Skip to content
OpenAdvisories
High WID-SEC-2023-2368 7 CVEs

IBM Operational Decision Manager: Mehrere Schwachstellen

Published Sep 14, 2023 · Updated Jan 7, 2024 · Revision 3 · de-DE

Vendor: IBM Vendor: Red Hat Product: Enterprise Linux Product: Operational Decision Manager Product: Operational Decision Manager < 8.10.5.1 Product: Operational Decision Manager < 8.11.0.1 Product: Operational Decision Manager < 8.11.1 Product: Operational Decision Manager < 8.12.0 Product: Operational Decision Manager 8.10.5.1 < IF049 Platform: Linux

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.

Product

IBM Operational Decision Manager ist Software für die Integration von Geschäftsereignissen und Geschäftsregeln, um Entscheidungen über verschiedene Prozesse und Anwendungen hinweg zu automatisieren.

Vulnerabilities 7

  • Critical 9.1
    CVE-2023-34034 Public exploit

    Access Control Bypass in Spring Security

    Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

    org.springframework.security:spring-security-config Maven
  • High 8.1
    CVE-2023-37460 Public exploit

    Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver

    Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file c…

    codehaus-plexus plexus-archiver javapackages-bootstrap org.codehaus.plexus:plexus-archiver Ubuntu Azure Linux Maven
  • High 7.5
    CVE-2022-34169 Public exploit EPSS 82%

    Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

    The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

    Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  • Medium 5.3
    CVE-2022-25881

    http-cache-semantics vulnerable to Regular Expression Denial of Service

    This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

    nodejs nodejs-nodemon http-cache-semantics org.webjars.npm:http-cache-semantics Azure Linux npm Maven
  • Medium 4.7
    CVE-2022-41946

    TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc

    pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger th…

    pgjdbc pgjdbc libpgjava libpgjava Debian Ubuntu Alpine Maven
  • Low 2.7
    CVE-2022-2047

    Jetty invalid URI parsing may produce invalid HttpURI.authority

    In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failu…

    The Eclipse Foundation Eclipse Jetty druid jetty9 Debian Ubuntu Wolfi Maven
  • High —
    CVE-2014-0107 EPSS 14%

    Improper Authorization in Apache Xalan-Java

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access exte…

    xalan:xalan libxalan2-java Debian Maven

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References