Security Bulletin: IBM Informix Dynamic Server is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Informix Dynamic Server for IBM Informix HQ. The fix includes Apache Log4j 2.17.1. Customers are encouraged to take immediated action by applying the interim fix. Vulnerability Details CVEID: CVE-2021-4104...

Security Bulletin: Denial of Service vulnerability in sanitize-html affects IBM Business Automation Workflow (CVE-2021-23382)

Summary A denial of service vulnerability in sanitize-html affects IBM Business Automation Workflow Workflow Center. Vulnerability Details CVEID: CVE-2021-23382 DESCRIPTION: Node.js postcss module is vulnerable to a denial of service, caused by a regular expression denial of Service ReDoS flaw in...

Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM i2 Intelligence Analysis Platform (CVE-2015-4000)

Summary The LogJam Attack on Diffie-Hellman ciphers CVE-2015-4000 may affect some configurations of the IBM WebSphere Application Server used with the IBM i2 Intelligence Analysis Platform. The IBM HTTP Server used by IBM i2 Intelligence Analysis Platform is not affected. Vulnerability Details...

Security Bulletin: IBM Operations Analytics Predictive Insights is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary Apache Log4j CVE-2021-45105, CVE-2021-45046 is used by IBM Operations Analytics Predictive Insights as part of its UI and REST Mediation components . The fix includes Apache log4j 2.17. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Operational Decision Manager (CVE-2021-44228)

Summary Rule Designer, shipped with IBM Operational Decision Manager since version 8.10.4 includes log4j-core.jar that contains the vulnerable code. The fix includes Apache Log4j 2.15. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to an Information Disclosure (CVE-2022-22310)

Summary IBM WebSphere Application Server Liberty is vulnerable to an Information Disclosure. This has been addressed. Vulnerability Details CVEID: CVE-2022-22310 DESCRIPTION: IBM WebSphere Application Server Liberty could provide weaker than expected security. A remote attacker could exploit this...

Security Bulletin: Cross-site scripting vulnerability affects IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-4516

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a cross-site scripting attack. Vulnerability Details CVEID: CVE-2020-4516 DESCRIPTION: IBM Business Process Manager and IBM Business Automation Workflow is vulnerable to cross-site scripting. This...

Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow - CVE-2020-4757, PSIRT-ADV0028011, CVE-2020-4934

Summary The embedded IBM Content Navigator, that is shipped with IBM Business Automation Workflow is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2020-4934 DESCRIPTION: IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the...

Security Bulletin: Vulnerability in Apache Log4j affects WebSphere Application Server (CVE-2021-44228) bundled with Predictive Maintenance and Quality and Predictive Maintenance Insights

Summary IBM WebSphere Application Server is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Vulnerabilities have been identified in Apache Log4j which affect WebSphere Application Server CVE-2021-44228. The recommended solution is to manually...

Security Bulletin: Vulnerability in Apache Log4j affects Content Collector for IBM Connections (CVE-2021-45105)

Summary Apache Log4j open source library is used by Content Collector for IBM Connections. This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by the failure...

Security Bulletin: Vulnerabilities in Oracle Outside In Technology component affect Content Collector for Email (CVE-2021-35572)

Summary There are vulnerabilities in in Oracle Outside In Technology related to Outside In Filters used by Content Collector for Email. Vulnerability Details CVEID: CVE-2021-35572 DESCRIPTION: An unspecified vulnerability in Oracle Outside In Technology related to the Outisde in Filters component...

Security Bulletin: Vulnerabilities in Oracle Outside In Technology component affect Content Collector for Email (CVE-2021-35657)

Summary There are vulnerabilities in in Oracle Outside In Technology related to Outside In Filters used by Content Collector for Email. Vulnerability Details CVEID:CVE-2021-35657 DESCRIPTION: An unspecified vulnerability in Oracle Outside In Technology related to the Outside In Filters component...

Security Bulletin: Vulnerabilities in Oracle Outside In Technology component affect Content Collector for Email (CVE-2021-35573)

Summary There are vulnerabilities in in Oracle Outside In Technology related to Outside In Filters used by Content Collector for Email. Vulnerability Details CVEID: CVE-2021-35573 DESCRIPTION: An unspecified vulnerability in Oracle Outside In Technology related to the Outside In Filters component...

Security Bulletin: Vulnerabilities in Oracle Outside In Technology component affect Content Collector for Email (CVE-2021-35574)

Summary There are vulnerabilities in in Oracle Outside In Technology related to Outside In Filters used by Content Collector for Email. Vulnerability Details CVEID: CVE-2021-35574 DESCRIPTION: An unspecified vulnerability in Oracle Outside In Technology related to the Outside In Filters component...

Security Bulletin: Vulnerabilities in Oracle Outside In Technology component affect Content Collector for Email (CVE-2021-35656)

Summary There are vulnerabilities in in Oracle Outside In Technology related to Outside In Filters used by Content Collector for Email. Vulnerability Details CVEID:CVE-2021-35656 DESCRIPTION: An unspecified vulnerability in Oracle Outside In Technology related to the Outside In Filters component...

Security Bulletin: IBM Business Automation Workflow is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Multiple Apache Log4j vunerabilities impact Process Federation Server that is shipped with IBM Business Automation Workflow. This vulnerability includes Apache Log4j v2.17. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused b...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by IBM WebSphere Application Server. This has been addressed. IBM HTTP Server is affected by CVE-2021-44224 for IBM HTTP Server configurations with "ProxyRequests ON" in the IBM HTTP Server configuration file httpd.conf by...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities in Apache log4j (CVE-2021-4104, CVE-2021-45046)

Summary Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty CVE-2021-4104, CVE-2021-45046 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: There are multiple vulnerabilities in the Apache Log4j used in IBM® QRadar Risk Manager that may allow for remote code execution (RCE).

Summary Apache Log4j is used by IBM® QRadar Risk Manager to log system events. This bulletin provides a remediation to address the multiple Apache Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046 by upgrading IBM® QRadar Risk Manager. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION...

Security Bulletin: IBM Informix Dynamic Server is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Informix Dynamic Server for IBM Informix HQ. Customers are encouraged to take action by applying the interim fix. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacke...