Skip to content
OpenAdvisories
High WID-SEC-2023-3025 16 CVEs

IBM InfoSphere Information Server: Mehrere Schwachstellen

Published Nov 28, 2023 · Updated Dec 4, 2023 · Revision 2 · de-DE

Vendor: IBM Vendor: Red Hat Product: Enterprise Linux Product: InfoSphere Information Server 11.7 Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial of Service Zustand herbeizuführen.

Product

IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.

Vulnerabilities 16

  • High 7.5
    CVE-2023-39410

    Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

    When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11…

    Apache Software Foundation Apache Avro Java SDK druid tez Wolfi Maven PyPI
  • High 7.5
    CVE-2023-40699

    IBM InfoSphere Information Server denial of service

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.

    IBM InfoSphere Information Server
  • High 7.5
    CVE-2023-43642

    Missing upper bound check on chunk length in snappy-java

    snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bou…

    xerial snappy-java druid snappy-java Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2020-8203 Public exploit

    Prototype Pollution in lodash

    Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

    js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  • High 7.2
    CVE-2021-23337 Public exploit Scanner template EPSS 20%

    Command Injection

    Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

    js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  • Medium 6.5
    CVE-2023-34462

    netty-handler SniHandler 16MB allocation

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2023-42019

    IBM InfoSphere Information Server information disclosure

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.

    IBM InfoSphere Information Server
  • Medium 5.9
    CVE-2023-43804 Public exploit

    `Cookie` HTTP header isn't stripped on cross-origin redirects

    urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

    urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.4
    CVE-2023-42009

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2023-42022

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2023-43015

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2023-46174

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.3
    CVE-2020-28500

    Regular Expression Denial of Service (ReDoS)

    Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

    js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  • Medium 5.3
    CVE-2022-25883

    semver vulnerable to Regular Expression Denial of Service

    Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

    nodejs js-jquery nodejs18 nodejs-nodemon Debian Ubuntu Azure Linux npm
  • Medium 5.3
    CVE-2023-43021

    IBM InfoSphere Information Server information disclosure

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 2661…

    IBM InfoSphere Information Server
  • Medium 4.3
    CVE-2023-38268

    IBM InfoSphere Information Server cross-site request forgery

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260585.

    IBM InfoSphere Information Server

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References