Skip to content
OpenAdvisories
High WID-SEC-2023-0027 14 CVEs

IBM Tivoli Network Manager: Mehrere Schwachstellen

Published Jan 4, 2023 · Updated Feb 23, 2023 · Revision 2 · de-DE

Vendor: IBM Product: Tivoli Network Manager Product: Tivoli Network Manager <= 4.2.0.15 Product: Tivoli Network Manager 4.2.0 Platform: Linux

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und nicht spezifizierte Auswirkungen zu verursachen.

Product

IBM Tivoli Network Manager ist eine Netzanalysesoftware für das Management komplexer Netze. Diese Software erfasst und verteilt Layer-2- und Layer-3-Netzdaten.

Vulnerabilities 14

  • Critical 9.8
    CVE-2018-8013 EPSS 19%

    Deserialization of Untrusted Data in Apache Batik

    In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling n…

    Apache Software Foundation Apache Batik batik batik Debian Ubuntu Maven
  • High 8.2
    CVE-2020-11987 EPSS 14%

    Server-side request forgery (SSRF) in Apache Batik

    Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GE…

    batik batik org.apache.xmlgraphics:batik-svgbrowser Debian Ubuntu Maven
  • High 7.5
    CVE-2019-17566 EPSS 11%

    Server-side request forgery (SSRF) in Apache Batik

    Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary…

    batik batik org.apache.xmlgraphics:batik Debian Ubuntu Maven
  • High 7.5
    CVE-2020-36518 Public exploit

    Deeply nested json in jackson-databind

    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

    management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2022-2048

    Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

    In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario w…

    The Eclipse Foundation Eclipse Jetty jetty9 jenkins Debian Ubuntu Alpine Maven
  • High 7.3
    CVE-2017-5662

    Improper Restriction of XML External Entity Reference in Apache Batik

    In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application…

    Apache Software Foundation Apache Batik batik batik Debian Ubuntu Maven
  • Medium 5.5
    CVE-2022-24823

    Local Information Disclosure Vulnerability in io.netty:netty-codec-http

    Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…

    netty netty netty netty Debian Ubuntu Maven
  • Low 2.7
    CVE-2022-2047

    Jetty invalid URI parsing may produce invalid HttpURI.authority

    In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failu…

    The Eclipse Foundation Eclipse Jetty druid jetty9 Debian Ubuntu Wolfi Maven
  • Unscored —
    CVE-2007-2378

    The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated pro…

  • Medium —
    CVE-2009-4269

    Use of Password Hash With Insufficient Computational Effort in Apache Derby

    The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for loc…

    org.apache.derby:derby sun-javadb Ubuntu Maven
  • Unscored —
    CVE-2009-4521 Public exploit

    Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT)…

  • Medium —
    CVE-2015-0250 EPSS 17%

    Improper Input Validation in Apache Batik

    XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

    batik batik org.apache.xmlgraphics:batik Debian Ubuntu Maven
  • Unscored —
    CVE-2016-3506

    Unspecified vulnerability in the JDBC component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2; the Oracle …

  • Unscored —
    CVE-2021-41033

    In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerab…

    The Eclipse Foundation Eclipse Equinox

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References