USN-5791-1: Linux kernel vulnerabilities

It was discovered that a race condition existed in the Android Binder IPC subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-20421 David Leadbeater...

CVE-2022-34323

Sage XRT Business Exchange 12.4.302 contains multiple stored XSS flaws. An authenticated user can trigger JavaScript execution in other users’ browsers via: (1) Filters/Display model names rendered as HTML, (2) Alert names in Notifications/alerts, and (3) the File download feature where form fiel...

CVE-2022-34323

Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Filters and Display model...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring included WebSphere Application Server and IBM HTTP Server used by WebSphere Application Server

Summary The following security issues have been identified in the WebSphere Application and IBM HTTP Server included as part of IBM Tivoli Monitoring ITM portal server: CVE-2022-34336 CVE-2022-22477 CVE-2022-22473 CVE-2022-34165. The IBM Tivoli Monitoring include IBM HTTP Server is also affected...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring.

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. CVEs: CVE-2021-35561, CVE-2021-41041, CVE-2022-21299, CVE-2022-21496, CVE-2022-21434, CVE-2022-21443 Vulnerability Details CVEID:CVE-2021-35561 DESCRIPTION: An...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring

Summary There are several vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2020-2590 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2021-35560 DESCRIPTION: An unspecified vulnerability in Java SE related to the Deployment component could allow an unauthenticated...

Security Bulletin: IBM Tivoli Monitoring is vulnerable to remote code execution and denial of service due to multiple Expat CVEs

Summary The libexpart parser that is used by IBM Tivoli Monitoring for parsing various configuration xml files and parsing soap requests is potentially vulnerable to the following remote code execution CVE's: CVE-2021-46143 CVE-2022-25314 CVE-2022-23990 CVE-2022-22825 CVE-2022-23852 CVE-2022-2282...

Security Bulletin: Vulnerablity in Apache Log4j may affect IBM Tivoli Monitoring (CVE-2021-4104)

Summary The following security issue has been identified in components related to IBM Tivoli Monitoring ITM portal server and client. Vulnerability Details CVEID:CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the...

Security Bulletin: IBM Tivoli Monitoring is vulnerable to remote code execution [CVE-2022-40674]

Summary The libexpart parser that is used by IBM Tivoli Monitoring for parsing various configuration xml files and parsing soap requests is potentially vulnerable to remote code execution CVE-2022-40674. Vulnerability Details CVEID:CVE-2022-40674 DESCRIPTION: libexpat could allow a remote attacke...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Monitoring for Virtual Environments Base (June 2021)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version for IBM Tivoli Monitoring for Virtual Environments Base . ITMfVE for has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to t...

Security Bulletin: Multiple vulnerabilities in IBM Java included with IBM Tivoli Monitoring

Summary There are several vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could all...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring

Summary There are several vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2020-2805 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries component could...

Security Bulletin: IBM Tivoli Monitoring is affected but not classified as vulnerable by a denial of service in Spring Framework (CVE-2022-22950)

Summary IBM Tivoli Monitoring is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22950. The Tivoli Enterprise Portal Server CQ component includes but does not use it. The fix removes Spring from the product. Vulnerability Details...

Security Bulletin: Apache Camel Core vulnerability in IBM Tivoli Monitoring Data Provider (CVE-2020-11971)

Summary IBM Tivoli Monitoring Data provider is vulnerable to Apache Camel Core vulnerabilty CVE-2020-11971 Vulnerability Details CVEID:CVE-2020-11971 DESCRIPTION: Apache Camel could allow a remote attacker to obtain sensitive information, caused by a rebind flaw in JMX. By sending a...

Security Bulletin: IBM Tivoli Monitoring Basic Services is vulnerable to a denial of service attack in zlib component (CVE-2018-25032)

Summary Fixes a vulnerability reported in the zlib that is used by IBM Tivoli Monitoring for historical data collection CVE-2018-25032. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By usi...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application and IHS server

Summary The following security issues have been identified in the WebSphere Application Server and IHS server included as part of IBM Tivoli Monitoring ITM portal server. Vulnerability Details CVEID:CVE-2019-4670 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring

Summary Vulnerability in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated...

Security Bulletin: IBM Tivoli Monitoring is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Tivoli Monitoring is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boo...