KB5009301 - FIX: XSS attacks and open redirect vulnerability in the ESB.Portal sample application for Microsoft BizTalk ESB Toolkit

None None...

PT-2021-24124

Name of the Vulnerable Software and Affected Versions: Action Pack versions 6.0.0 and later Description: A vulnerability exists that could allow an attacker to craft X-Forwarded-Host headers in combination with certain allowed host formats, causing the Host Authorization middleware to redirect...

Possible Open Redirect in Host Authorization Middleware

There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Decision Optimization Center (CVE-2021-35586, CVE-2021-35578)

Summary There are multiple vulnerabilities in IBM® SDK Java™ and IBM® Runtime Environment Java™ Versions 7 & 8 used by IBM Decision Optimization Center. IBM Decision Optimization Center has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-35586 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in Apache Commons Compress affect IBM Tivoli Netcool Impact (CVE-2021-35517, CVE-2021-36090)

Summary Multiple vulnerabilities have been identified in the Apache Commons Compress shipped with IBM Websphere Liberty. IBM Websphere Liberty is shipped with IBM Tivoli Netcool/Impact. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of...

Security Bulletin: September 2021 : A vulnerability in IBM Java Runtime affects CICS Transaction Gateway

Summary A vulnerability exists in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed this. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries...

Security Bulletin: IBM® Db2® could allow a local user to read and write specific files due to weak file permissions (CVE-2020-4976)

Summary IBM® Db2® could allow a local user to read and write specific files due to weak file permissions Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and wri...

Security Bulletin: IBM® Db2® under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. (CVE-2021-29763)

Summary IBM® Db2® under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. Vulnerability Details CVEID: CVE-2021-29763 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure, exposing remote storage credentials to privileged users under specific conditions.(CVE-2021-29752)

Summary IBM® Db2® is vulnerable to an information disclosure, exposing remote storage credentials to privileged users under specific conditions.CVE-2021-29752 Vulnerability Details CVEID: CVE-2021-29752 DESCRIPTION: IBM Db2 contains an information disclosure vulnerability, exposing remote storage...

Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting (XSS) (CVE-2021-29849)

Summary IBM QRadar SIEM is vulnerable to cross-site scripting Vulnerability Details CVEID: CVE-2021-29849 DESCRIPTION: IBM QRadar SIEM is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Security Bulletin: IBM QRadar SIEM is vulnerable to using weaker than expected cryptographic algorithms (CVE-2021-20400)

Summary IBM QRadar SIEM is vulnerable to using weaker than expected cryptographic algorithms Vulnerability Details CVEID: CVE-2021-20400 DESCRIPTION: IBM QRadar uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects IBM QRadar SIEM (CVE-2021-2161)

Summary A vulnerability in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 used by IBM QRadar SIEM. IBM QRadar SIEM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related t...

Security Bulletin: IBM QRadar SIEM is vulnerable to server side request forgery (SSRF) (CVE-2021-29863)

Summary IBM QRadar SIEM is vulnerable to server side request forgery SSRF Vulnerability Details CVEID: CVE-2021-29863 DESCRIPTION: IBM QRadar SIEM is vulnerable to server side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially...

Security Bulletin: Apache CXF as used by IBM QRadar SIEM is vulnerable to denial of service (DOS) (CVE-2021-30468)

Summary Apache CXF as used by IBM QRadar SIEM is vulnerable to denial of service Vulnerability Details CVEID: CVE-2021-30468 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by an infinite loop flaw in the JsonMapObjectReaderWriter function. By sending a specially-crafted JSON...

Security Bulletin: Apache PDFBox as used by IBM QRadar SIEM is vulnerable to denial of service (DOS) (CVE-2021-31811, CVE-2021-31812)

Summary Apache PDFBox as used by IBM QRadar SIEM is vulnerable to denial of service Vulnerability Details CVEID: CVE-2021-31811 DESCRIPTION: Apache PDFBox is vulnerable to a denial of service, caused by an out-of-memory exception while loading a file. By persuading a victim to open a...

Security Bulletin: IBM QRadar SIEM Performs Key Exchange Without Entity Authentication on Inter-Host Communications (CVE-2021-29779)

Summary IBM QRadar SIEM Performs Key Exchange Without Entity Authentication on Inter-Host Communications Vulnerability Details CVEID: CVE-2021-29779 DESCRIPTION: IBM QRadar could allow an attacker to obtain sensitive information due to the server performing key exchange without entity...

Security Bulletin: PostgreSQL as used by IBM QRadar SIEM is vulnerable to information disclosure (CVE-2021-32028, CVE-2021-32027)

Summary PostgreSQL as used by IBM QRadar SIEM is vulnerable to information disclosure Vulnerability Details CVEID: CVE-2021-32028 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by a memory disclosure vulnerability when using an INSERT …...

Security Bulletin: Fix available for Security Vulnerability in IBM WebSphere Portal (CVE-2015-5654)

Summary Security Bulletin: Fix available for Security Vulnerability in IBM WebSphere Portal CVE-2015-5654 Vulnerability Details CVEID: CVE-2015-5654 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could explo...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2021 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These might affect some configurations of IBM WebSphere Application Server Traditional, IBM WebSphere Application Server Liberty and IBM WebSphere Applicatio...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox

Summary IBM Cloud Pak for Multicloud Management Monitoringhas applied security fixes for its use of Mozilla Firefox. Vulnerability Details CVEID: CVE-2021-29976 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within...