Security Bulletin: IBM MQ is affected by a vulnerability in Eclipse Jetty (CVE-2024-22201)

Summary An issue was found in Eclipse Jetty that is shipped with the IBM MQ Explorer. Vulnerability Details CVEID:CVE-2024-22201 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by a flaw when an HTTP/2 connection gets TCP congested. By sending a specially crafted request, ...

IBM MQ 8.x < 8.0.0.3 Multiple Information Disclosure (credentialed check)

The version of IBM MQ formerly IBM WebSphere MQ 8.x installed on the remote Windows host is missing fix pack 8.0.0.3 or later. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the Advanced Message Security policy when a JMS client application sends a message to the...

CVE-2015-1967

MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used...

CVE-2015-1967: Exposure of Sensitive Information to an Unauthorized Actor

MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used...

PT-2015-2782

Name of the Vulnerable Software and Affected Versions WebSphere MQ versions prior to 8.0.0.3 Description The issue is related to the MQ Explorer component in IBM WebSphere MQ, which does not properly handle the absence of the compatibility-mode option. This allows remote attackers to obtain...

CVE-2014-4822

IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation...

CVE-2014-4822: Undefined Security Weakness

IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation...

PT-2014-6140

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ classes for Java libraries versions 8.0 before 8.0.0.1 IBM Websphere MQ Explorer versions 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 Description The issue allows local users to discover preconfigured cleartext passwords via an...