DeutschShown in its original language — a full translation is planned for a future version.
IBM Tivoli Network Manager: Mehrere Schwachstellen
view advisory published 2026-04-08
Ein Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-24308US | high7.5 | — | ||
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client confi… | ||||
| CVE-2026-24281US | high7.4 | — | ||
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impers… | ||||
| CVE-2026-3381US | — | — | ||
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib.
Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version… | ||||
| CVE-2026-27171US | medium5.5 | — | ||
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. | ||||
| CVE-2026-1225US | — | — | ||
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes alread… | ||||
| CVE-2026-21945US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affecte… | ||||
| CVE-2026-21933US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affec… | ||||
| CVE-2026-21932US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affe… | ||||
| CVE-2026-21925US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are… | ||||
| CVE-2025-68161US | medium4.8 | — | ||
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https:/… | ||||
| CVE-2025-66675US | — | — | ||
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, fro… | ||||
| CVE-2025-64775US | — | — | ||
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, fro… | ||||
| CVE-2025-11226US | — | — | ||
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitr… | ||||
| CVE-2025-55163US | high7.5 | Exploit | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical v… | ||||
| CVE-2025-40918US | — | — | ||
Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely.
The cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch… | ||||
| CVE-2025-48924US | — | Exploit | ||
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commo… | ||||
| CVE-2025-53864US | — | — | ||
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT c… | ||||
| CVE-2023-48795US | medium5.9OT high | Exploit | ||
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:14272 vom 2026-05-06external
- Red Hat Security Advisory RHSA-2026:14276 vom 2026-05-06external
- Red Hat Security Advisory RHSA-2026:8509 vom 2026-04-16external
- WID-SEC-W-2026-1032 - CSAF Versionself
- WID-SEC-2026-1032 - Portal Versionself
- IBM Security Bulletin 7268900 vom 2026-04-08external
- IBM Security Bulletin 7275270 vom 2026-06-05external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan