Skip to content
OpenAdvisories
Medium WID-SEC-2026-3908 5 CVEs

IBM SPSS: Mehrere Schwachstellen

Published Oct 13, 2026 · Updated Nov 3, 2026 · Revision 2 · de-DE

Vendor: IBM Product: Operational Decision Manager Product: SPSS Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM SPSS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Dateien zu manipulieren.

Product

IBM SPSS ist ein umfassendes Set von Daten- und prognostischen Analyse-Tools für Geschäftsbenutzer, Analysten und Statistik-Programmierer.

Vulnerabilities 5

  • High 7.5
    CVE-2026-59739

    Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

    Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restrict…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu
  • High 7.5
    CVE-2026-59969

    Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

    Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSock…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu
  • High 7.5
    CVE-2026-79993

    Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

    The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is cons…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu
  • Medium 5.3
    CVE-2026-84439

    Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

    When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the au…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu
  • Medium 5.3
    CVE-2026-84501

    Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

    An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProv…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References