Description of the security update for Office 2013: September 14, 2021 (KB5001958)

Description of the security update for Office 2013: September 14, 2021 KB5001958 Summary This security update resolves a Microsoft Office Access connectivity engine remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures...

Description of the security update for Office 2013: September 14, 2021 (KB5002007)

Description of the security update for Office 2013: September 14, 2021 KB5002007 Summary This security update resolves Microsoft Office graphics remote code execution vulnerabilities. To learn more about the vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2021-38658 and...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11, V12 (CVE-2021-2161)

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition, used by IBM Integration Bus & IBM App Connect Enterprise v11, V12. These issues were disclosed as part of the IBM Java SDK updates in April 2021 Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Ja...

Microsoft Office code injection vulnerability

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. Commonly used components of this product include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code injection vulnerability exists in Microsoft Office. The following products and edition...

Microsoft Windows Kernel Permission and Access Control Vulnerabilities

Microsoft Windows Kernel is the kernel of the Windows operating system from Microsoft Corporation USA. A vulnerability exists in the Microsoft Windows Kernel for privilege-granting and access control issues. Windows Server 2008 for x64-based Systems Service Pack 2,Windows Server 2008 for x64-base...

Microsoft Excel code injection vulnerability

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Excel. The following products and editions are affected: Microsoft Excel 2013 RT Service Pack 1,Microsoft Excel 2013 Service Pack 1 32-bit...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Stored Cross-site Scripting (CVE-2021-29743)

Summary IBM Maximo Asset Management is vulnerable to stored cross-site scripting. Vulnerability Details CVEID: CVE-2021-29743 DESCRIPTION: IBM Maximo Asset Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2021-29744)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2021-29744 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2021-3449, CVE-2021-3450)

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By sending a specially crafted renegotiation ClientHello...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2021-27919, CVE-2021-27918)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2021-27919 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the Reader.Open API when use a ZIP archive containing files start with “../”. By persuading a victim to open a...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2021-23337)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the template. By...

Security Bulletin: IBM Cloud Private is vulnerable to Java vulnerabilities (CVE-2020-2773)

Summary IBM Cloud Private is vulnerable to Java vulnerabilities Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities (CVE-2020-1971, CVE-2020-8287, CVE-2020-8265)

Summary IBM Cloud Private is vulnerable to OpenSSL and Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2021-3121)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2021-3121 DESCRIPTION: An unspecified error with the lack of certain index validation, aka the skippy peanut butter issue in GoGo Protobuf has an unknown impact and attack vector. CVSS Base score: 5.3...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2020-1968 )

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections...

Security Bulletin: IBM Cloud Private is vulnerable to Elastic vulnerabilities (CVE-2020-7018,CVE-2020-7019 )

Summary IBM Cloud Private is vulnerable to Elastic vulnerabilities Vulnerability Details CVEID: CVE-2020-7018 DESCRIPTION: Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by a credential exposure flaw in the App Search interface. By...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony

Summary This interim fix provides instructions on upgrading Apache Tomcat from v5.5.36 to v7.0.90 in IBM Platform Symphony 6.1.1 and from v6.0.43 to v8.5.32 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address security vulnerability CVE-2018-8014 in Tomcat. Vulnerability Details CVE-ID:...

Open Redirect in ActionPack

Overview There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942. Versions Affected: = 6.0.0. Not affected: 6.0.0 Fixed Versions: 6.1.4.1, 6.0.4.1 Impact Specially crafted...

GHSA-2RQW-V265-JF8C Open Redirect in ActionPack

Overview There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942. Versions Affected: = 6.0.0. Not affected: 6.0.0 Fixed Versions: 6.1.4.1, 6.0.4.1 Impact Specially crafted...

PT-2021-15288

Name of the Vulnerable Software and Affected Versions Action Pack versions 6.0.0 and later Description A possible open redirect vulnerability in the Host Authorization middleware could allow attackers to redirect users to a malicious website. Recommendations For Action Pack versions 6.0.0 and...