Security Bulletin: IBM Robotic Process Automation for Cloud Pak may be vulnerable to a denial of service due to ISC BIND (CVE-2022-38177, CVE-2022-38178).

Summary ISC BIND is used by IBM Robotic Process Automation for Cloud Pak as part of it's Antivirus and Watson NLP container images. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2022-38177 DESCRIPTION: ISC BIND is vulnerable to...

Security Bulletin: A vulnerability exists in IBM Robotic Process Automation where Queue Provider credentials are not obfuscated during editing (CVE-2023-25680)

Summary There is a vulnerability in IBM Robotic Process Automation where Queue Provider credentials are not obfuscated while editing. CVE-2023-25680. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2023-25680 DESCRIPTION: IBM...

Security Bulletin: IBM Robotic Process Automation is vulnerable to session tokens not being invalidated after password reset.

Summary IBM Robotic Process Automation session tokes are not invalidated after a password reset. IBM X-Force ID: 243710. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details IBM X-Force ID: 243710 DESCRIPTION: IBM Robotic Process Automation cou...

Security Bulletin: IBM Robotic Process Automation is vulnerable to Cross-Site Scripting.

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerabili...

libdwarf:fuzz_set_frame_all: Segv on unknown address in _dwarf_exec_frame_instr

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=5081006119190528 Project: libdwarf Fuzzing Engine: honggfuzz Fuzz Target: fuzzsetframeall Job Type: honggfuzzasanlibdwarf Platform Id: linux Crash Type: Segv on unknown address Crash Address:...

PT-2023-19301

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.3.7 Description The issue occurs when a payload is inserted inside a label name or instruction of an entry type, resulting in a cross-site scripting XSS attack in the quick post widget on the admin dashboard...

USN-5870-1: apr-util vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description Ronald Crane discovered that APR-util did not properly handled memory when encoding or decoding certain input data. An attacker could possibly use this issue ...

USN-5825-1: PAM vulnerability | Cloud Foundry

Severity Negligible Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that PAM did not correctly restrict login from an IP address that is not resolvable via DNS. An attacker could possibly use this issue t...

USN-5828-1: Kerberos vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that Kerberos incorrectly handled certain S4U2Self requests. An attacker could possibly use this issue to cause a denial of service. This...

CVE-2023-0868

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are...

Cross site scripting

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state th...

Cross site scripting

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are...

CVE-2023-0815 Plaintext Password Present in the Web logs

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizo...

CVE-2023-0815 Plaintext Password Present in the Web logs

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizo...

CVE-2023-0815 Plaintext Password Present in the Web logs

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizo...

CVE-2023-0867 Multiple stored and reflected Cross-site Scripting in webapp

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horiz...

CVE-2023-0867 Multiple stored and reflected Cross-site Scripting in webapp

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horiz...

CVE-2023-0868 Stealing Cookies using Reflected XSS via graph results

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Users should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and Horizon installation instructions state that they are...

CVE-2023-0869 Cross-site scripting in outage/list.htm

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4 or newer. Meridian and Horizon installation instructions state th...

Citrix Endpoint Management (aka XenMobile Server) 10.15.0 Rolling Patch 1

Package name: xms10.15.0.10125.bin For: XenMobile Server 10.15.0 Deployment type: On-premises only Replaces: None Date: February 2023 Languages supported: English US Important notes about this update As a best practice, Citrix recommends that you install this and other updates to ensure that you...