Security Bulletin: Vulnerabilities found within Apache Storm that is used by IBM Tivoli Network Manager (ITNM) IP Edition

Summary Vulnerabilities found within Apache Storm CVE-2020-25649, CVE-2020-36518, CVE-2021-22569, CVE-2021-38153 that is used by IBM Tivoli Network Manager ITNM IP Edition Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected securit...

PT-2023-16384 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

CVE-2023-0586: Improper Neutralization of Input During Web Page Generation

The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject...

CVE-2023-0585: Improper Neutralization of Input During Web Page Generation

The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above...

WordPress Plugin All in One SEO Pack 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2023-16385 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file. (CVE-2022-43930)

Summary IBM® Db2® is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file. Vulnerability Details CVEID:CVE-2022-43930 DESCRIPTION: IBM Db2 is vulernable to an Information Disclosure as sensitive information may be included in a log file. CVS...

Malicious Package

Overview proton-pack is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to server-side request forgery due to Apache CXF CVE-2022-46364 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22476)

Summary IBM B2B Advanced Communications has addressed vulnerability in IBM WebSphere Application Server Liberty shipped with product. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22475)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in IBM WebSphere Application Server Liberty shipped with product. Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to...

Security Bulletin: IBM B2B Advanced Communications is vulnerable security bypass due to Google Core Libraries for Java [Guava] (CVE-2020-8908)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in Google Core Libraries for Java Guava shipped with product. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions, caused by a temp directory...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2018-1000873)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in FasterXML jackson-databind shipped with product. Vulnerability Details CVEID:CVE-2018-1000873 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by improper input validation by the nanosecon...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to directory traversal due to Apache Commons IO (CVE-2021-29425)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in Apache Commons IO shipped with product. Vulnerability Details CVEID:CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper input validation by th...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to denial of service due to SnakeYAML (CVE-2017-18640)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in SnakeYAML shipped with product. Vulnerability Details CVEID:CVE-2017-18640 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by an entity expansion in Alias feature during a load operation. By sending a...

Security Bulletin: IBM B2B Advanced Communications is vulnerable to multiple issues due to Apache Commons Compress

Summary IBM B2B Advanced Communications has addressed vulnerabilities in Apache Commons Compress shipped with product. Vulnerability Details CVEID:CVE-2021-35516 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memor...

Security Bulletin: IBM® Db2® may be vulnerable to a denial of service when executing a specially crafted 'Load' command. (CVE-2022-43929)

Summary IBM® Db2® may be vulnerable to a denial of service when executing a specially crafted 'Load' command. Vulnerability Details CVEID:CVE-2022-43929 DESCRIPTION: IBM Db2 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. CVSS Base score: 6.2 CVSS...

Security Updates for Microsoft SharePoint Server Subscription Edition Language Pack (February 2023)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing a language pack security updates. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Security Bulletin: Intel Ethernet controllers as used in IBM QRadar SIEM are vulnerable to a denial of service (CVE-2021-0197, CVE-2021-0198, CVE-2021-0199, CVE-2021-0200)

Summary Intel Ethernet controllers as used in IBM QRadar SIEM are vulnerable to a denial of service, IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2021-0197 DESCRIPTION: Intel Ethernet controllers are vulnerable to a denial of service, caused by a protection...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.4.2, <=1.7.1) +3 more potentially affected by CVE-2023-25761 via org.jenkins-ci.plugins:junit (1.8)

org.jenkins-ci.plugins:junit MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:junit and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack =1.7.2, =1.4.2, =2.0, =2.0.1, =2.2.13, =2.2.17...