Security Bulletin: A security vulnerability has been identified in Tivoli Netcool/OMNIbus WebGUI shipped with IBM Operations Analytics Predictive Insights

Summary Tivoli Netcool/OMNIbus WebGUI is shipped as a component of IBM Operations Analytics Predictive Insights. Information about possible 'command injection' security vulnerability was reported to affect multiple Web GUI pages. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Cross-Site Scripting (XSS) fixed in IBM Security Access Manager 9.0.7.2 (CVE-2019-4725)

Summary A Cross-Site Scripting vulnerability reported in IBM Security Access Manager 9.0.7.0IF1 was fixed in IBM Security Access Manager 9.0.7.2 Vulnerability Details CVEID: CVE-2019-4725 DESCRIPTION: IBM Security Access Manager is vulnerable to cross-site scripting. This vulnerability allows use...

PT-2021-4108 · Upx +2 · Upx +2

Name of the Vulnerable Software and Affected Versions: UPX version 4.0.0 Description: A null pointer dereference was found in the PackLinuxElf::canUnpack function in p lx elf.cpp, which can allow attackers to execute arbitrary code and cause a denial of service via a crafted file. This issue may...

Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2020-4590)

Summary WebSphere Application Server Liberty is vulnerable to a denial of service. This has been addressed. Vulnerability Details CVEID: CVE-2020-4590 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is...

PT-2022-8863 · Upx +1 · Upx +1

Name of the Vulnerable Software and Affected Versions: UPX affected versions not specified Description: An out-of-bounds read access issue was discovered in the PackLinuxElf64::canPack function of the p lx elf.cpp file. This could be triggered by an attacker using a crafted input file, potentiall...

Security Bulletin: WebSphere Application Server is vulnerable to an information disclosure vulnerability (CVE-2020-4629)

Summary WebSphere Application Server is vulnerable to an information disclosure vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2020-4629 DESCRIPTION: IBM WebSphere Application Server could allow a local user with specialized access to obtain sensitive information from a...

Windows Language Pack Installer Privilege Escalation

The vulnerability of the Windows Language Pack Installer component in Windows operating systems is related to file operation errors. Exploiting this vulnerability can allow an attacker to execute processes in privileged mode using a specially created application...

List of the bugs that are fixed in SQL Server 2008 Service Pack 1

List of the bugs that are fixed in SQL Server 2008 Service Pack 1 INTRODUCTION This article lists the bugs that are fixed in Microsoft SQL Server 2008 Service Pack 1 SP1. Notes Other fixes that are not documented may be included in the service pack. This list will be updated when more articles ar...

Security Bulletin: IBM Cloud Private is vulnerable to a Python vulnerability (CVE-2020-14422)

Summary IBM Cloud Private is vulnerable to a Python vulnerability Vulnerability Details CVEID: CVE-2020-14422 DESCRIPTION: Python is vulnerable to a denial of service, caused by improper computing hash values in the IPv4Interface and IPv6Interface classes in Lib/ipaddress.py. By sending a...

Security Bulletin: IBM Cloud Private is vulnerable to Kibana vulnerabilities (CVE-2020-7015, CVE-2020-7013, CVE-2020-7012)

Summary IBM Cloud Private is vulnerable to Kibana vulnerabilities Vulnerability Details CVEID: CVE-2020-7015 DESCRIPTION: Elastic Kibana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input in TSVB visualization. A remote attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to a Docker vulnerability (CVE-2020-13401)

Summary IBM Cloud Private is vulnerable to a Docker vulnerability Vulnerability Details CVEID: CVE-2020-13401 DESCRIPTION: Docker Docker CE is vulnerable to a man-in-the-middle attack, caused by improper validation of router advertisements. By sending rogue router advertisements, an attacker coul...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2019-15605, CVE-2019-15606)

Summary Security vulnerabilities affect IBM Cloud Private Vulnerability Details CVEID: CVE-2019-15605 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could explo...

Security Bulletin: IBM Event Streams is affected by a Node.js http-proxy and lodash module vulnerabilities

Summary IBM Event Streams is affected by a Node.js http-proxy and lodash module denial of service vulnerabilities Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: IBM Event Streams is affected by a vulnerability in the Go runtime (CVE-2020-16845)

Summary IBM Event Streams is affected by a vulnerability in the Go runtime Vulnerability Details CVEID: CVE-2020-16845 DESCRIPTION: Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted...

CVE-2020-24592

Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output sanitization...

CVE-2020-24592

Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output sanitization...

Security Bulletin: Multiple vulnerabilities in Apache Struts affect Tivoli Netcool/OMNIbus WebGUI (CVE-2019-0233, CVE-2019-0230)

Summary Fix is available for vulnerabilities in Apache Struts affecting Tivoli Netcool/OMNIbus WebGUI CVE-2019-0233, CVE-2019-0230. Vulnerability Details CVEID: CVE-2019-0233 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by an access permission override when performing a...

Security Bulletin: IBM Maximo Asset Management is vulnerable to path traversal (CVE-2019-4582)

Summary IBM Maximo Asset Management is vulnerable to path traversal. Vulnerability Details CVEID: CVE-2019-4582 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot"...

PT-2020-14662 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions prior to 7.3.3 Liferay DXP 7.1 versions prior to fix pack 18 Liferay DXP 7.2 versions prior to fix pack 6 Description: The issue allows remote authenticated users to conduct denial-of-service attacks by uploading large...

Camera Codec Pack Windows Code Execution

The vulnerability of the Camera Codec Pack component of the Windows operating system is related to errors in object handling in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...