CVE-2020-5252 Malicious package may avoid detection in python auditing

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is...

CVE-2020-5252

CVE-2020-5252 concerns the command-line Python package Safety. Reports describe a low-severity issue where two Python-related characteristics permit a malicious package to poison-pill or obfuscate other packages, allowing bypass of Safety’s detection routines. This is said to occur when Safety ru...

Security Bulletin: MQSISTOP/STARTMSGFLOW commands with unauthorized user succeed affects IBM WebSphere Message Broker and IBM Integration Bus (CVE-2015-5011)

Summary MQSISTOP/STARTMSGFLOW commands with unauthorized user succeed affecting IBM WebSphere Message Broker and IBM Integration Bus Vulnerability Details CVEID: CVE-2015-5011 DESCRIPTION: IBM Integration Bus could allow a local user to start and stop a service that they should not have access to...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Integration Bus , IBM App Connect and WebSphere Message Broker

Summary Multiple vulnerabilities in OpenSSL affect IBM Integration Bus , IBM App Connect and WebSphere Message Broker. The DataDirect ODBC Drivers used by IBM App Connect , IBM Integration Bus and WebSphere Message Broker have addressed the applicable CVEs. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect WebSphere Message Broker and IBM Integration Bus

Summary Multiple vulnerabilities in OpenSSL affect WebSphere Message Broker and IBM Integration Bus. The DataDirect ODBC and Node.js Drivers used by WebSphere Message Broker and IBM Integration Bus have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2842 DESCRIPTION: OpenSSL...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js version 8 for which multiple vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2018-12122 DESCRIPTION: Node.js is vulnerable to a denial of...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise are affected by a Websphere Application Server Vulnerability (CVE-2018-1996)

Summary IBM Integration Bus and IBM App Connect Enterprise are affected by a WebSphere Application Server vulnerability which was reported and has been addressed. Vulnerability details are listed below Vulnerability Details CVEID: CVE-2018-1996 DESCRIPTION: IBM WebSphere Application Server 7.0,...

Security Bulletin: WebSphere Message Broker Toolkit and IBM Integration Toolkit cannot connect to a remote WebSphere Message Broker broker or IBM Integration Bus node with a TLS-compliant cipher (CVE-2015-0118)

Summary WebSphere Message Broker Toolkit and IBM Integration Toolkit cannot connect to remote WebSphere Message Broker or IBM Integration Bus node with a TLS-compliant cipher. Vulnerability Details CVEID: CVE-2015-0118 DESCRIPTION: IBM Integration Toolkit cannot connect to a remote IBM Integratio...

Security Bulletin: IBM Integration Bus is affected by Apache Tomcat vulnerability (CVE-2014-0230)

Summary IBM Integration Bus is affected by Apache Tomcat vulnerability. Vulnerability Details CVEID: CVE-2014-0230 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by missing limitations on request body size. By sending a specially crafted request to the server, an attacker...

Security Bulletin: IBM Integration Bus is affected by WebAdmin Session Timeout vulnerability (CVE-2017-1693)

Summary IBM Integration Bus has addressed the following vulnerability Vulnerability Details CVEID: CVE-2017-1693 DESCRIPTION: IBM Integration Bus could allow an attacker that has captured a valid session id to highjack another users session during a small timeframe before the session times out...

Security Bulletin: IBM Integration Bus is affected by a Open Source Apache Tomcat Vulnerability (CVE-2017-5664 )

Summary IBM Integration Bus has addressed the following vulnerabilities Vulnerability Details CVEID: CVE-2017-5664 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the improper handling of specific HTTP request methods for static error pages by t...

Security Bulletin: Vulnerability in Node.js affects IBM Integration Bus & IBM App Connect Enterprise V11

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed..Vulnerability details are listed below Vulnerability Details CVEID: CVE-2019-9511 DESCRIPTION: Some HTTP/2 implementations are vulnerable to window size...

Security Bulletin: Vulnerability in Node.js affects IBM Integration Bus & IBM App Connect Enterprise V11

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js version 8 for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2019-5739 DESCRIPTION: Node.js is vulnerable to a denial of service. B...

Security Bulletin: IBM WebSphere Installer used by WebSphere Message Broker, IBM Integration Bus, IBM Integration Bus Healthcare Pack, Manufacturing Pack, and Retail Pack is susceptible to DLL-planting vulnerability (CVE-2016-4560)

Summary The Windows graphical user interface installer setup.exe used by WebSphere Message Broker, IBM Integration Bus, IBM Integration Bus Healthcare Pack, IBM Integration Bus Manufacturing Pack, and IBM Integration Bus Retail Pack, is susceptible to a DLL-planting vulnerability, where a malicio...

Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by Open Source Tomcat vulnerability (CVE-2016-3092)

Summary WebSphere Message Broker and IBM Integration Bus are affected by Open Source Apache Tomcat vulnerability. Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect WebSphere Message Broker and IBM Integration Bus

Summary OpenSSL vulnerabilities were disclosed on September 22, September 26, and November 10, 2016 by the OpenSSL Project. The DataDirect ODBC Drivers used by WebSphere Message Broker and IBM Integration Bus have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6303...

Security Bulletin: Open Source Apache Xerces-C XML parser vulnerabilities affect IBM Integration Bus and WebSphere Message Broker (CVE-2016-4463, CVE-2016-0729)

Summary IBM Integration Bus and WebSphere Message Broker are affected by Open Source Apache Xerces-C XML parser vulnerabilities. Vulnerability Details CVEID: CVE-2016-0729 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking duri...

Security Bulletin: Authentication vulnerability affects IBM Integration Bus V10.0.0.4 onwards (CVE-2016-8918 )

Summary Web user accounts can be authenticated against an LDAP server, in IBM Integration Bus V10.0.0.4 and later versions. However, under some circumstances it is possible for a remote user to be authenticated without providing valid credentials. Vulnerability Details CVEID: CVE-2016-8918...

Security Bulletin: IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to XML external entity attack (CVE-2016-9706)

Summary IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to XML external entity attack. Vulnerability Details CVEID: CVE-2016-9706 DESCRIPTION: IBM Integration Bus and WebSphere Message Broker SOAP FLOWS are vulnerable to a denial of service attack, caused by an XML...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects WebSphere Message Broker and IBM Integration Bus (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects WebSphere Message Broker and IBM Integration Bus Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a...