Skip to content
OpenAdvisories
High WID-SEC-2024-1488 35 CVEs

IBM InfoSphere Information Server: Mehrere Schwachstellen

Published Jun 30, 2024 · Updated Jun 30, 2024 · de-DE

Vendor: IBM Product: InfoSphere Information Server Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.

Product

IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.

Vulnerabilities 35

  • High 8.8
    CVE-2023-4759

    Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write

    Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cl…

    Eclipse Foundation Eclipse JGit org.eclipse.jgit:org.eclipse.jgit jgit Debian Ubuntu Maven
  • High 8.6
    CVE-2024-21626 Public exploit EPSS 19%

    runc container breakout through process.cwd trickery and leaked fds

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…

    opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.3
    CVE-2023-22102

    MySQL Connectors takeover vulnerability

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to …

    Oracle MySQL Connectors mysql-5.5 mysql Ubuntu Azure Linux Wolfi Maven
  • High 7.5
    CVE-2023-5363

    Incorrect cipher key & IV length processing

    Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-5685

    Xnio: stackoverflowexception when the chain of notifier states becomes problematically big

    A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  • High 7.2
    CVE-2024-28798

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…

    IBM InfoSphere Information Server
  • High 7.0
    CVE-2023-27561

    Opencontainers runc Incorrect Authorization vulnerability

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …

    ctop podman podman-doc github.com/opencontainers/runc Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2023-51775

    jose4j denial of service via specifically crafted JWE

    The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

    confluent-kafka confluent-common-docker org.bitbucket.b_c:jose4j libjose4j-java Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2023-6129

    POLY1305 MAC implementation corrupts vector registers on PowerPC

    Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.4
    CVE-2024-28797

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…

    IBM InfoSphere Information Server
  • Medium 6.1
    CVE-2023-28642

    AppArmor bypass with symlinked /proc in runc

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…

    opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.9
    CVE-2023-6237

    Excessive time spent checking invalid RSA public keys

    Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2024-25026

    IBM WebSphere Application Server denial of service

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause …

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 5.9
    CVE-2024-27268

    IBM WebSphere Application Server Liberty denial of service

    IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-F…

    IBM WebSphere Application Server - Liberty
  • Medium 5.6
    CVE-2024-35195

    Requests `Session` object does not verify requests after making first request with verify=False

    Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

    psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.5
    CVE-2024-0727

    PKCS12 Decoding crashes

    Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.4
    CVE-2023-50952

    IBM InfoSphere Information Server server-side request forgery

    IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2023-50953

    IBM InfoSphere Information Server information disclosure

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. IBM X-Force ID: 275775.

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2023-50964

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2024-28794

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2024-28795

    IBM InfoSphere Information Server cross-site scripting

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trus…

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2024-31898

    IBM InfoSphere Information Server data modification

    IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references. IBM X-Force ID: 288182.

    IBM InfoSphere Information Server
  • Medium 5.3
    CVE-2023-3446

    Excessive time spent checking DH keys and parameters

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-3817

    Excessive time spent checking DH q parameter value

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2023-50312

    IBM WebSphere Application Server Liberty information disclosure

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.

    IBM WebSphere Application Server - Liberty
  • Medium 5.3
    CVE-2023-5678

    Excessive time spent in DH check / generation with large Q parameter value

    Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-35119

    IBM InfoSphere Information Server information disclosure

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: 29…

    IBM InfoSphere Information Server
  • Medium 4.8
    CVE-2024-34062

    tqdm CLI arguments injection attack

    tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had be…

    tqdm tqdm katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 4.7
    CVE-2024-27270

    IBM WebSphere Application Server Liberty cross-site scripting

    IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.

    IBM WebSphere Application Server - Liberty
  • Medium 4.3
    CVE-2023-50954

    IBM InfoSphere Information Server information disclosure

    IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force ID: 275776.

    IBM InfoSphere Information Server
  • Medium 4.3
    CVE-2024-22329

    IBM WebSphere Application Server server-side request forgery

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to cond…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.3
    CVE-2024-31902

    IBM InfoSphere Information Server cross-site request forgery

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 289234.

    IBM InfoSphere Information Server
  • Low 3.3
    CVE-2023-35022

    IBM InfoSphere Information Server improper authentication

    IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254.

    IBM InfoSphere Information Server
  • Low 3.0
    CVE-2021-25743

    ANSI escape characters in kubectl output are not being filtered

    kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Wolfi Go
  • Low 2.2
    CVE-2020-8562

    Bypass of Kubernetes API Server proxy TOCTOU

    As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Azure Linux Go

Revision history

  1. #1

    Initiale Fassung

References