CVE-2022-22493

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449...

Security Bulletin: Multiple Vulnerabilities in Cloud Pak for Watson AIOPs

Summary 3.5 Fixes the following vulnerabilities: CVE-2022-1154, CVE-2018-25032, CVE-2020-29582, CVE-2022-24329, CVE-2022-29217, CVE-2022-22476, CVE-2022-1271, CVE-2022-0778 Vulnerability Details CVEID:CVE-2022-1154 DESCRIPTION: Vim is vulnerable to a heap-based buffer overflow, caused by a...

CVE-2022-38709

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to Server-Side Request Forgery (CVE-2022-35282)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is vulnerable to Server-Side Request Forgery CVE-2022-35282 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Product...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a Denial of Service due to Neko HTML (CVE-2022-24839)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to a Denial of Service due to Neko HTML CVE-2022-24839 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Security vulnerability is addressed with IBM Cloud Pak for Business Automation iFixes for September 2022 (CVE-2021-2163)

Summary In addition to many updates of operating system level packages, the following security vulnerability is addressed with IBM Cloud Pak for Business Automation 21.0.3-IF013 and 22.0.1-IF003. Vulnerability Details CVEID:CVE-2021-2163 DESCRIPTION: An unspecified vulnerability in Java SE relate...

Security Bulletin: Multiple Vulnerabilities in node.js

Summary Security Vulnerabilities in node.js affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information.. Vulnerability Details CVEID:CVE-2022-32213 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly parse and...

Security Bulletin: IBM Robotic Process Automation may be vulnerable to spoofing attacks due to System.Security.Cryptography.Xml (CVE-2022-34716))

Summary System.Security.Cryptography.Xml is used by IBM Robotic Process Automation as part of the .NET Framework CVE-2022-34716 Vulnerability Details CVEID:CVE-2022-34716 DESCRIPTION: Microsoft .NET could allow a remote attacker to conduct spoofing attacks, caused by improper XML signature...

Security Bulletin: IBM Robotic Process Automation is vulnerable to arbitrary code execution due to DevExpress SafeBinaryFormatter (CVE-2022-28684)

Summary DevExpress is used by IBM Robotic Process Automatoin as part of the Dashboard and some commands. CVE-2022-28684 Vulnerability Details CVEID:CVE-2022-28684 DESCRIPTION: DevExpress could allow a remote authenticated attacker to execute arbitrary code on the system, caused by deserialization...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation for Cloud Pak versions 21.0.3 through 21.0.4, I...

Security Bulletin: Operations Dashboard is vulnerable to request smuggling due to Golang Go vulnerability CVE-2022-1705

Summary Operations Dashboard is vulnerable to request smuggling due to Golang Go vulnerability CVE-2022-1705 Vulnerability Details CVEID:CVE-2022-1705 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw with accepting of some invalid Transfer-Encoding headers in the...

Security Bulletin: A security vulnerability in Nodejs follow-redirects affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs follow-redirects affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-0536 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused b...

Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-24921 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validation. By using a specially-crafted deeply nested expressio...

Security Bulletin: A security vulnerability in GO crypto affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in GO crypto affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2021-43565 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an input validation flaw in golang.org/x/crypto's readCipherPacket...

Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-28327 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validaiton by the generic P-256 feature in crypto/elliptic. By...

Security Bulletin: A security vulnerability in Nodejs unset-value affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs unset-value affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 220063 DESCRIPTION: Node.js unset-value module is vulnerable to a denial of service, caused by a prototype pollution flaw in the unset...

Security Bulletin: A security vulnerability in Nodejs uglify-js affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs uglify-js affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 218243 DESCRIPTION: The Node.js uglify-js module is vulnerable to a denial of service, caused by an error in the stringtemplate and the...

Security Bulletin: A security vulnerability in Nodejs node-fetch affects IBM Cloud Pak for Multicloud Management Managed Services

Summary Security Bulletin: A security vulnerability in Nodejs node-fetch affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details CVEID:CVE-2022-0235 DESCRIPTION: Node.js node-fetch could allow a remote authenticated attacker to obtain sensitive information, caused b...

Security Bulletin: IBM WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the Admin Console (CVE-2022-34336)

Summary IBM WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to cross-site scripting in the Admin Console CVE-2022-34336 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Due to use of Apache Commons, IBM Cloud PAK for Watson AI Ops is vulnerable to remote code execution (CVE-2022-33980)

Summary Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that...