Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.
Product
IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.
Vulnerabilities 92
-
Critical 9.8
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
-
Critical 9.8
Prototype Pollution in kriszyp/json-schema
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
Critical 9.8
Improper Neutralization of Special Elements used in a Command in Shell-quote
The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted arg…
-
Critical 9.8
Prototype pollution in webpack loader-utils
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
-
Critical 9.8CVE-2022-46364 Public exploit
Apache CXF SSRF Vulnerability
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
-
High 8.8CVE-2020-13936 EPSS 23%
Velocity Sandbox Bypass
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/mod…
-
High 8.8
Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lea…
-
High 8.8
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
-
High 8.8
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to com…
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…
-
High 8.2
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning ab…
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…
-
High 8.2
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction targ…
-
High 8.2CVE-2022-41966 Public exploit
XStream Denial of Service via stack overflow
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…
-
High 8.1
Integer underflow in grub_net_recv_ip4_packets
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a sma…
-
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
High 7.7
Prototype Pollution in Dojox
In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates…
-
High 7.7CVE-2022-25647 EPSS 12%
Deserialization of Untrusted Data
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
-
High 7.5CVE-2021-23450 EPSS 30%
Prototype Pollution
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
-
High 7.5
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…
-
High 7.5
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…
-
High 7.5
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5CVE-2022-22970 Public exploit
Denial of service in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
-
High 7.5
Path Traversal in Moment.js
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is direct…
-
High 7.5
Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The…
-
High 7.5
qs vulnerable to Prototype Pollution
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…
-
High 7.5
Inefficient Regular Expression Complexity in moment
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…
-
High 7.5
Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException…
-
High 7.5
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
-
High 7.5
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
-
High 7.5CVE-2022-40153 Rejected
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and…
-
High 7.5CVE-2022-40154 Rejected
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and…
-
High 7.5CVE-2022-40155 Rejected
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and…
-
High 7.5CVE-2022-40156 Rejected
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and…
-
High 7.5
Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
-
High 7.5
Apache Tomcat request smuggling via malformed content-length
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…
-
High 7.5
Apache Batik prior to 1.16 allows RCE via scripting
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
-
High 7.5
Apache Tomcat: JsonErrorReportValve escaping
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…
-
High 7.5
Apache CXF directory listing / code exfiltration
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-que…
-
High 7.1
SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column n…
-
High 7.0
Unchecked Class Instantiation when providing Plugin Classes
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc…
-
Medium 6.8
DNS forwarders - cache poisoning vulnerability
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to…
-
Medium 6.5
Loop with Unreachable Exit Condition in Apache PDFBox
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
-
Medium 6.5
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …
-
Medium 6.5CVE-2022-22971 Public exploit
Allocation of Resources Without Limits or Throttling in Spring Framework
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
-
Medium 6.5CVE-2022-23437 EPSS 12%
Infinite loop within Apache XercesJ xml parser
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged durat…
-
Medium 6.5
In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecod…
-
Medium 6.5
Stack Buffer Overflow in Jettison
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…
-
Medium 6.5
Stack Buffer Overflow in Jettison
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may su…
-
Medium 6.5CVE-2022-40152 EPSS 18%
Stack Buffer Overflow in Woodstox
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…
-
Medium 6.2
Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…
-
Medium 6.2
Fix prototype pollution in the zrender merge and clone helper methods
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization libr…
-
Medium 6.1
XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.
-
Medium 6.1
jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that l…
-
Medium 5.9
Web Cache Poisoning
This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed head…
-
Medium 5.9CVE-2021-21295 EPSS 19%
Possible request smuggling in HTTP/2 due missing validation
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…
-
Medium 5.9
Possible request smuggling in HTTP/2 due missing validation of content-length
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…
-
Medium 5.6
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…
-
Medium 5.5
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…
-
Medium 5.3
Improper Certificate Validation in node-sass
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
-
Medium 5.3
Regular Expression Denial of Service (ReDOS)
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.
-
Medium 5.3
Inefficient Regular Expression Complexity in validatorjs/validator.js
validator.js is vulnerable to Inefficient Regular Expression Complexity
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweigh…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
-
Medium 5.3
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
-
Medium 5.3CVE-2022-25927 Public exploit
ReDoS Vulnerability in ua-parser-js version
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
-
Medium 5.3
Processing large delegations may severely degrade resolver performance
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
-
Medium 4.7
TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc
pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger th…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Sup…
-
Unscored —
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions:…
-
Unscored —
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sa…
-
Unscored —
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (us…
-
Unscored —
In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that…
-
Unscored —
In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a de…
-
Unscored —
In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service …
-
Unscored —
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.c…
-
Unscored —
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in…
-
Unscored —
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.
-
Unscored —
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.
-
Unscored —
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called …
-
Unscored —
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
-
Unscored —
Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or a…
-
Unscored —
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The…
-
Unscored —
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.…
Revision history
-
#4
Neue Updates von Fedora aufgenommen
-
#3
Neue Updates von IBM aufgenommen
-
#2
Neue Updates von IBM aufgenommen
-
#1
Initiale Fassung
References
-
IBM Security Bulletin: 6967283 vom 2023-03-30
https://www.ibm.com/support/pages/node/6967283
-
IBM Security Bulletin: 6967333 vom 2023-03-30
https://www.ibm.com/support/pages/node/6967333
-
IBM Security Bulletin 6980799 vom 2023-04-04
https://www.ibm.com/support/pages/node/6980799
-
IBM Security Bulletin 7108657 vom 2024-01-17
https://www.ibm.com/support/pages/node/7108657
-
Fedora Security Advisory FEDORA-2024-5ECC250449 vom 2024-02-19
https://bodhi.fedoraproject.org/updates/FEDORA-2024-5ecc250449