14 matches found
Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update
Summary Identity Insight customers are advised to update IBM WebSphere Liberty Profile WLP to version 26.0.0.4 for security update in WLP. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|-...
wLp tokens could be stolen
Lines of code Vulnerability details PosManagerremoveCollateralWLpTo function allows users to remove collateral wrapped in a wLp token that was previously supplied to the protocol: File: PosManager.sol 249: function removeCollateralWLpTouint posId, address wLp, uint tokenId, uint amt, address...
Delisted wLp still could be used for collateralization by changing position mode
Lines of code Vulnerability details Protocol governor address has the power to whitelist and delist wLp addresses using the ConfigsetWhitelistedWLps function. Only whitelisted wLp tokens are allowed to collateralize and de-collateralize users' positions: File: InitCore.sol 244: function...
A wLP collateral that is no longer whitelisted but was at some point won't let users decollateralize or be liquidated
Lines of code Vulnerability details Impact Users who collateralized using wLP won't ever be liquidated unless the wLP is whitelisted back, but this could be dangerous depending on the reason it was removed from the whitelist. They can't also decollateralize. The severity of this issue depends...
In case if wLP will be blacklisted then user will not be able to withdraw it
Lines of code Vulnerability details Proof of Concept When users deposit wLP tokens as collateral, then they are checked to be whitelisted. Later, it's possible that for some reason wLP token will be backlisted by governor. And once it's done, then users, who already used that wLP tokens as...
Should count pending harvest reward and already harvested reward as collateral credit if the collateral is WLP
Lines of code Vulnerability details Impact Should count pending harvest reward and already harvested reward as collateral credit if the collateral is WLP Proof of Concept User can use WLP as collateral, even use WLP purely as collateral to borrow fund from lending pool the collateral worth of WLP...
Security Bulletin: Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights
Summary Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights Vulnerability Details CVEID:CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting i...
Security Bulletin: Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights
Summary Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights Vulnerability Details CVEID:CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE attack when processing XML...
Security Bulletin: Updating OpenJDK in Identity Insight 10.0 to 17.0.3
Summary This document provides instructions on how to upgrade OpenJDK used in IBM InfoSphere Identity Insight II 10.0 to 17.0.3. Vulnerability Details This document provides instructions on how to upgrade OpenJDK used in IBM InfoSphere Identity Insight II 10.0 to 17.0.0.3. NOTE: Please substitute...
Security Bulletin: Updating OpenJDK in Identity Insight 10.0 to 17.0.3
Summary This document provides instructions on how to upgrade OpenJDK used in IBM InfoSphere Identity Insight II 10.0 to 17.0.3. Vulnerability Details This document provides instructions on how to upgrade OpenJDK used in IBM InfoSphere Identity Insight II 10.0 to 17.0.0.3. NOTE: Please substitute...
Security Bulletin: Updating OpenJDK in Identity Insight 10.0 to 17.0.2
Summary This document provides instructions on how to upgrade OpenJDK used in IBM InfoSphere Identity Insight II 10.0 to 17.0.2. Vulnerability Details This document provides instructions on how to upgrade OpenJDK used in IBM InfoSphere Identity Insight II 10.0 to 17.0.0.2. NOTE: Please substitute...
Security Bulletin: Vulnerabilities in Websphere Liberty server (WLP) affects IBM Cloud Application Business Insights
Summary Vulnerabilities in Websphere Liberty server WLP affects IBM Cloud Application Business Insights Vulnerability Details CVEID: CVE-2020-4590 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is...
CVE-2008-0865
BEA WebLogic Portal 8.1 through SP6 contains an unspecified vulnerability that allows remote attackers to bypass entitlements for instances of a floatable WLP portlet via unknown vectors. The available records do not specify the root cause, affected subcomponents, or a concrete exploit method. Th...
