Security Bulletin: IBM DB2 used by IBM Security Verify Governance, Identity Manager virtual appliance component has multiple vulnerabilities

Summary Information about security vulnerabilities affecting IBM DB2 has been published in security bulletins. IBM Security Verify Governance, Identity Manager virtual appliance component ships with IBM DB2. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Vulnerability for remote code execution fixed in IBM Security Verify Governance [CVE-2023-26119]

Summary The following security vulnerability for HtmlUnit has been addressed in IBM Security Verify Governance. CVE-2023-26119 Vulnerability Details CVEID:CVE-2023-26119 DESCRIPTION: HtmlUnit could allow a remote attacker to execute arbitrary code on the system, caused by an XSTL code injection...

Security Bulletin: Vulnerability for path traversal fixed in IBM Security Verify Governance

Summary The following security vulnerability has been addressed in IBM Security Verify Governance. Vulnerability Details IBM X-Force ID: 220912 DESCRIPTION: Apache HttpComponents Client could allow a remote attacker to traverse directories on the system, caused by improper validation of user...

Security Bulletin: Multiple vulnerabilities for IBM WebSphere Application Server addressed in IBM Security Verify Governance (CVE-2022-39161, CVE-2023-24998, CVE-2023-27554)

Summary Multiple security vulnerabilities for IBM WebSphere Application Server traditional and Liberty have been addressed in IBM Security Verify Governance - Identity Manager Virtual Appliance component. Vulnerability Details CVEID:CVE-2022-39161 DESCRIPTION: IBM WebSphere Application Server 7.0...

Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager Virtual Appliance

Summary Multiple security vulnerabilities for open source components used in IBM Security Verify Governance, Identity Manager - Virtual Appliance component have been addressed. Vulnerability Details CVEID:CVE-2020-7729 DESCRIPTION: Node.js grunt module could allow a remote authenticated attacker ...

Security Bulletin: A security vulnerability has been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component (CVE-2022-3676)

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type chec...

PT-2023-17960 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a side channel information disclosure in the verifyInputEvent function of InputDispatcher.cpp. This could lead to local escalation of privilege, requiring System execution...

libssh: authorization bypass in pki_verify_data_signature

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepkiverifydatasignature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the retu...

CVE-2023-2422

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...

CVE-2022-48334

Widevine Trusted Application TA 5.0.0 through 5.1.1 has a drmverifykeys totallen+filenamelen integer overflow and resultant buffer overflow...

CVE-2022-48333

Widevine Trusted Application TA 5.0.0 through 5.1.1 has a drmverifykeys prefixlen+featurenamelen integer overflow and resultant buffer overflow...

Widevine 输入验证错误漏洞

Widevine is a proprietary digital rights management DRM system from Widevine, Inc. A security vulnerability exists in Widevine Trusted Application TA versions 5.0.0 through 5.1.1, which stems from an integer overflow in drmverifykeys prefixlen+featurenamelen...

PT-2023-15712 · Google · Widevine Trusted Application

Name of the Vulnerable Software and Affected Versions: Widevine Trusted Application TA versions 5.0.0 through 5.1.1 Description: The issue is related to an integer overflow and resultant buffer overflow in the drm verify keys function, specifically with the prefix len+feature name len calculation...

PT-2023-15713 · Google · Widevine Trusted Application

Name of the Vulnerable Software and Affected Versions: Widevine Trusted Application TA versions 5.0.0 through 5.1.1 Description: The issue is related to an integer overflow and resultant buffer overflow in the drm verify keys function, specifically with the total len+file name len calculation. Th...

onlinemerker.com Cross Site Scripting vulnerability OBB-3457445

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

gotoastro.com Cross Site Scripting vulnerability OBB-3456095

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM Security Verify Governance, Identity Manager virtual appliance component vulnerable to spoofing attacks (CVE-2022-38712)

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2022-38712 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to...

Security Bulletin: Vulnerability for Dojo fixed in IBM Security Verify Governance [CVE-2021-23450]

Summary Security Vulnerability for Dojo component has been fixed in IBM Security Verify Governance CVE-2021-23450 Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the setObject...

Security Bulletin: IBM Security Verify Governance uses components with known vulnerabilities (CVE-2021-22696, CVE-2021-30468, CVE-2020-1954)

Summary Components with the following Known Vulnerabilities have been upgraded in IBM Security Verify Governance. Vulnerability Details CVEID:CVE-2021-22696 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by improper validation of requesturi parameter by the OAuth 2...

GHSA-455C-VQRF-MGHR Mattermost Server Missing Authorization vulnerability

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps...