Skip to content
OpenAdvisories
Medium WID-SEC-2022-0616 2 CVEs

IBM Tivoli Network Manager: Mehrere Schwachstellen

Published Jul 7, 2022 · Updated Feb 23, 2023 · Revision 2 · de-DE

Vendor: IBM Product: Tivoli Network Manager Product: Tivoli Network Manager < 4.2.0-TIV-ITNMIP-AIX-FP0015 Product: Tivoli Network Manager < 4.2.0-TIV-ITNMIP-Linux-FP0015 Product: Tivoli Network Manager < 4.2.0-TIV-ITNMIP-zLinux-FP0015 Product: Tivoli Network Manager 4.2.0 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen offenzulegen.

Product

IBM Tivoli Network Manager ist eine Netzanalysesoftware für das Management komplexer Netze. Diese Software erfasst und verteilt Layer-2- und Layer-3-Netzdaten.

Vulnerabilities 2

  • High 7.5
    CVE-2020-25649 EPSS 18%

    XML External Entity (XXE) Injection in Jackson Databind

    A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-28169 Scanner template EPSS 78%

    Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can ret…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References