Security Bulletin: CICS Transaction Gateway for Multiplatforms

Abstract Multiple security vulnerablilities exist in the JREs shipped with CICS TG for client applications. CICS TG itself is not vulnerable to these risks but client side applications using the JREs might be. You will need to evaluate your own code to determine if you are vulnerable. Content...

Security Bulletin: Vulnerability in SSLv3 affects IBM Data Studio Web Console (CVE-2014-3566)

Abstract SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Data Studio Web Console. Content Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : IBM Data Studio Web Console could allow a remo...

Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling External Authentication Server (CVE-2013-1571, CVE-2013-1500, CVE-2013-0443, CVE-2013-0440, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling External Authentication Server has security vulnerabilities in its Javadoc, and in SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID: CVE-2013-1571 DESCRIPTION: The Javadoc documentation generated for the Sterling...

Security Bulletin: Multiple vulnerabilities in IBM Rational Policy Tester (CVE-2013-0531, CVE-2013-0440, CVE-2013-4062, CVE-2013-4061, CVE-2013-2407)

Abstract Previous releases of IBM Rational Policy Tester are affected by multiple vulnerabilities reported in 3rd party components bundled with the product as well as in proprietary IBM code. These vulnerabilities include Java components, weak cipher suites, invalid certificate warnings and URL...

Security Bulletin: TADDM: Vulnerabilities in embedded JRE

Abstract Multiple security vulnerabilities exist in the Java Runtime Environments JREs IBM JRE 5.0 Service Release 15 or earlier, and non-IBM Java 5.0 or earlier, that can affect the security of IBM Tivoli Application Dependency Discovery Manager. Content VULNERABILITY DETAILS: CVEID: CVE-2013-14...

Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling Secure Proxy (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling Secure Proxy Configuration Manager has security vulnerabilities that affect SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID : CVE-2013-0440 DESCRIPTION: A vulnerability in Java Runtime Environment allows remote...

Security Bulletin: InfoSphere Optim Performance Manager affected by vulnerability in IBM JAVA JRE (CVE-2013-0169)

Abstract IBM InfoSphere Optim Performance Manager uses the IBM Java Runtime Environment JRE and is affected by a vulnerability in the IBM JRE. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0169 DESCRIPTION: The TLS protocol does not properly consider timing side-channel attacks, which allows...

Security Bulletin: IBM InfoSphere Optim Performance Manager affected by vulnerability in IBM Java Runtime Environment (CVE-2013-4002)

Abstract Unspecified vulnerability in the IBM Java Runtime Environment JRE in IBM Java allows remote attackers to affect availability via unknown vectors. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-4002 CVSS: CVSS Base Score: 7.1 CVSS Temporal Score: See...

Security Bulletin: IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway can be affected by vulnerabilities in the Websphere IBM Java Runtime Environment (CVE-2013-2407)

Abstract Vulnerability in the Java Runtime Environment component of Oracle Java SE Content VULNERABILITY DETAILS: DESCRIPTION: CVE-2013-2407 A unspecified vulnerability in the Websphere IBM Java Runtime Environment JRE component allows remote attackers to affect the confidentiality and availabili...

Security Bulletin: Multiple vulnerabilities in IBM DB2 Performance Expert and IBM InfoSphere Optim Performance Manager due to vulnerabilities in IBM Java Runtime Environment (CVE-2012-1720, CVE-2012-5081).

Abstract DB2® Performance Expert and InfoSphere® Optim™ Performance Manager use the IBM® Java™ Runtime Environment JRE and might be affected by vulnerabilities in the IBM JRE. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-1720 DESCRIPTION: An unspecified vulnerability in the JRE component allow...

Security Bulletin: IBM Tivoli Directory Integrator can be affected by a vulnerability in IBM Java Runtime Environment (CVE-2012-5081)

Abstract The JDK’s TLS implementation may not check the TLS vector length as set out in the Internet Engineering Task Force Request For Comments RFC 5246. The fix enhances the checking for the vector length. Content VULNERABILITY DETAILS: DESCRIPTION: The JDK's TLS implementation may not check th...

Security Bulletin: IBM InfoSphere Master Data Management Reference Data Management Hub affected by a vulnerability in the IBM JRE used by WebSphere Application Server (CVE-2012-5081)

Abstract An unspecified vulnerability in the Java Runtime Environment JRE allows remote attackers to affect availability, related to JSSE. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-5081 CVSS Base Score: 5 CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/79435 fo...

Security Bulletin: IBM Tivoli Federated Identity Manager can be affected by a vulnerability in IBM Java Runtime Environment (CVE-2012-5081)

Abstract A vulnerability in the Java Runtime Environment JRE impacts IBM Tivoli Federated Identity Manager Content VULNERABILITY DETAILS: DESCRIPTION: An unspecified vulnerability in the Java Runtime Environment JRE component allows remote attackers to affect availability, related to JSSE. The...

Security Bulletin: IBM Tivoli Federated Identity Manager Business Gateway can be affected by a vulnerability in IBM Java Runtime Environment (CVE-2012-5081)

Abstract A vulnerability in the Java Runtime Environment JRE impacts IBM Tivoli Federated Identity Manager Business Gateway Content VULNERABILITY DETAILS: DESCRIPTION: An unspecified vulnerability in the Java Runtime Environment JRE component allows remote attackers to affect availability, relate...

GHSA-Q979-9M39-23MQ Nepxion Discovery vulnerable to SpEL Injection leading to Remote Code Execution

Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as...

CVE-2022-35893

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM...

CVE-2022-32782

This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information...

CVE-2022-32781

This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8. An app with root privileges may be able to access private information...

CVE-2022-32782

This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information...

Information disclosure

This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information...