive (CVE-2021-34538)

Summary A vulnerability in Apache Hive used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2021-34538 DESCRIPTION: Apache Hive could allow a remote attacker to bypass security restrictions, caused by improper authorization validation by the CREATE and DROP functio...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Apache Hadoop

Summary Multiple vulnerabilities in Apache Hadoop used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-26612 DESCRIPTION: Apache Hadoop for Windows could allow a remote attacker to bypass security restrictions, caused by the use of an unTarUsingJava function ...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to a code execution vulnerability in Apache Kafka (CVE-2023-25194)

Summary A code execution vulnerability in Apache Kafka used byIBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to a denial of service vulnerability in XNIO (CVE-2022-0084)

Summary A denial of service vulnerability in XNIO used byIBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-0084 DESCRIPTION: XNIO is vulnerable to a denial of service, caused by a flaw in the notifyReadClosed method. By sending specially-crafted requests, a...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in jackson-databind ( CVE-2022-42004, CVE-2022-42003)

Summary Multiple vulnerabilities in jackson-databind used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in in the...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Google Guava (CVE-2018-10237, CVE-2020-8908)

Summary Multiple vulnerabilities in Google Guava used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2018-10237 DESCRIPTION: Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArray and CompoundOrderin...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in d3-color.

Summary A vulnerability in d3-color used by InfoSphere Information Server was addressed. Vulnerability Details IBM X-Force ID: 212233 DESCRIPTION: d3-color is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted string that starts with the letter...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js (CVE-2022-0235,CVE-2020-15168)

Summary Multiple vulnerabilities in Node.js used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-0235 DESCRIPTION: Node.js node-fetch could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when fetching a remote url with...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Spring Security

Summary Multiple vulnerabilities in Spring Security used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-22976 DESCRIPTION: Spring Security could provide weaker than expected security, caused by an integer overflow vulnerability which results in a lack of sal...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Node.js http-cache-semantics module (CVE-2022-25881)

Summary A vulnerability in Node.js http-cache-semantics module used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-25881 DESCRIPTION: Node.js http-cache-semantics module is vulnerable to a denial of service, caused by a regular expression denial of service...

Security Bulletin: IBM InfoSphere Information Server is affected by an information disclosure vulnerability (CVE-2023-24959)

Summary An information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-24959 DESCRIPTION: IBM InfoSphere Information Systems could expose information about the host system and environment configuration. CVSS Base score: 5.3 CVSS...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CVE-2023-23473)

Summary A cross-site request forgery vulnerability in InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-23473 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and...

Security Bulletin: IBM InfoSphere DataStage Flow Designer is affected by an information disclosure vulnerability (CVE-2023-23472)

Summary An information disclosure vulnerability in InfoSphere DataStage Flow Designer was addressed. Vulnerability Details CVEID:CVE-2023-23472 DESCRIPTION: IBM InfoSphere DataStage Flow Designer could allow an authenticated user to obtain sensitive information that could aid in further attacks...

Security Bulletin: IBM InfoSphere Information Server is potentially vulnerable to CSV Injection (CVE-2023-22887)

Summary A CSV Injection vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2023-22887 DESCRIPTION: IBM InfoSphere Information Server is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused ...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to insecure storage of sensitive information (CVE-2023-22878)

Summary A vulnerability due to insecure storage of sensitive information was addressed in InfoSphere Information Server. Vulnerability Details CVEID:CVE-2023-22878 DESCRIPTION: IBM InfoSphere Information Server stores user credentials in plain clear text which can be read by a local user. CVSS Ba...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Kubernetes (CVE-2022-3162, CVE-2022-3294)

Summary Multiple vulnerabilities in Kubernetes used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-3162 DESCRIPTION: Kubernetes kube-apiserver could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization. An...