Vulnerability fixed in IBM MQ

A vulnerability has been fixed in MQ Internet Pass-Thru. The vulnerability allows a local malicious party to potentially see sensitive information in trace files of the application when this feature is enabled. IBM has released updates to fix the vulnerabilities in MQ. For more information, see:...

IBM MQ Internet Pass-Thru 日志日志信息泄露漏洞

IBM MQ Internet Pass-Thru is an International Business Machines IBM product for supporting the implementation of messaging between remote sites on the Internet. The product is an extended functionality component of IBM MQ that serves as a protocol channel or proxy for establishing protocols durin...

PT-2022-35038 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns the RCU Tasks Trace loops not having quiescent states. This is an automated identification of a potential security issue, but its actual impact and attack plausibility have...

kernel: scsi: lpfc: Fix call trace observed during I/O with CMF enabled

A vulnerability has been identified in the lpfc module within the Linux kernel. This flaw occurs because the driver attempts to access per-CPU data from a preemptible context using an incorrect function. This improper handling of critical data can lead to system instability and result in a...

PT-2022-20978 · Gl.Inet · Gl-Inet Gl-Ax1800 Flint +1

Name of the Vulnerable Software and Affected Versions: gl-inet GL-MT300N-V2 Mango version 3.212 gl-inet GL-AX1800 Flint version 3.214 Description: The issue concerns command injection vulnerabilities. These vulnerabilities can be exploited via the ping addr and trace addr function parameters...

Dev Server XSS

Description The developer server unsafely renders the stack trace within errors. This can be manipulated by sending a specially crafted request. Root Cause The error-dev.vuetemplate, within @nuxt\ui-templates uses the v-html directive to render the stacktrace section of the error. vue This would...

UBUNTU-CVE-2022-39837

An issue was discovered in Connected Vehicle Systems Alliance COVESA dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference,...

dlt-daemon 缓冲区错误漏洞

Dlt-daemon is the DLT communication interface for Genivia's ECU. It collects and buffers log messages from one or more DLT users running on the ECU and makes them available to DLT clients upon request. A buffer overflow vulnerability exists in Genivia Dlt-daemon 2.18.8 and prior versions, which...

Security Bulletin: Multiple security vulnerabilities addressed in IBM Sterling Secure Proxy (CVE-2013-0518, CVE-2013-0519, CVE-2013-0520)

Abstract IBM Sterling Secure Proxy is vulnerable to spoofing and information disclosure attacks. Content VULNERABILITY DETAILS CVE ID: CVE-2013-0518 DESCRIPTION: Application Pages Do Not Break Out of 3rd Party HTML Frames. IBM Sterling Secure Proxy Configuration Manager pages permit rendering...

Security Bulletin: Tivoli Federated Identity Manager - Passwords exposed in trace files (CVE-2012-3310)

Abstract SUMMARY It is possible to configure Tivoli Federated Identity Manager TFIM in such a way that the logging of certain activities could result in the trace files produced by TFIM containing passwords that are either in clear text or obfuscated in a manner that the password can be derived...

OSV-2022-943 UNKNOWN WRITE in perfetto::trace_processor::TrackEventParser::ParseTrackDescriptor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51695 Crash type: UNKNOWN WRITE Crash state: perfetto::traceprocessor::TrackEventParser::ParseTrackDescriptor perfetto::traceprocessor::TrackEventModule::ParsePacket...

PT-2022-37301 · Perfetto · Perfetto

Name of the Vulnerable Software and Affected Versions: perfetto affected versions not specified Description: The issue is related to a crash in the perfetto trace processor. The crash occurs in the TrackEventParser::ParseTrackDescriptor function, which is called by TrackEventModule::ParsePacket a...

Security Bulletin: IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser (CVE-2016-5896)

Summary IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. Vulnerability Details CVEID: CVE-2016-5896 DESCRIPTION: IBM Maximo Asset Management could disclose sensitive information from a stack trace after...

GSD-2022-1006130 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions

spmi: trace: fix stack-out-of-bound access in SPMI tracing functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1005324 io_uring: fix io_uring_cqe_overflow trace format

iouring: fix iouringcqeoverflow trace format This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005117 ice: Fix call trace with null VSI during VF reset

ice: Fix call trace with null VSI during VF reset This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

Sensitive Information Disclosure

wildfly is vulnerable to sensitive information disclosure. It allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

PT-2022-33580 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the arm64 architecture and the selection of TRACE IRQFLAGS NMI SUPPORT. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-33375 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v5.19.3 Description: The issue is related to a potential security vulnerability in the Linux Kernel. It involves a fix for a call trace with a null VSI during VF reset. The actual impact and attack...

GHSA-FMQ7-GH8V-MJVC WildFly vulnerable to Insecure Default Initialization of Resource

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain...