DeutschShown in its original language — a full translation is planned for a future version.
IBM MQ: Mehrere Schwachstellen
view advisory published 2024-02-29
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
01
describes (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-27255US | high7.5OT elevated | — | ||
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptogr… | ||||
| CVE-2023-47745US | medium5.5OT elevated | — | ||
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentia… | ||||
| CVE-2024-25016US | high7.5 | — | ||
IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Fo… | ||||
| CVE-2024-0553US | high7.5 | — | ||
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5… | ||||
| CVE-2023-49568US | high7.5 | — | ||
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing sp… | ||||
| CVE-2023-26159US | medium6.1 | — | ||
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL()… | ||||
| CVE-2023-7104US | high7.3 | — | ||
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of t… | ||||
| CVE-2023-45287US | high7.5 | — | ||
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this m… | ||||
| CVE-2023-5676US | medium5.9 | — | ||
In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is… | ||||
| CVE-2023-4218US | medium5.0 | — | ||
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update… | ||||
| CVE-2023-22081US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected ar… | ||||
| CVE-2023-5072US | high7.5 | — | ||
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being… | ||||
| CVE-2023-44487US | high7.5OT critical | KEV | ||
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through… | ||||
| CVE-2023-39615US | medium6.5 | — | ||
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a De… | ||||
| CVE-2023-39976US | critical9.8 | — | ||
log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. | ||||
| CVE-2022-48468US | medium5.5 | — | ||
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member. | ||||
| CVE-2020-28241US | medium6.5 | — | ||
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c. | ||||
| CVE-2005-1941US | high7.8OT elevated | — | ||
SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py, (2) cgi-styler.py, and (3) source2html.py with read and write world permissions, which allows local users to execute arb… | ||||
| CVE-2002-1711US | low2.1OT elevated | — | ||
BasiliX 1.1.0 saves attachments in a world readable /tmp/BasiliX directory, which allows local users to read other users' attachments. | ||||
| CVE-2002-1713US | medium5.5OT elevated | — | ||
The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read… | ||||
showing 20 of 21
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2024-0521 - CSAF Versionself
- WID-SEC-2024-0521 - Portal Versionself
- IBM Security Bulletin 7114770 vom 2024-05-01external
- IBM Security Bulletin 7123135 vom 2024-02-29external
- IBM Security Bulletin 7123136 vom 2024-02-29external
- IBM Security Bulletin 7123137 vom 2024-02-29external
- IBM Security Bulletin 7123138 vom 2024-02-29external
- IBM Security Bulletin 7123139 vom 2024-02-29external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan