Security Bulletin: Vulnerabilities in OpenSSH and OpenSSL affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in OpenSSH and OpenSSL affect IBM Storage Virtualize products and could allow arbitrary code execution, authentication bypass and denial of service. CVE-2024-6387 CVE-2024-6409 CVE-2023-2975 CVE-2023-3446 CVE-2023-3817 CVE-2023-5678. Vulnerability Details CVEID:CVE-2024-63...

Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting (CVE-2024-56463)

Summary IBM QRadar SIEM is vulnerable to cross-site scripting, which could allow a privileged user to embed arbitrary JavaScript code in the Web UI. This vulnerability has been addressed in the update. Vulnerability Details CVEID:CVE-2024-56463 DESCRIPTION: IBM QRadar SIEM is vulnerable to...

Security Bulletin: IBM App Connect Enterprise Certified Container DesigneAuthoring operands are vulnerable to cross-site scripting [CVE-2024-11831]

Summary Node.js module serialize-javascript is used by IBM App Connect Enterprise Certified Container DesignerAuthoring operands. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to cross-site scripting. This bulletin provides patch information to address t...

Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)

Summary Multiple vulnerabilities have been addressed in IBM Data Virtualization on Cloud Pak for Data. Note that IBM Data Virtualization was named Watson Query in IBM Cloud Pak for Data version 4.6, 4.7, and 4.8. Vulnerability Details CVEID:CVE-2024-4067 DESCRIPTION: Node.js micromatch module is...

Security Bulletin: Vulnerability in restricted bash environment (CVE-2024-56477) affects Power HMC.

Summary The restricted bash environment is enabled in Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-56477 DESCRIPTION: IBM Hardware Management Console - Power could allow an authenticated user to traverse directories on the syste...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to command injection (CVE-2024-55904)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements. Vulnerability Details CVEID:CVE-2024-55904 DESCRIPTION: IBM DevOps Deploy / IBM...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a sensitive information disclosure (CVE-2024-54176)

Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function. Vulnerability Details CVEID:CVE-2024-54176 DESCRIPTION: IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1...

Security Bulletin: Multiple vulnerabilities found in IBM EntireX.

Summary IBM EntireX has been updated in order to address the multiple vulnerabilities CVE-2024-54171, CVE-2024-56467 & CVE-2025-0158. Vulnerability Details CVEID:CVE-2024-54171 DESCRIPTION: IBM EntireX is vulnerable to an XML external entity injection XXE attack when processing XML data. An...

Security Bulletin: Multiple Security Vulnerabilites were discovered in the IBM Verify Directory Server Container (CVE-2024-49814, CVE-2024-51450)

Summary Security Vulnerabilities have been addressed in the IBM Security Verify Directory Server Container. Vulnerability Details CVEID:CVE-2024-49814 DESCRIPTION: IBM Security Verify Access Appliance could allow a locally authenticated user to increase their privileges due to execution with...

Security Bulletin: Vulnerabilities in Flatpak affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerabilities in Flatpak has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-32462 DESCRIPTION: Flatpak could allow a local...

Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.

Summary IBM ApplinX has been updated in order to address the multiple vulnerabilities. Vulnerability Details CVEID:CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability usin...

Security Bulletin: IBM Aspera Shares is vulnerable to multiple medium vulnerabilities (CVE-2024-38317, CVE-2024-56470, CVE-2024-38316, CVE-2024-56473, CVE-2024-56472, CVE-2024-56471, CVE-2024-38318)

Summary This Security Bulletin addresses multiple medium severity vulnerabilities that have been remediated in IBM Aspera Shares 1.10.0 PL7. Vulnerability Details CVEID:CVE-2024-38317 DESCRIPTION: IBM Aspera Shares is vulnerable to cross-site scripting. This vulnerability allows a privileged user...

Security Bulletin: AIX is vulnerable to information disclosure (CVE-2024-13176) or arbitrary code execution or a denial of service (CVE-2024-9143) due to OpenSSL

Summary Vulnerabilities in OpenSSL could allow an attacker to recover a private key CVE-2024-13176 or execute arbitrary code or cause a denial of service CVE-2024-9143. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details CVEID:CVE-2024-13176 DESCRIPTION:...

Security Bulletin: Security Vulnerabilities reported against IBM Verify Identity Access and IBM Security Verify Access

Summary Multiple Security Vulnerabilities were adressed in IBM Verify Identity Access and IBM Security Verify Access. Vulnerability Details CVEID:CVE-2024-45659 DESCRIPTION: IBM Security Verify Access Appliance could allow a remote attacker to obtain sensitive information when a detailed technica...

Security Bulletin: Vulnerability in GNOME libsoup affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential vulnerability in GNOME libsoup has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-52530 DESCRIPTION: GNOME libsoup is...

Security Bulletin: Vulnerabilities in GStreamer affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerabilities in GStreamer has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-47538 DESCRIPTION: GStreamer is a library fo...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.8 LTS and 12.8.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: Security vulnerabilities discovered in IBM Security Directory Suite (CVE-2024-45650, CVE-2024-51540) have been addressed.

Summary Security vulnerabilities discovered in IBM Security Directory Suite have been addressed. Vulnerability Details CVEID:CVE-2024-45650 DESCRIPTION: IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation. CWE:CWE-754:...

Security Bulletin: A vulnerability in jQuery affects IBM Robotic Process automation and could result in cross-site scripting (CVE-2024-30875).

Summary A vulnerability in jQuery affects IBM Robotic Process automation and could result in cross-site scripting. jQuery is used by IBM Robotic Process Automation as part of the Carbon UI framework. This bulletin identifies the fixes required to address the vulnerability. Vulnerability Details...

Security Bulletin: IBM Sterling B2B Integrator is Vulnerable to Information Disclosure (CVE-2024-45089)

Summary IBM Sterling B2B Integrator has addressed the information disclosure vulnerability Vulnerability Details CVEID:CVE-2024-45089 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition EBICS server could allow an authenticated user to obtain sensitive filename information due to an...

Security Bulletin: IBM Sterling B2B Integrator is Vulnerable to Cross-Site Scripting (CVE-2024-47116)

Summary IBM Sterling B2B Integrator has addressed the Cross-Site scripting vulnerability Vulnerability Details CVEID:CVE-2024-47116 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary...

Security Bulletin: The Dashboard of IBM Sterling B2B Integrator is Vulnerable to Cross-Site Scripting (CVE-2024-47103, CVE-2024-49807, CVE-204-40696)

Summary IBM Sterling B2B Integrator has addressed the cross-site scripting security vulnerability Vulnerability Details CVEID:CVE-2024-47103 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed...

Security Bulletin: The Dashboard of the IBM Sterling B2B Integrator is Vulnerable to Cross-Site Request Forgery (CVE-2023-38739)

Summary IBM Sterling B2B Integrator has addressed the Cross-Site request forgery security vulnerability Vulnerability Details CVEID:CVE-2023-38739 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site request forgery which could allow an attacker to execute malicio...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in rack-2.0.7.gem

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of rack-2.0.7.gem Vulnerability Details CVEID:CVE-2022-44572 DESCRIPTION: Rack is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the multipart parsing component...

Security Bulletin: IBM App Connect Enterprise Certified Container operands have unnecessary external access [CVE-2022-43916]

Summary Some of the IBM App Connect Enterprise Certified Container Pods in a deployed environment have unnecessary external network access. This bulletin provides patch information to address the network access. CVE-2022-43916 Vulnerability Details CVEID:CVE-2022-43916 DESCRIPTION: IBM App Connec...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. These have been addressed in the update. Vulnerability Details CVEID:CVE-2024-46695 DESCRIPTION: In the Linux kernel, the following vulnerability has been...

Security Bulletin: IBM Aspera Faspex 5 has addressed multiple vulnerabilities (CVE-2023-37412, CVE-2023-37398, CVE-2023-37413, CVE-2023-35907)

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Aspera Faspex 5.0.11 Vulnerability Details CVEID:CVE-2023-37412 DESCRIPTION: IBM Aspera Faspex could allow a privileged user to make system changes without proper access controls. CWE:CWE-284:...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to remote code execution due to Apache Subversion (CVE-2024-45720)

Summary Apache Subversion is shipped with IBM Tivoli Netcool Impact as part of its version control for files. Information about a security vulnerability affecting Apache Subversion has been published in a security bulletin. Vulnerability Details CVEID:CVE-2024-45720 DESCRIPTION: Apache Subversion...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in logback-core

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of logback-core Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allo...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in logback-classic

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of logback-classic Vulnerability Details CVEID:CVE-2024-12798 DESCRIPTION: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in LibTIFF

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of LibTIFF Vulnerability Details CVEID:CVE-2024-6716 DESCRIPTION: libtiff is vulnerable to a denial of service, caused by an out-of-memory flaw in the TIFFReadEncodedStrip function. By persuading a victim to ope...

Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty and Open Source Software OSS components used by IBM Cognos Analytics. Additionally, Cognos Analytics is vulnerable to an XML External Entity Injection XXE. For more information about the vulnerability impact, refer to t...

Security Bulletin: A Security Vulnerability was discovered in IBM Security Verify Bridge (CVE-2024-45672)

Summary A Security Vulnerability has been addressed in IBM Security Verify Bridge. Vulnerability Details CVEID:CVE-2024-45672 DESCRIPTION: IBM Security Verify Bridge could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which could also cause a...

Security Bulletin: A vulnerability in DotNetZip affects IBM Robotic Process Automation and could allow an attacker to execute arbitrary code (CVE-2024-48510).

Summary A vulnerability in DotNetZip affects IBM Robotic Process Automation and could allow an attacker to execute arbitrary code. DotNetZip was used by IBM Robotic Process Automation for compression. This library has been replaced. This bulletin identifies the fixes required to resolve the...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to cross-site scripting (CVE-2024-51457).

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.287 Vulnerability Details CVEID:CVE-2024-47561 DESCRIPTION: Apache Avro could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in schema parsing in th...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Renwoxing Enterprise Intelligent Management System SQL injection vulnerability (CVE-2024-43040)

Summary A potential SQL injection vulnerability CVE-2024-43040 has been identified related to Renwoxing Enterprise Intelligent Management System that affects IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to java_shop arbitrary code execution vulnerabilitiy (CVE-2024-50652)

Summary A potential arbitrary code execution vulnerability CVE-2024-50652 has been identified related to javashop that affects IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-50652 DESCRIPTION:...

Security Bulletin: IBM watsonx.ai (for IBM Cloud Pak for Data) is vulnerable to cross-site scripting

Summary IBM watsonx.ai for IBM Cloud Pak for Data is vulnerable to cross-site scripting when using unauthored, 3rd party LLM prompts in the Web UI interface of the application. IBM watsonx.ai for IBM Cloud Pak for Data has addresed the applicable vulnerability. Vulnerability Details...

Security Bulletin: A vulnerability in IBM Robotic Process Autmation could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks (CVE-2024-51456).

Summary A vulnerability in IBM Robotic Process Autmation could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. This bulletin identifies the fixes or remediations available to resolve this vulnerability. Vulnerability Details...

Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to Race Condition Format Flaw (CVE-2024-41779) and Race Condition Servlet (CVE-2024-41787)

Summary IBM Engineering Requirements Management DOORS Next is vulnerable to CVE-2024-41779 Race Condition Format Flaw and CVE-2024-41787 Race Condition Servlet. Vulnerability Details CVEID:CVE-2024-41787 DESCRIPTION: IBM Engineering Requirements Management DOORS Next could allow a remote attacker...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Envoy denial of service vulnerabilitiy(CVE-2024-32475).

Summary Potential Envoy denial of service vulnerabilitiyCVE-2024-32475 has been identified that affects IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-32475 DESCRIPTION: Envoy is vulnerable to a...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Elasticsearch denial of service vulnerabilitiy(CVE-2024-23449)

Summary A potential denial of service vulnerability CVE-2024-23449 has been identified related to Elasticsearch that affects IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-23449 DESCRIPTION:...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Envoy denial of service vulnerabilitiy(CVE-2024-39305).

Summary Potential Envoy denial of service vulnerabilitiyCVE-2024-39305 has been identified that affects IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-39305 DESCRIPTION: Envoy is vulnerable to a...

Security Bulletin: Vulnerability in HAProxy (CVE-2023-45539) affects IBM Watson CP4D Data Stores

Summary A potential sensitive information disclosure vulnerability CVE-2023-45539 has been identified related to HAProxy that may affect IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-45539...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Validate.js Regular Expression Denial of Service (ReDoS) vulnerabilitiy(CVE-2020-26310)

Summary A potential Regular Expression Denial of Service ReDoSvulnerability CVE-2020-26310 has been identified related to Validate.js that affects IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Envoy denial of service vulnerabilitiy( CVE-2024-45810).

Summary Potential Envoy denial of service vulnerabilitiy CVE-2024-45810 has been identified that affects IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-45810 DESCRIPTION: Envoy is vulnerable to ...

Security Bulletin: Vulnerability in Elasticsearch (CVE-2023-49921) affects IBM Watson CP4D Data Stores

Summary A potential vulnerability CVE-2023-49921 has been identified related to Elasticsearch that may affect IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-49921 DESCRIPTION: An issue was...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2022-22491]

Summary IBM App Connect Enterprise Certified Container operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted. CVE-2022-22491 Vulnerability Details...

Security Bulletin: IBM Security QRadar EDR Software has multiple vulnerabilities ( CVE-2024-45640, CVE-2024-45100)

Summary IBM Security ReaQta is vulnerable to exposing sensitive information and denial of service.These vulnerabilities have been addressed in the latest update. Vulnerability Details CVEID:CVE-2024-45640 DESCRIPTION: IBM Security ReaQta returns sensitive information in an HTTP response that coul...