Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server shipped with IBM Security Identity Manager due to Oct 2021 - Includes Oracle October 2021 CPU (minus CVE-2021-35550/35561/35603) plus CVE-2021-41035

Summary IBM WebSphere Application Server is shipped with IBM Security Identity Manager about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM PowerVM Novalink is vulnerable because Dojo cloud allow a remote attacker to execute arbitrary code on the system due to WebSphere Liberty. (CVE-2021-23450)

Summary IBM PowerVM Novalink is vulnerable because Dojo cloud allow a remote attacker to execute arbitrary code on the system due to WebSphere Liberty, caused by a prototype pollution in the setObject function. By sending a specially-crafted request, an attacker could exploit this vulnerability t...

Security Bulletin: Client-side HTTP Parameter Pollution in WAS Intelligent Management Admin console

Summary Client-side HTTP Parameter Pollution in WAS Intelligent Management Admin console. TWAS pen testing uncovered an issue with the admin console that allows Client-side HTTP Parameter Pollution. The user must be navigating the affected resources. Client-side HTTP parameter pollution HPP...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary WebSphere Application Server configured with a federated repository is vulnerable to information disclosure. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary There is a vulnerability in the Dojo library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary IBM WebSphere Application Server traditional is vulnerable to an XML External Entity XXE Injection vulnerability Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injectio...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by InfoSphere Master Data Management

Summary WebSphere Application Server is vulnerable to a directory traversal vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20354 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management 11.6

Summary IBM WebSphere Application Server 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 184585. Vulnerability Details CVEID: CVE-2020-4589 DESCRIPTION: IBM WebSphere...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management 11.6

Summary IBM WebSphere Application Server ND 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured. Vulnerability Details CVEID: CVE-2020-4575 DESCRIPTION: IBM WebSphere Application Server ND 8.5 and 9.0...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management 11.6

Summary IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590. Vulnerability Details CVEID:...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary IBM WebSphere Application Server 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370. Vulnerability Details CVEID:...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary WebSphere Application Server Admin Console is vulnerable to cross-site scripting. This has been addressed. Vulnerability Details CVEID: CVE-2020-4578 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary WebSphere Application Server is vulnerable to an information disclosure vulnerability Vulnerability Details CVEID: CVE-2020-4629 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary Security Bulletin: WebSphere Application Server is vulnerable to an information disclosure vulnerability CVE-2020-4576. WebSphere Application Server is vulnerable to an information disclosure vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2020-4576 DESCRIPTION: I...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary There is a potential denial of service in the Admin Console of WebSphere Application Server. Vulnerability Details CVEID: CVE-2019-4270 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery SSRF. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502. Vulnerability Details CVEID:...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by InfoSphere Master Data Management 11.6

Summary IBM WebSphere Application Server Network Deployment 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228. Vulnerability Details CVEID: CVE-2020-4448 DESCRIPTION: IBM...

Security Bulletin: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.

Summary We are impacted as we ship WAS in docker image. As per security bulletin: https://www.ibm.com/support/pages/security-bulletin-information-disclosure-vulnerability-websphere-application-server-cve-2019-4441. For V9.0.0.0 through 9.0.5.1: · Upgrade to minimal fix pack levels as required by...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management 11.6

Summary IBM WebSphere Application Server 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 160201. Vulnerability Details CVEID:...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to read and delete arbitrary files on the system. IBM X-Force ID:...