Security Bulletin: IBM Cloud Pak for Network Automation 2.6.1 fixes multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.6.1 fixes multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32681 DESCRIPTION: python-requests could allow a remote attacker to obtain sensitive information, caused by the leaking of Proxy-Authorization...

Security Bulletin: IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2023

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF024 and 23.0.1-IF002. Vulnerability Details CVEID:CVE-2021-33813 DESCRIPTION: JDOM is vulnerable to a denial of service,...

Security Bulletin: IBM Cognos Dashboards on IBM Cloud Pak for Data has addressed security vulnerabilities (CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222, CVE-2023-26136)

Summary A Remote Code Execution RCE vulnerability in Salesforce tough-cookie CVE-2023-26136 and vulnerabilities reported in the Node.js July 2022 Security Release CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222 have been resolved in IBM Cognos Dashboards on IBM Clou...

Security Bulletin: A vulnerability in Microsoft Azure SDK for .NET affects IBM Robotic Process Automation and could allow a remote authenticated attacker to obtain sensitive information (CVE-2022-26907).

Summary Microsoft Azure SDK for .NET is used in the development of IBM Robotic Process Automation CVE-2022-26907. Vulnerability Details CVEID:CVE-2022-26907 DESCRIPTION: Microsoft Azure SDK for .NET could allow a remote authenticated attacker to obtain sensitive information. By sending a...

Security Bulletin: A vulnerability in MicrosoftAspNetCore.Identity affects IBM Robotic Process Automation and may result in allowing an attacker to bypass secrity restrictions (CVE-2023-33170).

Summary Microsoft.AspNetCore.Identity is used by IBM Robotic Process Automation as part of login functionality. CVE-2023-33170 Vulnerability Details CVEID:CVE-2023-33170 DESCRIPTION: Microsoft SharePoint Server could allow a remote attacker to bypass security restrictions. By winning a race...

Security Bulletin: Due to use of Mozilla Firefox, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities.

Summary Mozilla Firefox ESR is used by IBM Cloud Pak for Multicloud Management Monitoring as part of the selenium scripts / tests agent. Vulnerability Details CVEID:CVE-2023-29539 DESCRIPTION: Mozilla Firefox could allow a remote attacker to download arbitrary files, caused by the truncation of...

The vulnerability of the online business analytics service IBM Cognos Analytics, which is part of the IBM Cloud Pak for Data (CP4D) cloud platform for data analysis, organization, and management, allows a perpetrator to influence the integrity of protected information.

The vulnerability of the online business analytics service IBM Cognos Analytics, which is part of the IBM Cloud Pak for Data CP4D platform for data analysis, organization, and management, relates to insufficient protection of operational data during the processing of the seccomp parameter...

The vulnerability of the Watson Knowledge Catalog management service on the IBM Cloud Pak for Data (CP4D) cloud platform for analysis, organization, and data management allows a attacker to cause a service failure.

The vulnerability of the Watson Knowledge Catalog management service, which is part of the IBM Cloud Pak for Data CP4D cloud platform for data analysis, organization, and management, stems from insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for Watson AIOps version 4.1.2 Vulnerability Details CVEID:CVE-2023-24532 DESCRIPTION: An unspecified error with return an incorrect result in the ScalarMult and ScalarBaseMult methods of the P256 Curve in Golang Go has an unknown...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go with details below. CVE-2023-29400, CVE-2023-29402, CVE-2023-29404, CVE-2023-29403, CVE-2023-29405 The vulnerabilities...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in scikit-learn

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of scikit-learn. Vulnerability Details CVEID:CVE-2020-28975 DESCRIPTION: scikit-learn is vulnerable to a denial of service, caused by an error in svmpredictvalues in svm.cpp in Libsvm. By using a specially-craft...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2022-21282, CVE-2022-21296, CVE-2022-21299)

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Version 8 used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21299 DESCRIPTION: An unspecified...

Security Bulletin: A Unspecified Java Vulnerability is affecting Watson Knowledge Catalog for IBM Cloud Pak for Data (CVE-2021-35550)

Summary An unspecified vulnerability in Java is affecting Watson Knowledge Catalog for IBM Cloud Pak for Data. This vulnerability have been addressed. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an...

Security Bulletin: Multiple security vulnerabilities in .NET may affect IBM Robotic Process Automation for Cloud Pak (CVE-2023-24936, CVE-2023-29337, CVE-2023-33128)

Summary Microsoft .NET is used by IBM Robotic Process Automation for Cloud Pak as the development infrastructure and application runtime. CVE-2023-24936, CVE-2023-29337, CVE-2023-33128 Vulnerability Details CVEID:CVE-2023-24936 DESCRIPTION: Microsoft .NET and Visual Studio could allow a remote...

Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to denial of service due to Apache Log4j (CVE-2021-45105) and arbitrary code execution due to Apache Log4j (CVE-2021-45046)

Summary There are multiple Apache Log4j vulnerabilities CVE-2021-45105, CVE-2021-45046 impacting IBM Decision Optimization for Cloud Pak for Data which uses Apache Log4j for logging. The fix includes Apache Log4j 2.17. Vulnerability Details CVEID:CVE-2021-45105 DESCRIPTION: Apache Log4j is...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary There are multiple Apache Log4j vulnerabilities CVE-2021-45105, CVE-2021-45046 impacting IBM Cloud Pak for Data which uses Apache Log4j for logging. The fix includes Apache Log4j 2.17. Vulnerability Details CVEID:CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of servic...

Security Bulletin: A vulnerability in urlib3 affects IBM Robotic Process Automation for Cloud Pak which may result in CRLF injection (CVE-2020-26137).

Summary urlib3 is used by IBM Robotic Process Automation for Cloud Pak as part of OCR and AntiVirus container images. CVE-2020-26137 Vulnerability Details CVEID:CVE-2020-26137 DESCRIPTION: urllib3 is vulnerable to CRLF injection. By inserting CR and LF control characters in the first argument of...

Security Bulletin: IBM Robotic Process Automation is vulnerable to information disclosure of script content (CVE-2023-40370)

Summary IBM Robotic Process Automation runtime is vulnerable to information disclosure of script content if the remote REST request computer policy is enabled. Vulnerability Details CVEID:CVE-2023-40370 DESCRIPTION: IBM Robotic Process Automation runtime is vulnerable to information disclosure of...

Security Bulletin: A security vulnerability in Microsoft.NET affects IBM Robotic Process Automation and may result in a denial of service (CVE-2023-29331).

Summary IBM Robotic Process Automation in developed using Microsoft .NET CVE-2023-29331. Vulnerability Details CVEID:CVE-2023-29331 DESCRIPTION: Microsoft .NET is vulnerable to a denial of service. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause...