Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor

Summary IBM Business Automation Workflow Configuration Editor is vulnerable to multiple attacks. Vulnerability Details CVEID:CVE-2022-24999 DESCRIPTION: Express.js Express is vulnerable to a denial of service, caused by a prototype pollution flaw in qs. By adding or modifying properties of...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Golang Go

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Golang Go. Vulnerability Details CVEID:CVE-2022-27664 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted request, a remote...

Security Bulletin: CVE-2022-3509, CVE-2022-3171 may affect IBM CICS TX Advanced

Summary WebSphere Application Server Liberty is vulnerable to denial of service due to Google protobuf-java . This affects IBM WebSphere Liberty used by IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-3509 DESCRIPTION: protobuf-ja...

Security Bulletin: A vulnerability in OpenSSL affects the IBM FlashSystem models 840 and 900 (CVE-2015-3194)

Summary There is a vulnerability in OpenSSL to which the IBM® FlashSystem™ 840 and IBM FlashSystem 900 are susceptible. An exploit of this vulnerability could cause a system to crash. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a...

Security Bulletin: Multiple vulnerabilities affect the IBM FlashSystem models 840 and 900

Summary Multiple vulnerabilities exist in IBM FlashSystem™ 840 and FlashSystem 900. Vulnerability Details CVEID : CVE-2018-1433 DESCRIPTION : IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products' web handler /DownloadFile does not require authentication to...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to SnakeYaml code execution (CVE-2022-1471)

Summary Potential code execution vulnerability in snakeYAML-CVE-2022-1471 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote...

Security Bulletin: IBM CICS TX Standard is vulnerable to HTML injection (CVE-2022-34160)

Summary IBM CICS TX Standard could allow a remote attacker to inject malicious HTML code. The fix removes this vulnerability CVE-2022-34160 from IBM CICS TX Standard. Vulnerability Details CVEID:CVE-2022-34160 DESCRIPTION: IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A...

Security Bulletin: A vulnerability (CVE-2022-24839) in WebSphere Application Server Liberty affects IBM CICS TX Standard

Summary WebSphere Application Server Liberty is used by IBM CICS TX Standard. The fix removes vulnerability CVE-2022-24839, in the Neko HTML library used by IBM WebSphere Application Server Liberty, that could allow a remote attacker to cause a denial of service condition. Vulnerability Details...

Security Bulletin: IBM CICS TX Advanced is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22476)

Summary WebSphere Application Server Liberty is used by IBM CICS TX Advanced to provide a web based administration console. The fix removes the identity spoofing vulnerability CVE-2022-22476 from Liberty. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server...

Security Bulletin: IBM MQ Appliance is vulnerable to identity spoofing (CVE-2022-22476)

Summary IBM MQ Appliance has resolved an identity spoofing vulnerability. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42003)

Summary There is a vulnerability in FasterXML jackson-databind used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE CVE-2022-42003. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js command execution vulnerability (CVE-2022-43548)

Summary Potential command execution vulnerability in Node.js CVE-2022-43548 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-43548 DESCRIPTION: Node.js could allow a remote attack...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Node.js follow-redirects is used by IBM Robotic Process Automation as part of API Server functionality CVE-2022-0536. Madialize URI.js module for NPM is used by IBM Robotic Process Automation as par...

Security Bulletin: Vulnerabilities in Spring Framework affects IBM Common Licensing's Administration And Reporting Tool (ART) and its Agent (CVE-2022-22978, 220811)

Summary Security Vulnerablities have been addressed in IBM Common Licensing. In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. A fix is available to address the vulnerability...

Security Bulletin: IBM App Connect Enterprise Discovery Connector nodes are vulnerable to a loss of confidentiality due to CVE-2022-42439

Summary IBM App Connect Enterprise contains an unspecified vulnerability in the Discovery Connector nodes which may cause a 3rd party system's credentials to be exposed to a privileged attacker. The fix provided resolves the vulnerability. Vulnerability Details CVEID:CVE-2022-42439 DESCRIPTION: I...

Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2023

Summary In addition to many updates of operating system level packages, the following security vulnerability is addressed with IBM Cloud Pak for Business Automation 21.0.3-IF017 and 22.0.2-IF001. Vulnerability Details CVEID:CVE-2022-25887 DESCRIPTION: Node.js sanitize-html module is vulnerable to...

Security Bulletin: Multiple Security vulnerabilities in Java may affect IBM Robotic Process Automation for Cloud Pak (CVE-2022-21618, CVE-2022-21619, CVE-2022-21624, CVE-2022-21626, CVE-2022-21628, CVE-2022-39399)

Summary There are multiple security vulnerabilities in the Java used by IBM Robotic Process Automation as part of the it's infrastructure, license management, NLP, and UMS capability. This bulletin identifies the security fixes to apply to address the vulnerabilities. Vulnerability Details...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libexpat (CVE-2022-25313)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service caused by a stack exhaustion in the buildmodel component of libexpat CVE-2022-25313. Libexpat is used as part of the base image included in our service components. Please read the details...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer over-read flaw in Linux Kernel (CVE-2020-28915)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer over-read flaw in Linux Kernel CVE-2020-28915. This Linux Kernel is used as part of the base image included in our service components. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in cURL libcurl (CVE-2022-22576).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass caused by improper authentication validation in cURL libcurl CVE-2022-22576. cURL libcurl is used as part of the base image included in our service components. Please read the...

Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix

Summary A vulnerability in Apache CXF affecting WebSphere Liberty JAX-WS has been fixed in Liberty: 20.0.0.5. This fix is included in ICP Watson Text to Speech, Speech to Text v1.1.2 GA: 6/19/20. Vulnerability Details CVEID:CVE-2019-17573 DESCRIPTION: Apache CXF is vulnerable to cross-site...

Security Bulletin: AIX is affected by a root privilege escalation vulnerability (CVE-2022-41290)

Summary A vulnerability in the AIX rmmlcachefile user command could allow a non-privileged local user to obtain root privileges CVE-2022-41290. Vulnerability Details CVEID:CVE-2022-41290 DESCRIPTION: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to webpack loader-utils CVE-2022-37603

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to webpack loader-utils CVE-2022-37603 with details below. Vulnerability Details CVEID:CVE-2022-37603 DESCRIPTION: webpack loader-utils is vulnerable to a denial of service, caused by a regular...

Security Bulletin: Vulnerabilities in Log4j affects IBM Cloud Application Business Insights CVE-2021-44228

Summary Vulnerabilities in Log4j CVE-2021-44228 affects IBM Cloud Application Business Insights Vulnerability Details CVEID:CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled...

Security Bulletin: Multiple Vulnerabilities in base image packages affect IBM Voice Gateway

Summary Security Vulnerabilities in base image packages affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-37434 DESCRIPTION: zlib is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by inflate in inflate.c. By usi...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Transformation Advisor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.25 used by IBM Cloud Transformation Advisor. IBM Cloud Transformation Advisor has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates in April 2019. Vulnerability...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to arbitrary code execution due to CVE-2022-1355

Summary LibTIFF is not used directly by IBM App Connect Enterprise Certified Container but is present in the DesignerAuthoring image used for mapping assistance, which may be vulnerable to arbitrary code execution or denial of service. This bulletin provides patch information to address the...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the postgresql connector code may be vulnerable to SQL Injection due to [CVE-2022-35942]

Summary The postgresql Loopback connector is available in the IntegrationServer image from IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container does not use this component directly but it is available for use by an application developed to run in an...

Security Bulletin: Vulnerability in Netty shipped with IBM Operations Analytics - Log Analysis (CVE-2019-20444)

Summary Netty prior to version 4.1.44 is vulnerable to HTTP request smuggling. Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw in the HttpObjectDecoder.java. By sending a specially-crafted request, an attacker could exploit...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.5. Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw in the HttpObjectDecoder.java. By sending a specially-crafted request, an attacker cou...

Security Bulletin: JQuery UI shipped with IBM Tivoli Netcool Impact is vulnerable to XSS (CVE-2022-31160)

Summary JQuery UI is used by IBM Tivoli Netcool Impact as part of its UI framework. Information about a security vulnerability affecting JQuery UI has been published in a security bulletin. Vulnerability Details CVEID:CVE-2022-31160 DESCRIPTION: jQuery UI is vulnerable to cross-site scripting,...

Security Bulletin: IBM MQ is vulnerable to an issue within the Zlib library (CVE-2018-25032)

Summary An issue was identified within the Zlib library that affects IBM MQ. IBM MQ uses Zlib to perform message compression. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many...

Security Bulletin: Tivoli Storage Productivity Center - Oracle CPU June 2013

Abstract Multiple security vulnerabilities exist in the IBM Java SDK that is shipped with Tivoli Storage Productivity Center. Content Tivoli Storage Productivity Center is shipped with an IBM Java SDK that is based on the Oracle JDK. Oracle has released June 2013 critical patch updates CPU which...

Security Bulletin: Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities

Abstract Storwize V7000 Unified includes multiple software components for which the vendors have provided fixes for security vulnerabilities in such components. Content VULNERABILITY DETAILS: CVE ID: Vendor| Vendor ID| Vendor Title| Included CVEs ---|---|---|--- Red Hat| RHSA-2013-0587| Moderate:...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2015-3183)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Aviation, Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation,...

Security Bulletin: Vulnerability in IBM WebSphere Application Server affects WebSphere Process Server and WebSphere Process Server Hypervisor Editions (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM WebSphere Application Server Full Profile and IBM WebSphere Application Server Hypervisor Edition that is used by WebSphere Process Server and WebSphere Process Server Hypervisor Editions...

Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)

Summary Security vulnerabilities have been reported for IBM SDK for Node.js. IBM Business Automation Workflow and IBM BPM include a stand-alone tool for editing configuration properties files that is based on IBM SDK for Node.js. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is...

Security Bulletin: qs (QueryString) package in the Service Portal of IBM Control Desk is vulnerable (CVE-2014-7191 and CVE-2017-1000048)

Summary As per the BlackDuck Scan, there is one package qs QueryString which is vulnerable in the Service Portal. The qs QueryString package is coming from multer modules installed as npm package. Vulnerability Details CVEID:CVE-2014-7191 DESCRIPTION: Node.js is vulnerable to a denial of service,...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2022-22365)

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Netcool Operations Insight v1.6.5 contains fixes for multiple security vulnerabilities.

Summary Security Bulletin: Netcool Operations Insight v1.6.5 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2021-44521 DESCRIPTION: Apache Cassandra could allow a remote authenticated attacker to execute arbitrary code on the system...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2014-3509, CVE-2014-3511)

Summary There are multiple vulnerabilities in OpenSSL that is used by IBM Systems Director. These issues were disclosed on August 6, 2014 by the OpenSSL Project. Vulnerability Details Abstract There are multiple vulnerabilities in OpenSSL that is used by IBM Systems Director. These issues were...

Security Bulletin: Multiple vulnerabilities in zlib affects IBM Common Inventory Technology (CIT)

Summary zlib compression library is vulnerable to a denial of service attack. By persuading a victim to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to...

Security Bulletin: Vulnerability in Diffie-Helman ciphers affects IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis (CVE-2015-4000)

Summary The LogJam Attack on Diffie-Hellman ciphers affects IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis. Vulnerability Details CVEID : CVE-2015-4000 DESCRIPTION : The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure t...

Security Bulletin: IBM Security SOAR is using a component with multiple known vulnerabilities - IBM JDK 8.0.7.6

Summary IBM® Security SOAR includes an older version of IBM JDK that may be identified and exploited. An update has been released which addresses these issues. The version of IBM JDK included in the latest version of SOAR App Host and IBM Security Soar is 8.0.7.10. Vulnerability Details...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects Rational Service Tester (CVE-2021-35550)

Summary A vulnerability in IBM SDK Java Version 1.8 and IBM Runtime Environment Java Version 1.8 used by Rational Service Tester. Rational Service Tester has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to th...

Security Bulletin: Multiple Vulnerabilities in Expat component shipped with IBM Rational ClearCase ( CVE-2022-23852, CVE-2022-23990, CVE-2022-25235, CVE-2022-25315 )

Summary libexpat is a stream-oriented XML parser library used by IBM Rational ClearCase. IBM Rational ClearCase has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-23852 DESCRIPTION: Expat aka libexpat could allow a remote attacker to execute arbitrary code on the system, caus...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple vulnerabilities due to its use of IBM JAVA (CVE-2021-35560, CVE-2021-35578, CVE-2021-35565, CVE-2021-35603)

Summary IBM Java is the runtime environment used by several components in IBM Cloud Pak for Multicloud Management Monitoring and contains several security vulnerabilities. Vulnerability Details CVEID: CVE-2021-35560 DESCRIPTION: An unspecified vulnerability in Java SE related to the Deployment...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors

Summary There are multiple vulnerabilities in OpenSSL which is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsi...

Security Bulletin: IBM QRadar Network Security is affected by Vulnerability in OpenSSH. (CVE-2021-41617)

Summary IBM QRadar Network Security has addressed vulnerability in OpenSSH. The issue could allow a local attacker to gain elevated privileges on the system. Vulnerability Details CVEID:CVE-2021-41617 DESCRIPTION: OpenSSH could allow a local attacker to gain elevated privileges on the system,...

Security Bulletin: IBM Analytic Accelerator Framework for Communication Service Providers & IBM Customer and Network Analytics for Communications Service Providers and Datasets Impacted by Log4j Vulnerabilities ( CVE-2021-44832)

Summary Apache Log4j is used by as part of its logging infrastructure by IBM Analytic Accelerator Framework for Communication Service Providers AAF and IBM Customer and Network Analytics for Communications Service Providers and Datasets CNA. These products are vulnerable to CVE-2021-44832. The fi...