Security Bulletin: A security vulnerability in Node.js braces and netmask module affects IBM Cloud Pak for Multicloud Management Managed Service

Summary A security vulnerability in Node.js braces and netmask module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2018-1109 DESCRIPTION: Node.js braces module is vulnerable to a denial of service, caused by a regular expression denial of servi...

Security Bulletin: A security vulnerability in Node.js pug and pug-code-gen module affects IBM Cloud Pak for Multicloud Management Managed Service.

Summary A security vulnerability in Node.js pug and pug-code-gen module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-21353 DESCRIPTION: Node.js pug and pug-code-gen could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: A security vulnerability in Node.js netmask module affects IBM Cloud Pak for Multicloud Management Managed Service

Summary A security vulnerability in Node.js netmask module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-28918 DESCRIPTION: Node.js netmask module is vulnerable to server-side request forgery, caused by the improper handling of mixed-format...

Security Bulletin: Vulnerability identified in XCC affects IBM Cloud Pak System (CVE-2021-3473)

Summary Vulnerability identified in Lenovo XCC component bundled with IBM Cloud Pak System. Information about vulnerability has been published in a security advisiory. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC

Summary Security Bulletin: Security vulnerabilities in Go affect IBM Cloud Pak for Multicloud Management Hybrid GRC. Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an unknown impact an...

Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring

Summary Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring. Vulnerability Details CVEID: CVE-2021-23978 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the...

Security Bulletin: A vulnerability in Java affects IBM Cloud Pak for Multicloud Management Monitoring

Summary An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecifie...

Security Bulletin: A vulnerability in Java affects IBM Cloud Pak for Multicloud Management Monitoring

Summary Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause th...

Security Bulletin: A vulnerability in Java affects IBM Cloud Pak for Multicloud Management Monitoring

Summary An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring allows certain web pages to be stored locally

Summary IBM Cloud Pak for Multicloud Management Monitoring allows certain web pages to be stored locally which potentially can be read by another user on the system. Vulnerability Details CVEID: CVE-2020-4765 DESCRIPTION: IBM Cloud Pak for Multicloud Management Monitoring allows web pages to be...

IBM Cloud Pak for Security Logic Vulnerability

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A logic vulnerability exists in IBM Cloud Pak for Security versions 1.4.0.0,...

IBM Cloud Pak for Security Malicious Data Injection Vulnerability

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A malicious data injection vulnerability exists in IBM Cloud Pak for Security...

IBM Cloud Pak for Security Information Disclosure Vulnerability (CNVD-2021-36325)

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. An information disclosure vulnerability exists in IBM Cloud Pak for Security...

IBM Cloud Pak for Multicloud Management 安全漏洞

IBM Cloud Pak for Multicloud Management is an application from IBM, USA. used to manage the default functionality of a multi-cloud environment. A security vulnerability exists in IBM Cloud Pak for Multicloud Management that allows web pages to be stored locally and can be read by other users on t...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js Vulnerability Details CVEID: CVE-2020-8237 DESCRIPTION: Node.js json-bigint module is vulnerable to a denial of service, caused by a prototype pollution flaw. By adding or modifying Object properties, a remote attacker could...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Python (CVE-2020-15801)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Python CVE-2020-15801 Vulnerability Details CVEID: CVE-2020-15801 DESCRIPTION: Python could allow a local attacker to execute arbitrary code on the system, caused by an issue with sys.path restrictions specified in a python38.pth fi...

CVE-2021-20564

IBM Cloud Pak for Security CP4S 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information usin...

CVE-2020-4811

IBM Cloud Pak for Security CP4S 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation...

CVE-2021-20564

IBM Cloud Pak for Security CP4S 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information usin...

CVE-2021-20565

IBM Cloud Pak for Security CP4S 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. IBM X-Force ID: 199236...