Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44832, CVE-2021-45046, ) and denial of service due to Apache Log4j (CVE-2021-45105)

Summary There are Remote Attack Vulnerabilities in Apache Log4j CVE-2021-44832, CVE-2021-45046, CVE-2021-45105 which is used by IBM Engineering Lifecycle Optimization - Publishing PUB and Rational Publishing Engine RPE Knowledge Center for logging . The fix includes upgrade to Apache Log4j v2.17....

IBM Engineering Workflow Management has an unspecified vulnerability

IBM Engineering Workflow Management is an engineering lifecycle management solution software for project management from IBM U.S.A. A security vulnerability exists in IBM Engineering Workflow Management, which can be exploited by authenticated attackers to gain access to sensitive information...

Security Bulletin: Apache Log4j vulnerabilities (CVE-2021-45105, CVE-2021-44832) in IBM WebSphere Application Server impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary There are multiple vulnerabilities from Apache Log4j CVE-2021-45105, CVE-2021-44832 that affect IBM WebSphere Application Server that affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Siemens COMOS Web Component Cross-Site Scripting Vulnerability

COMOS is a unified data platform for collaborative plant design, operations, and management that supports the collection, processing, storage, and distribution of information throughout the plant lifecycle.A cross-site scripting vulnerability exists in the Siemens COMOS Web component that could b...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects Engineering Lifecycle Management and IBM Engineering products

Summary There is a high risk Remote Attack Vulnerability in Apache Log4j CVE-2021-44228 which is used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Workflow Management EWM, IBM Engineering Systems...

PT-2022-2185 · Vmware · Vmware Vrealize Automation +4

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access affected versions not specified VMware vRealize Automation affected versions not specified VMware Identity Manager vIDM affected versions not specified VMware Cloud Foundation affected versions not specified vReali...

PT-2022-2187 · Vmware · Vmware Vrealize Automation +4

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access affected versions not specified VMware vRealize Automation affected versions not specified VMware Identity Manager vIDM affected versions not specified VMware Cloud Foundation affected versions not specified vReali...

Security Bulletin: Apache Log4j vulnerabilities in IBM WebSphere Application Server impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary There are multiple vulnerabilities from Apache Log4j CVE-2021-4104, CVE-2021-45046 that affect IBM WebSphere Application Server that affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: WebSphere Application Server is vulnerable to a denial of service which can impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary WebSphere Application Server is vulnerable to a denial of service CVE-2021-38951. This may affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects IBM Engineering Lifecycle Optimization - Integration Adapters Tasktop Edition and Tasktop Sync

Summary No action is required for Tasktop Viz or Tasktop Sync or IBM Engineering Lifecycle Optimization - Integration Adapters Tasktop Edition as they were not impacted by this vulnerability. Sync or IBM LIA is using Log4J 1.2.15, which is very old and not subject to the Log4J vulnerability. The...

GSD-2021-1002754 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit...

GSD-2021-1002706 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...

GSD-2021-1002675 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.168 by commit...

GSD-2021-1002657 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.222 by commit...

GSD-2021-1002637 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.259 by commit...

GSD-2021-1002614 net: systemport: Add global locking for descriptor lifecycle

net: systemport: Add global locking for descriptor lifecycle This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.296 by commit...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Telco Network Cloud Manager (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Telco Network Cloud Manager to provide logging functionality. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to...

OPENSUSE-SU-2021:1600-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 96.0.4664.110 boo1193713: CVE-2021-4098: Insufficient data validation in Mojo CVE-2021-4099: Use after free in Swiftshader CVE-2021-4100: Object lifecycle issue in ANGLE CVE-2021-4101: Heap buffer overflow in Swiftshader CVE-2021-4102:...

Vulnerabilities fixed in VMware products

VMware has fixed vulnerabilities in the following products: VMware Cloud Foundation VMware Identity Manager vIDM VMware Workspace ONE Access Access VMware vRealize Automation vRA VMware vRealize Suite Lifecycle Manager A remote malicious party could potentially exploit them to bypass two-factor...

Enalean Tuleap SQL Injection Vulnerability (CNVD-2021-103507)

Enalean Tuleap is a set of open source software development and project management tools from the French company Enalean. The tool provides enterprise application lifecycle management, as well as project tracking, source code management and team collaboration.Enalean Tuleap is vulnerable to SQL...