Security Bulletin: IBM Db2 used by IBM Security Verify Governance has multiple vulnerabilities

Summary IBM Security Verify Governance ISVG uses IBM Db2 database. Information about security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

CVE-2024-47120: Execution with Unnecessary Privileges

IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the host due to the containers running with unnecessary privileges...

IBM Security Verify Information Queue 安全漏洞

IBM Security Verify Information Queue is a microservices architecture integration platform that leverages Kafka technology and a publish/subscribe model to integrate data between IBMSecurity products, acting as a cross-product data exchange hub. An elevation of privilege vulnerability exists in I...

CVE-2024-45671: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2024-45669: Allocation of Resources Without Limits or Throttling

IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of special characters that could lead to uncontrolled resource consumption...

CVE-2025-58758 TinyEnv: Missing .env file not required — may cause unexpected behavior

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration,...

The vulnerability of the verify_gemtek_header() function in Linksys E5600 router microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the verifygemtekheader function in Linksys E5600 router microprogramming software is related to the use of a unstable cryptographic algorithm. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code or cause service failures...

PT-2025-36952

Name of the Vulnerable Software and Affected Versions: TinyEnv versions 1.0.1 through 1.0.2 TinyEnv versions 1.0.9 through 1.0.10 Description: TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently...

CVE-2025-48581

A logic error in the VerifyNoOverlapInSessions function within the apexd.cpp file of the Android operating system allows for a local escalation of privilege without requiring additional execution privileges or user interaction. The flaw is caused by insufficient checking of unusual or exceptional...

CVE-2025-48581

In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

...

CVE-2025-21039

CVE-2025-21039 affects Samsung S Assistant prior to version 9.3.2. The vulnerability stems from improper verification of intents in the SystemExceptionalBroadcastReceiver component, enabling local attackers to modify itinerary information. Impact details are described as local, with confidentiali...

Linux Distros Unpatched Vulnerability : CVE-2024-28835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the certtool...

PT-2025-36083

Name of the Vulnerable Software and Affected Versions Android versions affected versions not specified Description A logic error exists in the VerifyNoOverlapInSessions function within the apexd.cpp file. This issue allows local attackers to block security updates through mainline installations,...

CVE-2025-30064

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to genera...

IBM Security Verify Governance Identity Manager Information Disclosure Vulnerability (CNVD-2025-23712)

IBM Security Verify Governance Identity Manager is IBM's identity governance and management solution for centralized management of enterprise user identities and access rights. An information disclosure vulnerability exists in IBM Security Verify Governance Identity Manager 10.0.2, which stems fr...

CVE-2025-36003: Generation of Error Message Containing Sensitive Information

IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system...

ROS-20250828-06

A vulnerability in the Verify component of the Go programming language is related to incorrect assignment of permissions for a critical resource. a critical resource. Exploitation of the vulnerability could allow a remote attacker to bypass existing security restrictions. existing security...

IBM Security Verify Governance Identity Manager 安全漏洞

IBM Security Verify Governance Identity Manager is IBM's identity governance and management solution for centralized management of enterprise user identities and access rights. An information disclosure vulnerability exists in IBM Security Verify Governance Identity Manager 10.0.2, which stems fr...

Linux Distros Unpatched Vulnerability : CVE-2021-3336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA...