Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9 and IBM BigFix Inventory v9

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool and IBM BigFix Inventory. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017 Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool, IBM Tivoli Asset Discovery for Distributed and IBM Endpoint Manager for Software Use Analysis (April 2015 CPU)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed.These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses FREAK: Factoring Attack ...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK have been identified in IBM WebSphere Application Server shipped with IBM Intelligent Operations Center products (January 2017 CPU)

Summary IBM WebSphere Application Server is shipped as a component of IBM Intelligent Operations Center and related products. Oracle released the January 2017 critical patch updates that contain multiple fixes for security vulnerabilities in the IBM Java Development Kit that is included with IBM...

Security Bulletin: Tivoli Storage Productivity Center - Oracle CPU February 2012, June 2012

Summary Multiple security vulnerabilities exist in the IBM Java SDK that is shipped with IBM Tivoli Storage Productivity Center. Vulnerability Details IBM Tivoli Storage Productivity Center 4.x is shipped with an IBM Java SDK that is based on the Oracle JDK. Oracle released February 2012 and Apri...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9, v7.5 & v7.2.2, IBM Tivoli Asset Discovery for Distributed v7.5 & v7.2.2 and IBM Endpoint Manager for Software Use Analysis v9 - CVE-2014-6593, CVE-2015-0400, C

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM License Metric Tool v9, v7.5 & v7.2.2, IBM Tivoli Asset Discovery for Distributed v7.5 & v7.2.2 and IBM Endpoint Manager for Software Use Analysis v9. These issues were disclosed as part of the IBM...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Business Services Fabric (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by WebSphere Business Services Fabric. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK (April 2022) affect IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8 that is used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in April 2022. Vulnerability Details CVEID:CVE-2021-35561 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerabilities in IBM® Java™ SDK Technology Edition, Oct 2021 affects IBM Security Identity Manager Virtual Appliance (CVE-2021-35603, CVE-2021-35550, CVE-2021-35578)

Summary There are multiple vulnerabilities in IBM® Java™ SDK Technology Edition, Oct 2021, used by IBM Security Identity Manager Virtual Appliance. IBM Security Identity Manager Virtual Appliance has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2021-35603 DESCRIPTION: An...

cloud.metaapi.sdk:metaapi-java-sdk (>=7.1.0, <=14.0.9), com.after_sunrise.cryptocurrency:bitflyer4j (>=0.5.0, <=0.6.0) +72 more potentially affected by CVE-2022-25867 via io.socket:socket.io-client (>=0.6.1, <=2.0.0)

io.socket:socket.io-client MAVEN version =0.6.1, =7.1.0, =0.5.0, =0.2.0, =1.1.5, =1.0.4, =1.0.4, =1.2.1, =2.3.3, =2.7.7, =1.0.1, =2.1.0, =3.1.1 and more Source cves: CVE-2022-25867 Source advisory: MEND:CVE-2022-25867...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects Rational Service Tester (CVE-2021-35603)

Summary A vulnerability in IBM SDK Java Version 1.8 and IBM Runtime Environment Java Version 1.8 used by Rational Service Tester. Rational Service Tester has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-35603 DESCRIPTION: An unspecified vulnerability in Java SE related to th...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects Rational Service Tester (CVE-2021-35550)

Summary A vulnerability in IBM SDK Java Version 1.8 and IBM Runtime Environment Java Version 1.8 used by Rational Service Tester. Rational Service Tester has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to th...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Java SE (CVE-2020-2773)

Summary IBM Resilient SOAR is Using Components with Known Vulnerabilities - Java SE. Vulnerability Details CVEID:CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a denial of service...

Path Traversal

aws-java-sdk-s3 is vulnerable to path traversal. The vulnerability exists due to the insufficient guard logic used for the download directory in the leavesRoot function of TransferManager.java, allowing an attacker to access files from the S3 bucket that is one level up in the file system by...

agorapulse.plugins.asset-pipeline-cdn:agorapulse.plugins.asset-pipeline-cdn.gradle.plugin (>=0.1, <=0.1.3), ai.deepsense:seahorse-executor-deeplang_2.11 (>=1.4.2, <=1.4.3) +3290 more potentially affected by CVE-2022-31159 via com.amazonaws:aws-java-sdk-s3 (>=1.9.0, <=1.12.260)

com.amazonaws:aws-java-sdk-s3 MAVEN version =1.9.0, =0.1, =1.4.2, =0.3.2, =3.22.0.1, =3.22.0.1, =3.22.0.1, =3.8.3.1, =1.4.15, =2.0.0, =3.30.0.5-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =1.4.15, =2.0.0, =3.36.1.3-1-2.4 and more Source cves: CVE-2022-31159 Source advisory: OSV:GHSA-C28R-HW5M-5GV3...

agorapulse.plugins.asset-pipeline-cdn:agorapulse.plugins.asset-pipeline-cdn.gradle.plugin (>=0.1, <=0.1.3), ai.deepsense:seahorse-executor-deeplang_2.11 (>=1.4.2, <=1.4.3) +3290 more potentially affected by CVE-2022-31159 via com.amazonaws:aws-java-sdk-s3 (>=1.9.0, <=1.12.260)

com.amazonaws:aws-java-sdk-s3 MAVEN version =1.9.0, =0.1, =1.4.2, =0.3.2, =3.22.0.1, =3.22.0.1, =3.22.0.1, =3.8.3.1, =1.4.15, =2.0.0, =3.30.0.5-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =1.4.15, =2.0.0, =3.36.1.3-1-2.4 and more Source cves: CVE-2022-31159 Source advisory: GHSA-C28R-HW5M-5GV3...

agorapulse.plugins.asset-pipeline-cdn:agorapulse.plugins.asset-pipeline-cdn.gradle.plugin (>=0.1, <=0.1.3), ai.deepsense:seahorse-executor-deeplang_2.11 (>=1.4.2, <=1.4.3) +3290 more potentially affected by CVE-2022-31159 via com.amazonaws:aws-java-sdk-s3 (>=1.9.0, <=1.12.260)

com.amazonaws:aws-java-sdk-s3 MAVEN version =1.9.0, =0.1, =1.4.2, =0.3.2, =3.22.0.1, =3.22.0.1, =3.22.0.1, =3.8.3.1, =1.4.15, =2.0.0, =3.30.0.5-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =1.4.15, =2.0.0, =3.36.1.3-1-2.4 and more Source cves: CVE-2022-31159 Source advisory: MEND:CVE-2022-31159...

Amazon AWS SDK for Java path traversal vulnerability

Amazon AWS SDK for Java is a software development kit for Amazon Web Services AWS for the Java platform from Amazon.com, Inc. A path traversal vulnerability exists in AWS SDK for Java v1 prior to version 1.12.261, which stems from the fact that AWS SDK for Java enables Java developers to work wit...

Security Bulletin: IBM® Java™ SDK Technology Edition, Oct 2021, affects IBM Security Verify Governance, Identity Manager virtual appliance component

Summary There are multiple vulnerabilities in IBM® Java™ SDK Technology Edition, Oct 2021, used by IBM Security Verify Governance, Identity Manager virtual appliance component. IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the applicable CVEs...

GHSA-64X4-9HC6-R2H6 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

Security Bulletin: A security vulnerability has been identified in in IBM Java SDK shipoped with IBM Tivoli Netcool Impact (CVE-2021-35603)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Tivoli Netcool Impact. IBM Tivoli Netcool Impact has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-35603 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE...