Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um seine Privilegien zu erweitern, Administratorrechte zu erlangen, beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
Product
IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.
Vulnerabilities 105
-
High 8.3
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
KEV Oct 6, 2025 -
High 8.8
Privilege escalation vulnerability in Apache Hadoop
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
-
High 8.8
A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted we…
-
High 8.8
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML we…
-
High 8.8
Improper Privilege Management in Apache Hadoop
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
-
High 7.8CVE-2019-18276 Public exploit
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run wi…
-
High 7.8
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead t…
-
High 7.8CVE-2021-3347 Public exploit
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault…
-
High 7.5
user/group information can be corrupted across storing in fsimage and reading back from fsimage
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
-
High 7.5
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…
-
High 7.5
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
-
High 7.5
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
-
High 7.5
Path Traversal in pip
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…
-
High 7.5
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerber…
-
High 7.5
Denial of Service in Cryptacular
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input wi…
-
High 7.5
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
-
High 7.5
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildca…
-
High 7.5
OAuth 2 authorization service vulnerable to DDos attacks
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, t…
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
-
High 7.5
Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prio…
-
High 7.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences …
-
High 7.5
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…
-
High 7.4
CA certificate check bypass with X509_V_FLAG_X509_STRICT
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…
-
High 7.1
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh …
-
Medium 6.7
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is u…
-
Medium 6.7
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digit…
-
Medium 6.5
Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct…
-
Medium 6.5
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…
-
Medium 6.5
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…
-
Medium 6.5
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…
-
Medium 6.1
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the s…
-
Medium 6.1CVE-2020-13954 EPSS 41%
Apache CXF Reflected XSS in the services listing page via the styleSheetPath
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject ja…
-
Medium 5.9
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequ…
-
Medium 5.9
IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …
-
Medium 5.9
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:…
-
Medium 5.9CVE-2021-23336 EPSS 41%
Web Cache Poisoning
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…
-
Medium 5.9
IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key ex…
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…
-
Medium 5.5
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …
-
Medium 5.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input…
-
Medium 5.5
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
-
Medium 5.5
A carefully crafted PDF file can trigger an infinite loop while loading the file
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
-
Medium 5.4
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Medium 5.4
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attack…
-
Medium 5.3
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enab…
-
Medium 5.3CVE-2020-8927 Public exploit
Buffer overflow in Brotli library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It i…
-
Medium 5.3
Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can ret…
-
Medium 5.1
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match special…
-
Medium 4.5CVE-2019-3842 Public exploit
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using …
-
Low 3.7
Denial of service in nghttp2
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…
-
Low 3.7
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP ad…
-
Low 2.7
Directory exposure in jetty
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and…
-
Unscored —
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in th…
-
Unscored —
read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names …
-
Unscored —
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in A…
-
Unscored —
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related…
-
Unscored —
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_…
-
Unscored —
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes …
-
Unscored —
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.…
-
Unscored —
In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorr…
-
Unscored —
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in Op…
-
Unscored —
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose leng…
-
Unscored —
Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.13…
-
Unscored —
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ov…
-
Unscored —
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execu…
-
Unscored —
Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and bef…
-
Unscored —
Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux…
-
Unscored —
Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version …
-
Unscored —
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
-
Unscored —
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TL…
-
Unscored —
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to…
-
Unscored —CVE-2020-14422 EPSS 13%
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…
-
Unscored —
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflo…
-
Unscored —
Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of p…
-
Unscored —
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enabl…
-
Unscored —
Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable informa…
-
Unscored —
Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to pot…
-
Unscored —
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if…
-
Unscored —
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entit…
-
Unscored —
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spe…
-
Unscored —
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …
-
Unscored —
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usuall…
-
Unscored —
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array…
-
Unscored —
An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC…
-
Unscored —
An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC …
-
Unscored —
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
-
Unscored —
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verificati…
-
Unscored —
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in d…
-
Unscored —
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing mali…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing ma…
-
Unscored —
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processin…
-
Unscored —
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who c…
-
Unscored —
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, E…
-
Unscored —
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existe…
-
Unscored —
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and e…
-
Unscored —
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial …
-
Unscored —
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…
-
Unscored —
A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an au…
-
Unscored —CVE-2021-32399 Public exploit
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
-
Unscored —
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be p…
-
Unscored —
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger …
-
Unscored —
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechani…
-
Unscored —
A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the…
Revision history
-
#3
Neue Updates von IBM aufgenommen
-
#2
Neue Updates von IBM aufgenommen
-
#1
Initiale Fassung
References
-
IBM Security Bulletin: 6520488 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520488
-
IBM Security Bulletin: 6520484 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520484
-
IBM Security Bulletin: 6520490 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520490
-
IBM Security Bulletin: 6520476 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520476
-
IBM Security Bulletin: 6520492 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520492
-
IBM Security Bulletin: 6520478 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520478
-
IBM Security Bulletin: 6520486 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520486
-
IBM Security Bulletin: 6520474 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520474
-
IBM Security Bulletin: 6520472 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520472
-
IBM Security Bulletin: 6520482 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520482
-
IBM Security Bulletin: 6520480 vom 2021-11-30
https://www.ibm.com/support/pages/node/6520480
-
IBM Security Bulletin 7182001 vom 2025-01-30
https://www.ibm.com/support/pages/node/7182001
-
IBM Security Bulletin 7282656 vom 2026-08-11
https://www.ibm.com/support/pages/node/7282656