Possible Open Redirect Vulnerability in Action Pack

There is a possible Open Redirect Vulnerability in Action Pack. Versions Affected: = v6.1.0.rc2 Not affected: v6.1.0.rc2 Fixed Versions: 6.1.3.2 Impact ------ This is similar to CVE-2021-22881. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. There is a possible Open Redirect Vulnerability in Action Pack. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise V11 are affected by vulnerabilities in Node.js (CVE-2020-28500)

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of...

Security Bulletin: IBM Integration Bus & IBM App Connect Enterprise V11 are affected by vulnerabilities in Node.js (CVE-2020-8265)

Summary IBM Integration Bus & IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-8265 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a...

Possible Open Redirect Vulnerability in Action Pack

There is a possible Open Redirect Vulnerability in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22903. Versions Affected: = v6.1.0.rc2 Not affected: v6.1.0.rc2 Fixed Versions: 6.1.3.2 Impact ------ This is similar to CVE-2021-22881: Specially crafted Host headers ...

Possible Information Disclosure / Unintended Method Execution in Action Pack

There is a possible information disclosure / unintended method execution vulnerability in Action Pack which has been assigned the CVE identifier CVE-2021-22885. Versions Affected: = 2.0.0. Not affected: 2.0.0. Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 Impact ------ There is a possible...

Rails Action Pack 信息泄露漏洞

Red Hat Satellite 6 is an application system from Red hat, Inc. provides an infrastructure management product specifically designed to keep Red Hat EnterpriseLinux® environments and other Red Hat infrastructures running efficiently, securely, and in compliance with various standards. An unspecifi...

Rails Action Pack 输入验证错误漏洞

Red hat Red Hat Satellite 6 is an application system from Red hat, Inc. It provides an infrastructure management product specifically designed to keep Red Hat EnterpriseLinux® environments and other Red Hat infrastructures running efficiently, securely, and in compliance with various standards. A...

Security Bulletin: IBM® Db2® is vulnerable to weak file permissions allowing access to specific files (CVE-2020-4976)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local user to read and write specific files due to weak file permissions. Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a loc...

Security Bulletin: IBM® Db2® db2fm is vulnerable to a buffer overflow (CVE-2020-5025)

Summary IBM Db2 db2fm is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. Vulnerability Details CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 db2fm is vulnerable to a buffer overflow,...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Sourcing Vulnerability Details CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds...

Security Bulletin: IBM DB2 Server Vulnerabilities Affect IBM Emptoris Emptoris Supplier Lifecycle Mgmt

Summary IBM DB2 Server Vulnerabilities Affect IBM Emptoris Emptoris Supplier Lifecycle Management. Vulnerability Details CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caus...

Security Bulletin: Vulnerability in Dojo affects WebSphere Application Server (CVE-2020-5258)

Summary There is a vulnerability in the Dojo library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By...

HPESBHF04091 rev.1 - HPE Intel 700-DA series Ethernet Controllers, Local Multiple Vulnerabilities

Potential Security Impact: Local: Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Ethernet 10Gb 2-port FLR-SFP+ X710-DA2 Adapter -Prior to Version 10.54.7 HPE Ethernet 10Gb 2-port SFP+ X710-DA2 Adapter -Prior to Version 10.54.7 Intel X710-DA2 Ethernet...

Security Bulletin: WebSphere Application Server is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20453)

Summary WebSphere Application Server is vulnerable to an XML External Entity XXE Injection vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20453 DESCRIPTION: IBM WebSphere Application Server is vulnerable to a XML External Entity Injection XXE attack when processing...

Security Bulletin: An unspecified vulnerability in Java SE could affect InfoSphere Streams

Summary An unspecified vulnerability in Java SE could affect InfoSphere Streams. Please see details below. Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2021 vulnerabilities could affect InfoSphere Streams

Summary IBM SDK, Java Technology Edition Quarterly CPU - Jan 2021 vulnerabilities could affect InfoSphere Streams. Please see details below. Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive...

Security Bulletin: An Apache Hadoop vulnerability could affect InfoSphere Streams.

Summary An Apache Hadoop vulnerability could affect InfoSphere Streams. Please see details below. Vulnerability Details CVEID: CVE-2020-9492 DESCRIPTION: Apache Hadoop could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of SPNEGO...

Security Bulletin: An unspecified vulnerability in Java SE related to the JNDI component could affect InfoSphere Streams

Summary An unspecified vulnerability in Java SE related to the JNDI component could affect InfoSphere Streams . Please see details below. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated...

Security Bulletin: An unspecified vulnerability in Java SE related to the Libraries component could affect InfoSphere Streams version 4.3

Summary An unspecified vulnerability in Java SE related to the Libraries component could affect InfoSphere Streams version 4.3. Please see details below. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow...