Security Bulletin: Security vulnerabilities in Java SE affects Rational Build Forge

Summary Java SE that is used by IBM Rational Build Forge has a security vulnerabilities. IBM Rational Build Forge has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allo...

Security Bulletin: A security vulnerability has been identified in Xstream, which is a required product for IBM Tivoli Network Configuration Manager (CVE-2020-26258, CVE-2020-26259)

Summary A security vulnerability has been disclosed in the Xstream library , which is installed as part of IBM Tivoli Network Configuration Manager version 6.4.2. Information about this vulnerability has been published in a security bulletin. Vulnerability Details CVEID: CVE-2020-26258 DESCRIPTIO...

Security Bulletin: Vulnerabilities in IBM Java SDK affecting IBM Application Discovery and Delivery Intelligence V5.1.0.8 and V5.1.0.9

Summary Multiple vulnerabilities are identified in IBM® SDK Java™ Technology Edition Version 1.8 that is used by IBM Application Discovery and Delivery Intelligence V5.1.0.8 and V5.1.0.9 respectively. These issues were disclosed as part of the IBM Java SDK updates in October 2020. Vulnerability...

HPESBGN04107 rev.2 - HPE iLO Amplifier Pack, Remote Cross-Site Scripting (XSS) Vulnerability

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. iLO Amplifier Pack - Prior to version 1.95 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-26580 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:...

HPESBGN04109 rev.1 - HPE iLO Amplifier Pack, Multiple Remote Cross-Site Scripting (XSS) Vulnerabilities

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. iLO Amplifier Pack - Prior to version 1.80 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-11022 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

Information Disclosure

x-pack-core is vulnerable to an information disclosure. Sensitive request headers of other users in the cluster are exposed to a user with the ability to read the .tasks index due to a flawed implementation of async search API which allows users executing an async search to store the HTTP headers...

Fedora 33 : 1:rubygem-actionpack / 1:rubygem-activerecord (2021-b571fca1b8)

The remote Fedora 33 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-b571fca1b8 advisory. - The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service REDoS vulnerability...

Security Bulletin: IBM InfoSphere Information Server is affected by a cross-site scripting vulnerability

Summary A cross-site scripting vulnerability was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2020-4298 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t...

Security Update for Microsoft Visual Studio Code Java Extension Pack Extension (March 2021)

Microsoft Visual Studio Code Java Extension Pack could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim. Not...

Security Bulletin: IBM® Db2® is vulnerable to a Denial of Service on Windows (CVE-2020-4642)

Summary IBM Db2 for Windows includes Db2 Connect Server could allow local attacker to cause a denial of service inside the "Db2 Management Service". Vulnerability Details CVEID: CVE-2020-4642 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow local attacker t...

CVE-2021-27084

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability...

CVE-2021-27084

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability...

Remote code execution

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability...

CVE-2021-27084 Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

...

CVE-2021-27084 Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

...

CVE-2021-27084

CVE-2021-27084 affects Visual Studio Code Java Extension Pack. The data in connected docs confirms a Remote Code Execution vulnerability tied to this extension pack, with remediation by Microsoft updates. The CVSS/metrics indicate HIGH impact with local attack vector and user interaction required...

Security Bulletin: IBM® Db2® is vulnerable to denial of service (CVE-2020-4200).

Summary Db2 is vulnerable to a denial of service. Authenticated users using a JDBC client may send specially crafted commands to cause Db2 to terminate abnormally. Vulnerability Details CVEID: CVE-2020-4200 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a...

Security Bulletin: IBM® Db2® is vulnerable to privilege escalation (CVE-2020-4230).

Summary IBM Db2 is vulnerable to a priviledge escalation. An authenticated local attacker with special permissions can execute specially crafted Db2 commands to modify the owner of stored procedures to SYSIBM, causing a privilege escalation. Vulnerability Details CVEID: CVE-2020-4230 DESCRIPTION:...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service attack (CVE-2020-4420)

Summary IBM® Db2® could allow an unauthenticated attacker to cause a denial of service due to a hang in the execution of a terminate command. Vulnerability Details CVEID: CVE-2020-4420 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an unauthenticated...

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow leading to a privileged escalation (CVE-2020-4363)

Summary IBM® Db2® is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. Vulnerability Details CVEID: CVE-2020-4363 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connec...