179 matches found
CVE-2024-23550 HCL DevOps Deploy / HCL Launch (UCD) may be vulnerable to sensitive information disclosure
HCL DevOps Deploy / HCL Launch UCD could disclose sensitive user information when installing the Windows agent...
CVE-2024-23550
CVE-2024-23550 affects HCL DevOps Deploy / HCL Launch (UCD). The Windows agent installer could disclose sensitive user information, with confidentiality impact described as High in the CVSS data. The provided documents do not specify the underlying root cause details or a fixed version. Public so...
CVE-2024-23550: Exposure of Sensitive Information to an Unauthorized Actor
HCL DevOps Deploy / HCL Launch UCD could disclose sensitive user information when installing the Windows agent...
CVE-2023-47161
IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. IBM X-Force ID: 270799...
CVE-2023-47161
IBM UrbanCode Deploy (UCD) is affected by CVE-2023-47161 due to mishandling input validation of an uploaded archive file, causing a denial of service from resource exhaustion. Affected versions are 7.0–7.0.5.18, 7.1–7.1.2.14, 7.2–7.2.3.7, and 7.3–7.3.2.2. Remediation guidance recommends upgrading...
CVE-2023-42013
IBM UrbanCode Deploy (UCD) contains an information-disclosure vulnerability (CVE-2023-42013) where a detailed technical error message returned in the browser can reveal sensitive information. Affected versions include 7.0 through 7.0.5.18, 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 throug...
CVE-2023-42015
IBM UrbanCode Deploy (UCD) versions affected: 7.1 up to 7.1.2.14, 7.2 up to 7.2.3.7, and 7.3 up to 7.3.2.2 are vulnerable to HTML injection in the Web UI, potentially enabling disclosure of sensitive information. Root cause is an HTML injection vulnerability in the UI. CVSS base score is 4.3 (LOW...
Security Bulletin: IBM UrbanCode Deploy (UCD) could allow a remote attacker to obtain sensitive information (CVE-2023-42013)
Summary IBM UrbanCode Deploy UCD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Vulnerability Details CVEID:CVE-2023-42013 DESCRIPTION: IBM...
CVE-2023-40376 IBM UrbanCode Deploy (UCD) improper authentication controls
IBM UrbanCode Deploy UCD 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X-Force ID: 263581...
CVE-2023-40376
CVE-2023-40376 affects IBM UrbanCode Deploy (UCD) versions 7.1‑7.3.2.x under certain configurations. The root cause is improper authentication controls that could allow an authenticated user to change environment variables. Impact described by sources: potential unauthorized modifications to envi...
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to denial of service due to Apache Tomcat (CVE-2023-28709)
Summary Apache Tomcat is used by IBM Urbancode Deploy UCD for processing web requests. Apache Tomcat is vulnerable to a denial of service, caused by an incomplete fix for CVE-2023-24998 related to the failure to limit the number of request parts to be processed in the file upload function. By...
CVE-2022-43877
IBM UrbanCode Deploy (UCD) could disclose sensitive password information when a manual edit of the agentrelay.properties file is made, due to the value not being automatically encrypted after restart. Affected versions include 6.2.0.0 to 6.2.7.19; 7.0 to 7.0.5.14; 7.1 to 7.1.2.10; 7.2 to 7.2.3.3;...
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to denial of service due to Jettison-json (CVE-2022-45693, CVE-2022-45685)
Summary Jettison-json is used by IBM UrbanCode Deploy UCD for parsing JSON data. A remote authenticated user may cause high memory usage by sending a request containing specially crafted JSON data. CVE-2022-45693, CVE-2022-45685 Vulnerability Details CVEID:CVE-2022-45693 DESCRIPTION: Jettison is...
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to denial of service due to Apache Tomcat (CVE-2023-24998)
Summary Apache Tomcat is used by IBM Urbancode Deploy UCD for processing web requests. Tomcat is vulnerable to a denial of service, caused by not limiting the number of request parts to be processed in the file upload function. By sending a specially-crafted request with a series of uploads, a...
Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to cross-site scripting ( CVE-2022-46771 )
Summary IBM UrbanCode Deploy UCD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details...
CVE-2022-46771
CVE-2022-46771 affects IBM UrbanCode Deploy (UCD) versions 6.2.0.0–6.2.7.18, 7.0.5.0–7.0.5.13, 7.1.0.0–7.1.2.9, 7.2.0.0–7.2.3.2 and 7.3.0.0, with a cross-site scripting vulnerability that can lead to arbitrary JavaScript in the Web UI and potential credentials disclosure within a trusted session....
CVE-2022-40751
CVE-2022-40751 affects IBM UrbanCode Deploy (UCD) versions: 6.2.7.0–6.2.7.17; 7.0.0.0–7.0.5.12; 7.1.0.0–7.1.2.8; 7.2.0.0–7.2.3.1. An administrator with "Manage Security" permissions could recover credentials saved for LDAP authentication, exposing sensitive data. IBM X-Force ID: 236601. The fixed...
CVE-2022-35716
CVE-2022-35716 affects IBM UrbanCode Deploy (UCD) across multiple lines: 6.2.0.0–6.2.7.16, 7.0.0.0–7.0.5.11, 7.1.0.0–7.1.2.7, and 7.2.0.0–7.2.3.0. The issue stems from improper security checks that can allow an authenticated user to obtain sensitive information in some instances (information disc...
CVE-2022-22367
CVE-2022-22367 affects IBM UrbanCode Deploy (UCD) and allows a local user to disclose sensitive database information in plain text. Affected versions are UCD 6.0.0.0–6.2.7.15 and 7.0.0.0–7.0.5.10, 7.1.0.0–7.1.2.6, and 7.2.0.0–7.2.2.1. Root cause: information disclosure in plain text stored/retrie...
