Security Bulletin: Multiple vulnerabilities in Intel Processors affect IBM Cloud Pak System

Summary Multiple vulnerabilities in Intel Processors affect Cloud Pak System. IBM Cloud Pak System has addressed vulnerabilities. Vulnerability Details CVEID:CVE-2022-21123 DESCRIPTION: Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by incomple...

Security Bulletin: Vulnerability in libexpat affects IBM Cloud Pak System [CVE-2022-40674]

Summary Vulnerability in libexpat affects Tivoli Monitoring and Platform System Manager shipped with Cloud Pak System. IBM Cloud Pak System has addressed this vulnerability. CVE-2022-40674 Vulnerability Details CVEID:CVE-2022-40674 DESCRIPTION: libexpat could allow a remote attacker to execute...

Security Bulletin: Vulnerability in Samba affects Spectrum Scale shipped with Cloud Pak System [CVE-2021-44142]

Summary Vulnerability in Samba affects Spectrum Scale shipped with Cloud Pak System. IBM Cloud Pak System has addressed this vulnerability. CVE-2021-44142 Vulnerability Details CVEID:CVE-2021-44142 DESCRIPTION: Samba could allow a remote authenticated attacker to execute arbitrary code on the...

Security Bulletin: Multiple vulnerabilities identified in VMWare ESXi shipped with IBM Cloud Pak System

Summary Vulnerabilties in VMware ESXi affect IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2022-26373 DESCRIPTION: VMware ESXi could allow a local authenticated attacker to obtain sensitive information, caused by a...

Security Bulletin: Vulnerabilities in VMware vCenter affect IBM Cloud Pak System (CVE-2022-31697, CVE-2022-31698)

Summary Vulnerabilities in VMware vCenter affect IBM Cloud Pak System. IBM Cloud Pak System has addressed those vulnerabilities. Vulnerability Details CVEID:CVE-2022-31697 DESCRIPTION: VMware vCenter Server could allow a local attacker to obtain sensitive information, caused by the logging of...

Security Bulletin: Multiple Vulnerabilities in XCC affect Cloud Pak System (CVE-2022-34884, CVE-2022-34888)

Summary XClarity Controller XCC is vulnerable to Denial of Service and tampering. XCC is used by Cloud Pak System. Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2022-34884 DESCRIPTION: Lenovo XClarity Controller XCC is vulnerable to a denial of service,...

Security Bulletin: Multiple vulnerabilities in software used in node.js affect Cloud Pak System

Summary Multiple vulnerabilities found in follow-redirect, html-parse-stringify2, nth-check, pycrypto affect Cloud Pak System. IBM Cloud Pak System has addressed those vulnerabilities. Vulnerability Details CVEID:CVE-2021-23346 DESCRIPTION: Node.js html-parse-stringify and html-parse-stringify2...

Security Bulletin: IBM Cloud Pak System is vulnerable to multiple vulnerabilities in Golang Go

Summary Cloud Pak System is vulnerable to multiple vulnerabilities in Golang Go. The fix removes these vulnerablities in IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2022-32148 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by improper exposu...

Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System

Summary Multiple vulnerabilities in Open Source software used by Cloud Pak System. IBM Cloud Pak System has addressed those vulnerabilities. Vulnerability Details CVEID:CVE-2015-1832 DESCRIPTION: Apache Derby could allow a remote attacker to obtain sensitive information, caused by a XML external...

Security Bulletin: Multiple vulnerabilities in IBM Db2 for Linux, UNIX and Windows affect Cloud Pak System (CVE-2022-22389, CVE-2022-22390)

Summary IBM Db2 for Linux, UNIX and Windows is shipped with Cloud Pak System PSM and as PatternType pType . Cloud Pak System has addressed vulnerabilities. Vulnerability Details CVEID:CVE-2022-22389 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to ...

Security Bulletin: Vulnerability in commons-io affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2021-29425]

Summary Commons-io package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2021-29425. Vulnerability Details CVEID:CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the syste...

Security Bulletin: Vulnerability in gson-2.8.0.jar affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)(CVE-2022-25647).

Summary The gson-2.8.0.jar package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVECVE-2022-25647 Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserializatio...

Security Bulletin: Vulnerability in ant-1.8.1.jar affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)

Summary The ant-1.8.1.jar package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVEs CVE-2012-2098, CVE-2020-11979, CVE-2021-36374, CVE-2021-36373, CVE-2020-1945. Vulnerability Details CVEID:CVE-2012-2098 DESCRIPTION: Apache Commons...

Security Bulletin: Vulnerability in commons-httpclient-3.0.1.jar affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) (CVE-2012-5783)

Summary Commons-httpclient-3.0.1.jar package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVE CVE-2012-5783. Vulnerability Details CVEID:CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazon Flexible Payments Servi...

Security Bulletin: Multiple Vulnerabilities have been identified in WebSphere Application Server Liberty shipped with Cloud Pak System (CVE-2022-3509, CVE-2022-3171)

Summary Vulnerabilities has been identified in WebSsphere Application Server Liberty pattern pType shipped with Cloud Pak System. IBM Cloud Pak System ships with optional Single- Sign-On SSO feature. Information about security vulnerabilities affecting IBM WebSphere Application Server Liberty hav...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the Admin Console (CVE-2023-26283)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the Admin Console CVE-2023-26283 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Freedesktop D-Bus is used by IBM Robotic Process Automation as part of container base images CVE-2022-42010, CVE-2022-42011, CVE-2022-42012. GNU Libtasn1 is used by IBM Robotic Process Automation as...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an information exposure in WebSphere Application Server Liberty (CVE-2016-0378

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an information exposure in WebSphere Application Server Liberty caused by improper handling of exceptions CVE-2016-0378. IBM WebSphere Application Server Liberty is included as part of the Base OS used by our...

PT-2023-4607 · Ibm · Ibm Cognos Analytics On Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics on Cloud Pak for Data version 4.0 Description: The issue is related to insufficient protection of service data when processing the seccomp parameter, which could allow a remote attacker to compromise the security of...

PT-2023-4630 · Ibm · Ibm Watson Knowledge Catalog

Name of the Vulnerable Software and Affected Versions: IBM Watson Knowledge Catalog on Cloud Pak for Data version 4.0 Description: The issue is related to insufficient input validation in the Watson Knowledge Catalog service, which can be exploited by a remote attacker to cause a denial of servic...