DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM Tivoli Network Manager: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-01-04
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und nicht spezifizierte Auswirkungen zu verursachen.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-2048US | high7.5 | — | ||
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connec… | ||||
| CVE-2022-2047US | low2.7 | — | ||
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI… | ||||
| CVE-2022-24823US | medium5.5 | — | ||
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix… | ||||
| CVE-2020-36518US | high7.5 | Exploit | ||
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. | ||||
| CVE-2021-41033US | high8.1 | — | ||
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTT… | ||||
| CVE-2020-11987US | high8.2 | — | ||
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could… | ||||
| CVE-2019-17566US | high7.5 | — | ||
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker co… | ||||
| CVE-2018-8013US | critical9.8 | — | ||
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no… | ||||
| CVE-2017-5662US | high7.3 | — | ||
In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types th… | ||||
| CVE-2016-3506US | high8.1 | — | ||
Unspecified vulnerability in the JDBC component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2; the Oracle Retail Xstore Point of Service 5.5, 6.0, 6.5, 7.0, 7.1, 15.0,… | ||||
| CVE-2015-0250US | medium6.4 | — | ||
XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause… | ||||
| CVE-2009-4269US | low2.1 | — | ||
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of in… | ||||
| CVE-2009-4521US | medium4.3 | Exploit | ||
Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as used in KonaKart and other products, allows… | ||||
| CVE-2007-2378US | medium5.0OT erhöht | — | ||
The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the d… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2023-0027 - CSAF Versionself
- WID-SEC-2023-0027 - Portal Versionself
- IBM Security Advisory vom 2023-01-04external
- IBM Security Advisory vom 2023-01-04external
- IBM Security Advisory vom 2023-01-04external
- IBM Security Advisory vom 2023-01-04external
- IBM Security Bulletin 6958056 vom 2023-02-24external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan