DeutschShown in its original language — a full translation is planned for a future version.
IBM QRadar SIEM: Mehrere Schwachstellen
view advisory published 2022-05-24
Ein lokaler Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen, Dateien manipulieren oder Sicherheitsvorkehrungen zu umgehen.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3807US | high7.5 | — | ||
ansi-regex is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2021-37713US | high8.6 | — | ||
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to… | ||||
| CVE-2021-37712US | high8.6 | — | ||
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to… | ||||
| CVE-2021-37701US | high8.6 | — | ||
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to… | ||||
| CVE-2021-32804US | high8.1 | Exploit | ||
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitiz… | ||||
| CVE-2021-32803US | high8.1 | — | ||
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `no… | ||||
| CVE-2021-29060US | medium5.3 | — | ||
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a craft… | ||||
| CVE-2020-28469US | high7.5 | — | ||
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. | ||||
| CVE-2021-33623US | high7.5 | — | ||
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method. | ||||
| CVE-2021-33502US | high7.5 | — | ||
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential perfo… | ||||
| CVE-2021-27292US | high7.5 | — | ||
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will g… | ||||
| CVE-2021-23337US | high7.2 | Exploit | ||
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. | ||||
| CVE-2020-28500US | medium5.3 | — | ||
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. | ||||
| CVE-2020-28498US | medium4.3OT elevated | — | ||
The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key po… | ||||
| CVE-2020-24025US | medium5.3 | — | ||
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. | ||||
| CVE-2020-7793US | high7.5 | — | ||
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). | ||||
| CVE-2020-15168US | medium5.3 | — | ||
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError wo… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan