High 2 exploited CVEs WID-SEC-2022-1738 29 CVEs

IBM InfoSphere Information Server: Mehrere Schwachstellen

Published Oct 16, 2022 · Updated Nov 3, 2025 · Revision 5 · de-DE

Vendor: IBM Product: InfoSphere Information Server Product: QRadar SIEM Product: Tivoli Business Service Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.

Product

IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.

Vulnerabilities 29

Critical 9.8

CVE-2015-4852 Exploited Public exploit EPSS 95%

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…

openjdk-8 libcommons-collections3-java Ubuntu

Nov 18, 2015
KEV Nov 3, 2021
Critical 9.8

CVE-2015-7501 Exploited Public exploit Scanner template EPSS 86%

Deserialization of Untrusted Data in Apache commons collections

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …

commons-collections:commons-collections org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic org.apache.commons:commons-collections4 libcommons-collections3-java Debian Ubuntu Maven

Nov 9, 2017
Critical 9.8

CVE-2015-6420 Public exploit EPSS 24%

Insecure Deserialization in Apache Commons Collection

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switchin…

commons-collections:commons-collections org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic org.apache.commons:commons-collections4 net.sourceforge.collections:collections-generic Maven

Dec 15, 2015
Critical 9.8

CVE-2017-15708 Public exploit EPSS 18%

Remote Code Execution in Apache Synapse

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by inject…

Apache Software Foundation Apache Synapse org.apache.synapse:synapse-core Maven

Dec 11, 2017
Critical 9.8

CVE-2019-13116

Mulesoft Mule Unsafe Deserialization

The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections

org.mule.runtime:mule Maven

Oct 16, 2019
Critical 9.1

CVE-2022-40747

"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing …

Nov 3, 2022
High 8.8

CVE-2022-30608

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to ex…

Nov 3, 2022
High 7.8

CVE-2022-35717

"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on t…

Nov 3, 2022
High 7.5

CVE-2012-0881 EPSS 17%

Denial of service in Apache Xerces2

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

xerces:xercesImpl libxerces2-java libxerces2-java Debian Ubuntu Maven

Oct 30, 2017
High 7.5

CVE-2021-33813 EPSS 19%

XML External Entity (XXE) Injection in JDOM

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

org.jdom:jdom2 libjdom2-intellij-java libjdom2-java org.jdom:jdom Debian Ubuntu Azure Linux Maven

Jun 16, 2021
High 7.5

CVE-2021-40690

Bypass of the secureValidation property

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abus…

Apache Software Foundation Apache Santuario org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven

Sep 19, 2021
High 7.5

CVE-2022-31129

Inefficient Regular Expression Complexity in moment

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

moment moment mediawiki wordpress Debian Ubuntu npm NuGet

Jul 6, 2022
Medium 6.5

CVE-2022-22442

"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users wit…

Nov 3, 2022
Medium 6.5

CVE-2022-23437 EPSS 12%

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged durat…

Apache Software Foundation Apache Xerces xerces:xercesImpl libxerces2-java Debian Ubuntu Azure Linux Maven

Jan 24, 2022
Medium 6.5

CVE-2022-40235

"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run …

Nov 3, 2022
Medium 6.3

CVE-2021-41091 Public exploit

Insufficiently restricted permissions on data directory in Docker Engine

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing …

moby moby docker-machine-driver-harvester rancher-machine Debian Ubuntu Alpine Wolfi Go

Oct 4, 2021
Medium 5.9

CVE-2022-24769

Default inheritable capabilities for linux container should be empty

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilit…

moby moby ctop docker-machine-driver-harvester Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 24, 2022
Medium 5.5

CVE-2021-36373

Apache Ant TAR archive denial of service vulnerability

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.…

Apache Software Foundation Apache Ant javapackages-bootstrap ant Debian Ubuntu Azure Linux Alpine Maven

Jul 14, 2021
Medium 5.5

CVE-2021-36374

Apache Ant ZIP, and ZIP based, archive denial of service vulerability

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly …

Apache Software Foundation Apache Ant javapackages-bootstrap ant Debian Ubuntu Azure Linux Alpine Maven

Jul 14, 2021
Medium 5.4

CVE-2022-30615

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed…

Nov 3, 2022
Medium 5.4

CVE-2022-35642

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed…

Nov 3, 2022
Medium 5.3

CVE-2022-36109

Moby vulnerability relating to supplementary group permissions

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementa…

moby moby docker.io docker.io Debian Ubuntu Alpine Go

Sep 9, 2022
Low 2.8

CVE-2021-41089

`docker cp` allows unexpected chmod of host files

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for ex…

moby moby docker.io docker.io Debian Ubuntu Alpine Wolfi Go

Oct 4, 2021
Medium —

CVE-2009-0217

Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server…

mono org.apache.santuario:xmlsec xml-security-c xmlsec1 Debian Maven

Jul 14, 2009
Medium —

CVE-2009-2625 EPSS 30%

Denial of service in Apache Xerces2

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and applic…

xerces:xercesImpl libxerces2-java Debian Maven

Aug 6, 2009
Medium —

CVE-2012-2098 EPSS 13%

Uncontrolled Resource Consumption in Apache Commons Compress

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeat…

org.apache.commons:commons-compress libcommons-compress-java Debian Maven

Jun 29, 2012
Medium —

CVE-2013-2172

Inefficient Algorithmic Complexity in Apache Santuario XML Security

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify …

org.apache.santuario:xmlsec libxml-security-java Debian Maven

Aug 20, 2013
High —

CVE-2013-4002 Public exploit EPSS 25%

Missing XML Validation in Apache Xerces2

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u6…

xerces:xercesImpl Maven

Jul 23, 2013
Medium —

CVE-2013-4517

Improper Input Validation in Apache Santuario XML Security

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

org.apache.santuario:xmlsec libxml-security-java Debian Maven

Jan 11, 2014

Revision history

2025-11-03 #5
Neue Updates von IBM aufgenommen
2023-09-27 #4
Neue Updates von IBM aufgenommen
2023-02-15 #3
Neue Updates von IBM aufgenommen
2022-11-03 #2
CVE ergänzt
2022-10-16 #1
Initiale Fassung

References

IBM Security Bulletin: 6829353 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829353
IBM Security Bulletin: 6829371 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829371
IBM Security Bulletin: 6829373 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829373
IBM Security Bulletin: 6829335 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829335
IBM Security Bulletin: 6829311 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829311
IBM Security Bulletin: 6829369 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829369
IBM Security Bulletin: 6829325 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829325
IBM Security Bulletin: 6829365 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829365
IBM Security Bulletin: 6829361 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829361
IBM Security Bulletin: 6829339 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829339
IBM Security Bulletin: 6829349 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829349
IBM Security Bulletin: 6829363 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829363
IBM Security Bulletin: 6829327 vom 2022-10-16
https://www.ibm.com/support/pages/node/6829327
IBM Security Bulletin 6955819 vom 2023-02-15
https://www.ibm.com/support/pages/node/6955819
IBM Security Bulletin 7038982 vom 2023-09-28
https://www.ibm.com/support/pages/node/7038982
IBM Security Bulletin 7249676 vom 2025-11-03
https://www.ibm.com/support/pages/node/7249676