CVE-2023-42015

IBM UrbanCode Deploy (UCD) versions affected: 7.1 up to 7.1.2.14, 7.2 up to 7.2.3.7, and 7.3 up to 7.3.2.2 are vulnerable to HTML injection in the Web UI, potentially enabling disclosure of sensitive information. Root cause is an HTML injection vulnerability in the UI. CVSS base score is 4.3 (LOW...

CVE-2023-42015 IBM UrbanCode Deploy HTML injection

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. IBM X-Force ID: 265512...

IBM UrbanCode Deploy 输入验证错误漏洞

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...

IBM UrbanCode Deploy 输入验证错误漏洞

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...

PT-2023-30337 · Ibm · Ibm Urbancode Deploy

Name of the Vulnerable Software and Affected Versions: IBM UrbanCode Deploy UCD versions 7.1 through 7.1.2.14 IBM UrbanCode Deploy UCD versions 7.2 through 7.2.3.7 IBM UrbanCode Deploy UCD versions 7.3 through 7.3.2.2 Description: The issue is related to the mishandling of input validation of an...

IBM UrbanCode Deploy 输入验证错误漏洞

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...

IBM UrbanCode Deploy Security Vulnerabilities

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from International Business Machines IBM. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different...

Security Bulletin: IBM UrbanCode Deploy (UCD) is vulnerable to a HTTP tequest smuggling vulnerability (CVE-2023-45648)

Summary Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP trailer headers. By sending a specially crafted invalid trailer header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct X...

Security Bulletin: IBM UrbanCode Deploy (UCD) is susceptible to multiple Eclipse Jetty vulnerabilities (CVE-2023-36478, CVE-2023-44487)

Summary IBM UrbanCode Deploy UCD is susceptible to multiple Eclipse Jetty denial of service vulnerabilities. Vulnerability Details CVEID:CVE-2023-36478 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an integer overflow and buffer allocation in MetaDataBuilder.checkSize...

Security Bulletin: IBM UrbanCode Deploy (UCD) is susceptible to a Denial of Serivce vulnerability (CVE-2023-47161)

Summary IBM UrbanCode Deploy UCD may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. Vulnerability Details CVEID:CVE-2023-47161 DESCRIPTION: IBM UrbanCode Deploy UCD may mishandle input validation of an uploaded archive file leadin...

Security Bulletin: IBM UrbanCode Deploy (UCD) is susceptible to multiple Apache Tomcat vulnerabilities (CVE-2023-42794, CVE-2023-42795, CVE-2023-44487)

Summary IBM UrbanCode Deploy UCD is susceptible to multiple Apache Tomcat vulnerabilities CVE-2023-42794, CVE-2023-42795, CVE-2023-44487 Vulnerability Details CVEID:CVE-2023-42794 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by accumulation of temporary files on Windows...

Security Bulletin: IBM UrbanCode Deploy (UCD) is affected by a HTTP request smuggling Vulnerability in Eclipse Jetty (CVE-2023-40167)

Summary Due to the use of Jetty IBM UrbanCode Deploy UCD is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP/1 request header. By sending a specially crafted request, a remote attacker could exploit this vulnerability to poison the web cache, bypass web application...

Security Bulletin: IBM UrbanCode Deploy (UCD) Agents as a windows service is vulnerable to a Denial Of Service (CVE-2023-42012)

Summary An IBM UrbanCode Deploy UCD Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. Vulnerability Details CVEID:CVE-2023-42012 DESCRIPTION: An IBM UrbanCode Deploy Agent installed as a Windows service in a...

Security Bulletin: IBM UrbanCode Deploy (UCD) could allow a remote attacker to obtain sensitive information (CVE-2023-42013)

Summary IBM UrbanCode Deploy UCD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Vulnerability Details CVEID:CVE-2023-42013 DESCRIPTION: IBM...

Security Bulletin: IBM UrbanCode Deploy (UCD) is susceptible to an HTML injection vulnerability (CVE-2023-42015)

Summary IBM UrbanCode Deploy UCD is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. Vulnerability Details CVEID:CVE-2023-42015 DESCRIPTION: IBM UrbanCode Deploy UCD is vulnerable ...

Security Bulletin: Vulnerability in d3-color affects IBM UrbanCode Velocity . WS-2022-0322

Summary WS-2022-0322 The d3-color module prior to 3.1.0 which Velocity was using is susceptible to a regular expression denial of service attack. Vulnerability Details IBM X-Force ID: 212233 DESCRIPTION: d3-color is vulnerable to a denial of service, caused by improper input validation. By sendin...

Security Bulletin: CVE-2022-24434 An issue was discovered in the npm package dicer

Summary This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes. Vulnerability Details CVEID:CVE-2022-24434 DESCRIPTION: Node.js...

Security Bulletin: CVE-2022-41713 An issue was discovered in deep-object-diff version 1.1.0

Summary CVE-2022-41713 deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited. Vulnerability Details...

Security Bulletin: IBM UrbanCode Release addresses multiple vulnerablities.

Summary IBM UrbanCode Release 6.2.5.11 addresses multiple vulnerablities. CVE-2023-41080, CVE-2022-40149, CVE-2022-40150, CVE-2022-45685, CVE-2023-1436, CVE-2022-45693, CVE-2023-28709, CVE-2020-13936, CVE-2023-28708, CVE-2023-34981, CVE-2019-10172, CVE-2019-10202 Vulnerability Details CVEID:...

Security Bulletin: IBM UrbanCode Release 6.2.5.11 addresses multiple vulnerablities

Summary IBM UrbanCode Release 6.2.5.11 addresses multiple vulnerablities Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function...