Security Bulletin: IBM Data Product Hub is affected by several vulnerabilities

Summary IBM Data Product Hub has a dependencies on IBM WebSphere Application Server Liberty, IBM Semeru Runtime, and Node.js elliptic & path-to-regexp modules, which are vulnerable. This bulletin contains information regarding the vulnerabilities and their fixture. Vulnerability Details...

php: host/secure cookie bypass due to partial CVE-2022-31629 fix

An improper input validation vulnerability was found in PHP. Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser...

kernel: iommu: Restore lost return in iommu_report_device_fault()

A flaw was found in the Linux kernel's input/output memory management unit iommu component. A missing return statement in the iommureportdevicefault function can lead to incorrect fault processing when a partial fault occurs. This issue can be triggered by a local attacker, potentially causing th...

JDK: Unbounded allocation leads to out-of-memory error (8331446)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;...

JDK: HTTP client improper handling of maxHeaderSize (8328286)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;...

php: host/secure cookie bypass due to partial CVE-2022-31629 fix

An improper input validation vulnerability was found in PHP. Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser...

Security update for nodejs20

This update for nodejs20 fixes the following issues: CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency bsc1233856 Other fixes: - Updated to 20.18.1: Experimental Network Inspection Support in Node.js Exposes X509VFLAGPARTIALCHAIN to tls.createSecureContext New...

Sensitive Information Exposure

Matrix-synapse is vulnerable to information disclosure. The vulnerability is due to improper handling of Sliding Sync, which can leak partial room state changes to users who are no longer in a room, while non-state events remain unaffected...

Oracle Siebel CRM 8.1.1.x < 8.1.1.11 / 8.2.2.x < 8.2.2.4 (October 2013 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2013 CPU advisory. - Vulnerability in the Siebel Core - Server Infrastructure component of Oracle Siebel CRM subcomponent: SISNAPI & Network Infrastructu. Supported...

Oracle Siebel Server (July 2024 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory. - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Repository Utilities zlib. Supported versions that are affected...

Oracle Siebel Server 8.5.1.x <= 8.5.1.7 / 8.6.0 / 8.6.1 (April 2019 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2019 CPU advisory. - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM subcomponent: Information Manager Console Apache Xalan. Supported versions...

Oracle Siebel CRM (January 2014 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2014 CPU advisory. - Vulnerability in the Siebel Life Sciences component of Oracle Siebel CRM subcomponent: Clinical Trip Report. Supported versions that are affect...

Oracle Siebel CRM (January 2013 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2013 CPU advisory. - Vulnerability in the Siebel CRM component of Oracle Siebel CRM subcomponent: Siebel Calendar. Supported versions that are affected are 8.1.1 an...

Oracle Siebel CRM 8.1.1.x < 8.1.1.11 (October 2013 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected a vulnerability as referenced in the October 2013 CPU advisory. - Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM subcomponent: Web Services. The supported version that is affected is 8.1.1. Easily...

Oracle Siebel Server (April 2019 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the April 2019 CPU advisory. - Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM subcomponent: Integration - Scripting. The supported version that...

Leak partial content of the heap through heap buffer over-read in mysqlnd

...

ROS-20241209-02

A vulnerability in some IntelR TDX modules is related to improper input validation. Exploitation of the vulnerability could allow a privileged attacker to potentially escalate privileges through local access. Vulnerability related to processor instruction sequencing causes unexpected behavior on...

CVE-2024-47791

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and from devices...

CVE-2024-47791

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and from devices...

CVE-2024-47791

CVE-2024-47791 affects Ruijie Reyee OS (MQTT broker) versions 2.206.x up to but not including 2.320.x. The issue is a weak mechanism around topic handling that could let an attacker subscribe to partial possible topics and receive partial messages exchanged with devices. Several connected sources...