CVE sync 2026-11-13T22:30:43Z
This commit is contained in:
Vulnerability Bot committed
1 parent
aa65f0c147
commit
c1444140e5
61 files changed
+6438
-713
No files matched your search
@@ -0,0 +1,73 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-102632",
|
||||
"assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "DEVOLUTIONS",
|
||||
"dateReserved": "2026-09-29T15:43:49.635Z",
|
||||
"datePublished": "2026-11-13T21:17:45.535Z",
|
||||
"dateUpdated": "2026-11-13T21:17:45.535Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
|
||||
"shortName": "DEVOLUTIONS",
|
||||
"dateUpdated": "2026-11-13T21:17:45.535Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-266",
|
||||
"description": "CWE-266 Incorrect Privilege Assignment",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Devolutions",
|
||||
"product": "PowerShell Universal",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "2026.3.5",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://devolutions.net/security/advisories/DEVO-2026-0042/"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.2"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-10-01T18:54:15.120Z",
|
||||
"datePublished": "2026-11-13T18:44:09.471Z",
|
||||
"dateUpdated": "2026-11-13T18:44:09.471Z"
|
||||
"dateUpdated": "2026-11-13T21:18:52.182Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -89,6 +89,48 @@
|
||||
"advisory": "GHSA-hg85-pmm3-jfcf",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-hg85-pmm3-jfcf",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:18:32.522646Z",
|
||||
"id": "CVE-2026-104204",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:18:52.182Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Zenitel",
|
||||
"dateReserved": "2026-10-05T16:30:58.403Z",
|
||||
"datePublished": "2026-11-13T15:40:23.944Z",
|
||||
"dateUpdated": "2026-11-13T15:40:23.944Z"
|
||||
"dateUpdated": "2026-11-13T21:46:22.488Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -125,6 +125,40 @@
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:46:14.050984Z",
|
||||
"id": "CVE-2026-105622",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:46:22.488Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Zenitel",
|
||||
"dateReserved": "2026-10-05T16:31:04.052Z",
|
||||
"datePublished": "2026-11-13T15:42:42.515Z",
|
||||
"dateUpdated": "2026-11-13T15:42:42.515Z"
|
||||
"dateUpdated": "2026-11-13T21:43:33.794Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -125,6 +125,40 @@
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:43:27.551807Z",
|
||||
"id": "CVE-2026-105623",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:43:33.794Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Zenitel",
|
||||
"dateReserved": "2026-10-05T16:31:06.093Z",
|
||||
"datePublished": "2026-11-13T15:41:59.393Z",
|
||||
"dateUpdated": "2026-11-13T15:41:59.393Z"
|
||||
"dateUpdated": "2026-11-13T21:45:18.832Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -125,6 +125,40 @@
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:45:12.663777Z",
|
||||
"id": "CVE-2026-105624",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:45:18.832Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "jci",
|
||||
"dateReserved": "2026-10-06T12:44:52.563Z",
|
||||
"datePublished": "2026-11-12T20:50:42.994Z",
|
||||
"dateUpdated": "2026-11-12T20:50:42.994Z"
|
||||
"dateUpdated": "2026-11-13T21:32:54.410Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -114,6 +114,40 @@
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:32:44.371811Z",
|
||||
"id": "CVE-2026-106018",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:32:54.410Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-108290",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-09T17:54:29.151Z",
|
||||
"datePublished": "2026-11-13T21:35:45.225Z",
|
||||
"dateUpdated": "2026-11-13T21:35:45.225Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:35:45.225Z"
|
||||
},
|
||||
"title": "IBM Cyber Fraud includes components with multiple known vulnerabilities",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-923",
|
||||
"description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Cyber Fraud",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an attacker with local access to a container to extract sensitive information due to unrestrictive network policies.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an attacker with local access to a container to extract sensitive information due to unrestrictive network policies.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7295966",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p>Please upgrade to at least version 1.1.1 according to the following instructions:<br/><br/><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud</a></p><p><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-109158",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-12T12:02:17.685Z",
|
||||
"datePublished": "2026-11-13T22:03:01.617Z",
|
||||
"dateUpdated": "2026-11-13T22:03:27.115Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T22:03:27.115Z"
|
||||
},
|
||||
"title": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Insertion of Sensitive Information into Log File",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-532",
|
||||
"description": "CWE-532 Insertion of Sensitive Information into Log File",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "App Connect Operator",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.1.0",
|
||||
"lessThanOrEqual": "12.21.0",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.0",
|
||||
"lessThanOrEqual": "12.0.28",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.0",
|
||||
"lessThanOrEqual": "13.6.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "App Connect Enterprise Certified Containers Operands",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.11.1-r1",
|
||||
"lessThanOrEqual": "12.0.12.5-r1",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.1.0-r1",
|
||||
"lessThanOrEqual": "13.0.6.2-r1",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.12-r1",
|
||||
"lessThanOrEqual": "12.0.12-r28",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.7.0-r1",
|
||||
"lessThanOrEqual": "13.0.9.0-r1",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296008",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly suggests the following:\n\n\n\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator \n\n\n\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM strongly suggests the following:</p><p><strong>App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator</a></p><p><br/><strong>App Connect Enterprise Certified Container 12.0 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110178",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T17:10:52.843Z",
|
||||
"datePublished": "2026-11-13T21:44:00.993Z",
|
||||
"dateUpdated": "2026-11-13T21:44:00.993Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:44:00.993Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by an improper access control vulnerability in configuration import",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-284",
|
||||
"description": "CWE-284 Improper Access Control",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.0.11",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.11:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated attacker holding a team-scoped `admin.import` permission can overwrite the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants by sending a crafted POST request to `/v1/import` with `conflict_strategy=update`, redirecting subsequent AI gateway invocations to an attacker-controlled host.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated attacker holding a team-scoped `admin.import` permission can overwrite the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants by sending a crafted POST request to `/v1/import` with `conflict_strategy=update`, redirecting subsequent AI gateway invocations to an attacker-controlled host.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296701",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "None. IBM strongly recommends upgrading to the fixed version.\n\n\n\nUntil upgrading, administrators can reduce exposure by not granting `admin.import` to team-scoped roles and by reserving configuration import for platform administrators.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>None. IBM strongly recommends upgrading to the fixed version.</div><div></div><div>Until upgrading, administrators can reduce exposure by not granting `admin.import` to team-scoped roles and by reserving configuration import for platform administrators.</div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.0Install or upgrade to v1.1.0 [ v1.1.0 Release Notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>v1.1.0</td><td>Install or upgrade to v1.1.0 [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0\" rel=\"nofollow\">v1.1.0 Release Notes</a>]</td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110189",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T17:24:47.069Z",
|
||||
"datePublished": "2026-11-13T21:43:26.623Z",
|
||||
"dateUpdated": "2026-11-13T21:43:26.623Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:43:26.623Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by a denial of service due to an incomplete list of disallowed jq inputs",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-184",
|
||||
"description": "CWE-184 Incomplete List of Disallowed Inputs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.8",
|
||||
"lessThanOrEqual": "1.0.11",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.8:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.11:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.8 through 1.0.11, and v1.1.0 is vulnerable to denial of service due to an incomplete denylist in the jq filter guard module (CWE-184). An authenticated remote attacker can supply a crafted `jsonpath_filter` value containing `halt`, `halt_error`, or unbounded-loop built-ins that bypass the safety check, causing gateway worker process termination or sustained resource exhaustion.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.8 through 1.0.11, and v1.1.0 is vulnerable to denial of service due to an incomplete denylist in the jq filter guard module (CWE-184). An authenticated remote attacker can supply a crafted `jsonpath_filter` value containing `halt`, `halt_error`, or unbounded-loop built-ins that bypass the safety check, causing gateway worker process termination or sustained resource exhaustion.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296697",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "None. IBM strongly recommends upgrading to the fixed version.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>None. IBM strongly recommends upgrading to the fixed version.</div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.1Install or upgrade to v1.1.1 [ v1.1.1 Release notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.1 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>v1.1.1</td><td>Install or upgrade to v1.1.1 [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.1\" rel=\"nofollow\">v1.1.1 Release notes</a>]</td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110194",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T17:38:19.341Z",
|
||||
"datePublished": "2026-11-13T21:44:24.821Z",
|
||||
"dateUpdated": "2026-11-13T21:52:31.533Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:44:24.821Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by a server-side request forgery vulnerability",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-918",
|
||||
"description": "CWE-918 Server-Side Request Forgery",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.0.11",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.11:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296696",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends upgrading to the fixed version.\n\nIf this is not possible restrict the accepted authorization server issuers by setting `DCR_ALLOWED_ISSUERS` to a list of trusted issuers, or disable Dynamic Client Registration (`DCR_ENABLED=false`), and restrict gateway creation permissions to trusted users.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>IBM strongly recommends upgrading to the fixed version.</div><div>If this is not possible restrict the accepted authorization server issuers by setting `DCR_ALLOWED_ISSUERS` to a list of trusted issuers, or disable Dynamic Client Registration (`DCR_ENABLED=false`), and restrict gateway creation permissions to trusted users. </div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.0Install or upgrade to v1.1.0 [ v1.1.0 Release Notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>v1.1.0</td><td>Install or upgrade to v1.1.0 [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0\" rel=\"nofollow\">v1.1.0 Release Notes</a>]</td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:52:25.303263Z",
|
||||
"id": "CVE-2026-110194",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:52:31.533Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,133 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110195",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T17:42:23.844Z",
|
||||
"datePublished": "2026-11-13T21:43:18.359Z",
|
||||
"dateUpdated": "2026-11-13T21:43:18.359Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:43:18.359Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by an authorization bypass vulnerability",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-287",
|
||||
"description": "CWE-287 Improper Authentication",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.0.11",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.11:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296695",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends upgrading to the fixed version.\n\nIf this cannot be done, ensure authorization policies for upstream MCP servers assign identical scopes and permissions to all credential types (interactive session JWTs and API tokens) for a given account, or avoid configuring OAuth token exchange with `subject_token_source=inbound_user_jwt` across mixed credential types until the gateway is updated.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>IBM strongly recommends upgrading to the fixed version.</div><div>If this cannot be done, ensure authorization policies for upstream MCP servers assign identical scopes and permissions to all credential types (interactive session JWTs and API tokens) for a given account, or avoid configuring OAuth token exchange with `subject_token_source=inbound_user_jwt` across mixed credential types until the gateway is updated. </div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.0Install or upgrade to v1.1.0 [ v1.1.0 Release Notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>v1.1.0</td><td>Install or upgrade to v1.1.0 [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0\" rel=\"nofollow\">v1.1.0 Release Notes</a>]</td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This vulnerability was reported to IBM by Nick Simpson.",
|
||||
"type": "finder"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110199",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T17:52:24.970Z",
|
||||
"datePublished": "2026-11-13T21:43:52.021Z",
|
||||
"dateUpdated": "2026-11-13T21:43:52.021Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:43:52.021Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by a DOM-based cross-site scripting",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-79",
|
||||
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.0.11",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.11:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296694",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 4.8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "None. IBM strongly recommends upgrading to the fixed version.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>None. IBM strongly recommends upgrading to the fixed version.</div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.0Install or upgrade to v1.1.0 [ v1.1.0 Release Notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>v1.1.0</td><td>Install or upgrade to v1.1.0 [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0\" rel=\"nofollow\">v1.1.0 Release Notes</a>]</td></tr></tbody></table></div><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,133 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110278",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T19:05:09.052Z",
|
||||
"datePublished": "2026-11-13T21:43:09.800Z",
|
||||
"dateUpdated": "2026-11-13T21:43:09.800Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:43:09.800Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by an information exposure vulnerability",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-294",
|
||||
"description": "CWE-294 Authentication Bypass by Capture-replay",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configuration checks during tool invocation.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configuration checks during tool invocation.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296489",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends upgrading to the fixed version.\nIf you cannot update disable identity propagation globally (set `IDENTITY_PROPAGATION_ENABLED=false`) so that no upstream MCP server receives user identity information, and restrict access to the gateway to trusted users.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>IBM strongly recommends upgrading to the fixed version.<br/>If you cannot update disable identity propagation globally (set `IDENTITY_PROPAGATION_ENABLED=false`) so that no upstream MCP server receives user identity information, and restrict access to the gateway to trusted users.</div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\n\n\n\nv1.0.0-v1.1.0Upgrade to v1.1.1 immediately [ Release notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.1 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td><div><div>IBM ContextForge MCP Gateway</div></div></td><td>v1.0.0-v1.1.0</td><td>Upgrade to v1.1.1 immediately [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.1\" rel=\"nofollow\">Release notes</a>]</td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This vulnerability was reported to IBM by Wolfgang Kriesel.",
|
||||
"type": "finder"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,133 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110279",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-13T19:06:34.353Z",
|
||||
"datePublished": "2026-11-13T21:43:43.544Z",
|
||||
"dateUpdated": "2026-11-13T21:43:43.544Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:43:43.544Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by an improper authentication vulnerability",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-287",
|
||||
"description": "CWE-287 Improper Authentication",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth (authorization_code and client_credentials), bearer and basic authenticated gateways, which could allow an authenticated user to cause upstream requests to be made with a different credential and bypass per-user permission and audit attribution.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth (authorization_code and client_credentials), bearer and basic authenticated gateways, which could allow an authenticated user to cause upstream requests to be made with a different credential and bypass per-user permission and audit attribution.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296490",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Remove the X-Upstream-Authorization request header at the reverse proxy or API gateway in front of IBM ContextForge MCP Gateway for all MCP endpoints, and restrict network access to MCP endpoints to trusted networks. IBM strongly recommends upgrading to the fixed version.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div>Remove the X-Upstream-Authorization request header at the reverse proxy or API gateway in front of IBM ContextForge MCP Gateway for all MCP endpoints, and restrict network access to MCP endpoints to trusted networks. IBM strongly recommends upgrading to the fixed version.</div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway2.0Download and deploy v1.1.1 [ Release notes v1.1.1 https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.1 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>2.0</td><td>Download and deploy v1.1.1 [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.1\" rel=\"nofollow\">Release notes v1.1.1</a>]</td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This vulnerability was reported to IBM by Wolfgang Kriesel.",
|
||||
"type": "finder"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,147 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110330",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-13T20:26:13.525Z",
|
||||
"datePublished": "2026-11-13T21:26:06.206Z",
|
||||
"dateUpdated": "2026-11-13T21:26:06.206Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This allows a local attacker to read environment variables and related metadata of other users' or root processes when abrtd is running."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 6",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "abrt",
|
||||
"defaultStatus": "unknown",
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:6"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "abrt",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "abrt",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:8"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-110330",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552065",
|
||||
"name": "RHBZ#2552065",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-13T20:52:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-862",
|
||||
"description": "Missing Authorization",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-862: Missing Authorization",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Disable or remove ABRT if not required: systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service. Restrict local interactive user access on systems that keep abrtd enabled."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-07-26T00:00:00.000Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-13T20:52:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Red Hat would like to thank Vivek Parikh (BreachX Zero Day Labs) for reporting this issue."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-13T21:26:06.206Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,147 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-110331",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-13T20:26:16.700Z",
|
||||
"datePublished": "2026-11-13T21:25:59.256Z",
|
||||
"dateUpdated": "2026-11-13T21:25:59.256Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Important",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a \"count\" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or seize ownership of, dump directories while privileged ABRT handlers are processing them. Related Problems2 mutating methods remain ungated by the same check."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 6",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "abrt",
|
||||
"defaultStatus": "unknown",
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:6"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 7",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "abrt",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/o:redhat:rhel_els:7"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "abrt",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:8"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-110331",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552067",
|
||||
"name": "RHBZ#2552067",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-13T20:53:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-862",
|
||||
"description": "Missing Authorization",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-862: Missing Authorization",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Disable or remove ABRT if not required: systemctl disable --now abrtd.service abrt-journal-core.service abrt-oops.service abrt-xorg.service. Restrict local interactive user access on systems that keep abrt installed. Note that abrt-dbus is D-Bus activatable even when abrtd is stopped."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-07-26T00:00:00.000Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-13T20:53:00.000Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Red Hat would like to thank Vivek Parikh (BreachX Zero Day Labs) for reporting this issue."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-13T21:25:59.256Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-114468",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-21T15:02:53.032Z",
|
||||
"datePublished": "2026-11-13T21:59:04.689Z",
|
||||
"dateUpdated": "2026-11-13T22:01:38.463Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T22:01:38.463Z"
|
||||
},
|
||||
"title": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Hard-coded Credentials",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-798",
|
||||
"description": "CWE-798 Use of Hard-coded Credentials",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "App Connect Operator",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.1.0",
|
||||
"lessThanOrEqual": "12.21.0",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.0",
|
||||
"lessThanOrEqual": "12.0.28",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.0",
|
||||
"lessThanOrEqual": "13.6.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "App Connect Enterprise Certified Containers Operands",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.11.1-r1",
|
||||
"lessThanOrEqual": "12.0.12.5-r1",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.1.0-r1",
|
||||
"lessThanOrEqual": "13.0.6.2-r1",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.12-r1",
|
||||
"lessThanOrEqual": "12.0.12-r28",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.7.0-r1",
|
||||
"lessThanOrEqual": "13.0.9.0-r1",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to<span> can make administrative calls to a running IntegrationRuntime.</span></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296008",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly suggests the following:\n\n\n\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator \n\n\n\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\n\n\n\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM strongly suggests the following:</p><p><strong>App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator</a></p><p><br/><strong>App Connect Enterprise Certified Container 12.0 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,159 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-115501",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-22T16:04:20.832Z",
|
||||
"datePublished": "2026-11-13T21:46:28.286Z",
|
||||
"dateUpdated": "2026-11-13T21:51:38.210Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:46:28.286Z"
|
||||
},
|
||||
"title": "IBM i is Affected By A Buffer Overflow Vulnerability in QFileSvr.400 File System []",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-121",
|
||||
"description": "CWE-121 Stack-based Buffer Overflow",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "i",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "7.6"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "7.5"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "7.4"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "7.3"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM i 7.3 7.4, 7.5, and 7.6 is vulnerable to a stack buffer overflow, caused by improper bounds checking in the QFileSvr.400 file system. By sending a command in the QFileSvr.400 file system, a local authenticated attacker could cause undefined behavior.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM i 7.3 7.4, 7.5, and 7.6 is vulnerable to a stack buffer overflow, caused by improper bounds checking in the QFileSvr.400 file system. By sending a command in the QFileSvr.400 file system, a local authenticated attacker could cause undefined behavior.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296188",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM i Release5770-SS1 \nPTF Number(s)PTF Download Link(s)7.6SJ12288 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12288 7.5SJ12287 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12287 7.4SJ12286 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12286 7.3SJ12285 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12285 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><table><colgroup><col/><col/><col/></colgroup><thead><tr><td><strong>IBM i Release</strong></td><td><strong>5770-SS1 <br/>PTF Number(s)</strong></td><td><strong>PTF Download Link(s)</strong></td></tr></thead><tbody><tr><td>7.6</td><td>SJ12288</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12288\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12288</a></td></tr><tr><td>7.5</td><td>SJ12287</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12287\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12287</a></td></tr><tr><td>7.4</td><td>SJ12286</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12286\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12286</a></td></tr><tr><td>7.3</td><td>SJ12285</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12285\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ12285</a></td></tr></tbody></table></div><p>IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:51:31.064711Z",
|
||||
"id": "CVE-2026-115501",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:51:38.210Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-115788",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-10-23T13:52:20.386Z",
|
||||
"datePublished": "2026-11-13T22:01:07.122Z",
|
||||
"dateUpdated": "2026-11-13T22:01:07.122Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T22:01:07.122Z"
|
||||
},
|
||||
"title": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Log Forging",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-117",
|
||||
"description": "CWE-117 Improper Output Neutralization for Logs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "App Connect Operator",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.1.0",
|
||||
"lessThanOrEqual": "12.21.0",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.0",
|
||||
"lessThanOrEqual": "12.0.28",
|
||||
"versionType": "semver"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.0",
|
||||
"lessThanOrEqual": "13.6.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:app_connect_operator:12.1.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_operator:12.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_operator:13.0.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "App Connect Enterprise Certified Containers Operands",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.11.1-r1",
|
||||
"lessThanOrEqual": "12.0.12.5-r1",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.1.0-r1",
|
||||
"lessThanOrEqual": "13.0.6.2-r1",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "12.0.12-r1",
|
||||
"lessThanOrEqual": "12.0.12-r28",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "13.0.7.0-r1",
|
||||
"lessThanOrEqual": "13.0.9.0-r1",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.11.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.1.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:12.0.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:app_connect_enterprise_certified_containers_operands:cd:13.0.7.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296008",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly suggests the following:\nApp Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\n\nApp Connect Enterprise Certified Container 12.0 LTS (Long Term Support)\nUpgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM strongly suggests the following:</p><p><strong>App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher. Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator</a></p><p><br/><strong>App Connect Enterprise Certified Container 12.0 LTS (Long Term Support)</strong></p><p>Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher. Documentation on the upgrade process is available at <a href=\"https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases\" rel=\"nofollow\">https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,119 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-123628",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-11-06T04:02:30.527Z",
|
||||
"datePublished": "2026-11-13T21:50:13.487Z",
|
||||
"dateUpdated": "2026-11-13T21:50:13.487Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:50:13.487Z"
|
||||
},
|
||||
"title": "IBM webMethods Integration Server is vulnerable to sensitive information disclousure via admin/server/env API request.",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-200",
|
||||
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "webMethods Integration Server",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "10.15",
|
||||
"lessThanOrEqual": "10.15_Core_Fix2",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "11.1",
|
||||
"lessThanOrEqual": "11.1_Core_Fix11",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:webmethods_integration_server:10.15:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:webmethods_integration_server:11.1:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296466",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now by applying the mentioned core fixes or later core fixes for the affected versions and following the respective fix readme document.\n\n\n\nIS_10.15_Core_Fix27 or later\n\nIS_11.1_Core_Fix12 or later\n\n\n\n\n\nFixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software https://www.ibm.com/support/pages/node/7232491",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div>IBM strongly recommends addressing the vulnerability now by applying the mentioned core fixes or later core fixes for the affected versions and following the respective fix readme document.</div><div></div><div>IS_10.15_Core_Fix27 or later</div><div>IS_11.1_Core_Fix12 or later</div><div></div><div></div><div>Fixes can be downloaded and installed via IBM webMethods Update Manager. Refer to <a href=\"https://www.ibm.com/support/pages/node/7232491\" rel=\"nofollow\">How to Download webMethods Software</a></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-124020",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T18:38:38.544Z",
|
||||
"datePublished": "2026-11-13T21:43:00.963Z",
|
||||
"dateUpdated": "2026-11-13T21:43:00.963Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-13T21:43:00.963Z"
|
||||
},
|
||||
"title": "Control Web Panel < 1.30.6 Host Header Password Reset Poisoning",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account."
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-10T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Weak Password Recovery Mechanism for Forgotten Password",
|
||||
"cweId": "CWE-640",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "Control Web Panel",
|
||||
"product": "Control Web Panel",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "1.30.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"baseScore": 9.2,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://control-webpanel.com/changelog",
|
||||
"name": "CWP Changelog",
|
||||
"tags": [
|
||||
"release-notes",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/control-web-panel-host-header-password-reset-poisoning",
|
||||
"name": "VulnCheck Advisory: Control Web Panel < 1.30.6 Host Header Password Reset Poisoning",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Valentin Lobstein (Chocapikk)",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-124021",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-06T18:38:38.544Z",
|
||||
"datePublished": "2026-11-13T21:43:13.762Z",
|
||||
"dateUpdated": "2026-11-13T21:43:13.762Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-13T21:43:13.762Z"
|
||||
},
|
||||
"title": "Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes."
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-10T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Incorrect Authorization",
|
||||
"cweId": "CWE-863",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"vendor": "Control Web Panel",
|
||||
"product": "Control Web Panel",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver",
|
||||
"lessThan": "1.30.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"baseScore": 9.2,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://control-webpanel.com/changelog",
|
||||
"name": "CWP Changelog",
|
||||
"tags": [
|
||||
"release-notes",
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/control-web-panel-authorization-bypass-via-oauth-authorization-codes",
|
||||
"name": "VulnCheck Advisory: Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Valentin Lobstein (Chocapikk)",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T16:30:10.903Z",
|
||||
"datePublished": "2026-11-13T19:18:18.761Z",
|
||||
"dateUpdated": "2026-11-13T19:18:18.761Z"
|
||||
"dateUpdated": "2026-11-13T21:21:44.568Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -145,6 +145,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:21:35.095863Z",
|
||||
"id": "CVE-2026-127213",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:21:44.568Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-12T16:30:10.904Z",
|
||||
"datePublished": "2026-11-13T20:41:10.804Z",
|
||||
"dateUpdated": "2026-11-13T20:41:10.804Z"
|
||||
"dateUpdated": "2026-11-13T21:25:38.595Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -140,6 +140,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:25:31.200782Z",
|
||||
"id": "CVE-2026-127216",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:25:38.595Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,20 +8,20 @@
|
||||
"assignerShortName": "zephyr",
|
||||
"dateReserved": "2026-11-12T18:50:56.268Z",
|
||||
"datePublished": "2026-11-13T00:23:09.233Z",
|
||||
"dateUpdated": "2026-11-13T00:23:09.233Z"
|
||||
"dateUpdated": "2026-11-13T21:59:41.612Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
|
||||
"shortName": "zephyr",
|
||||
"dateUpdated": "2026-11-13T00:23:09.233Z"
|
||||
"dateUpdated": "2026-11-13T21:59:41.612Z"
|
||||
},
|
||||
"title": "MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed.\n\nThe callers bound part of the span, or none of it:\n\nOn the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB.\nThe serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well.\n\nThe image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication.\n\nWhether a malformed header produces an actual read beyond the area depends on the flash backend:\n\nBackends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read.\nWith MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check.\nThe Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy().\n\nThe bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting.\n\nThe fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller."
|
||||
"value": "bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed.\n\nThe callers bound part of the span, or none of it:\n\nOn the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB.\nZephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) read the header with boot_image_load_header(), which bounds ih_hdr_size + ih_img_size against the flash area. Before MCUboot 2.4.0 that bound did not include ih_protect_tlv_size, which leaves the same gap of up to 64 KB. From 2.4.0 these loaders bound the whole span.\nThe serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well.\n\nThe image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication.\n\nWhether a malformed header produces an actual read beyond the area depends on the flash backend:\n\nBackends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read.\nWith MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check.\nThe Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy().\n\nThe bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path and, before 2.4.0, on the Zephyr loaders, and potentially much further on the serial recovery handlers, which skip the header check. Where validation is repeated at every boot (a pending upgrade, or, before 2.4.0, the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting.\n\nThe fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-12T22:42:47.031Z",
|
||||
"datePublished": "2026-11-13T19:29:04.744Z",
|
||||
"dateUpdated": "2026-11-13T19:29:04.744Z"
|
||||
"dateUpdated": "2026-11-13T21:22:10.163Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -118,6 +118,40 @@
|
||||
"advisory": "GHSA-mw6w-2fmv-pvw3",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:22:02.715419Z",
|
||||
"id": "CVE-2026-128117",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:22:10.163Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-12T22:42:47.031Z",
|
||||
"datePublished": "2026-11-13T19:44:19.075Z",
|
||||
"dateUpdated": "2026-11-13T19:44:19.075Z"
|
||||
"dateUpdated": "2026-11-13T21:22:54.622Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -170,6 +170,40 @@
|
||||
"advisory": "GHSA-jf9x-2fg2-hx4w",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:22:41.259065Z",
|
||||
"id": "CVE-2026-128121",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:22:54.622Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-12T22:42:47.032Z",
|
||||
"datePublished": "2026-11-13T20:25:56.650Z",
|
||||
"dateUpdated": "2026-11-13T20:25:56.650Z"
|
||||
"dateUpdated": "2026-11-13T21:24:58.089Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -117,6 +117,40 @@
|
||||
"advisory": "GHSA-5pv8-vvhc-h7jv",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:24:50.484299Z",
|
||||
"id": "CVE-2026-128125",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:24:58.089Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-11-12T22:42:47.032Z",
|
||||
"datePublished": "2026-11-13T20:33:45.088Z",
|
||||
"dateUpdated": "2026-11-13T20:33:45.088Z"
|
||||
"dateUpdated": "2026-11-13T21:25:19.830Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -117,6 +117,40 @@
|
||||
"advisory": "GHSA-pw86-h8fm-j323",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:25:12.290566Z",
|
||||
"id": "CVE-2026-128129",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:25:19.830Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-13T11:51:21.521Z",
|
||||
"datePublished": "2026-11-13T21:06:46.450Z",
|
||||
"dateUpdated": "2026-11-13T21:06:46.450Z"
|
||||
"dateUpdated": "2026-11-13T21:19:18.067Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -116,6 +116,48 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462795",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:19:12.316022Z",
|
||||
"id": "CVE-2026-128885",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:19:18.067Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,121 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-128886",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-13T11:51:37.809Z",
|
||||
"datePublished": "2026-11-13T21:42:20.482Z",
|
||||
"dateUpdated": "2026-11-13T21:42:20.482Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 6.2,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because the server processes this verification without enforcing a timeout, the stalled connection blocks the accept process and prevents legitimate clients from establishing new connections."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 10",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "dbus",
|
||||
"defaultStatus": "unknown",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-128886",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2472930",
|
||||
"name": "RHBZ#2472930",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-08-19T16:20:17.572Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-1322",
|
||||
"description": "Use of Blocking Code in Single-threaded, Non-blocking Context",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Disable non-standard `nonce-tcp` listeners in the D-Bus configuration in favor of standard UNIX domain sockets. If network reachability is required, restrict access to trusted hosts using `firewalld`.\n\nTo remove an exposed port from an untrusted firewall zone:\n\n```\nfirewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>\nfirewall-cmd --reload\n```\n\nCaveats:\nRestricting or disabling network listeners prevents remote clients outside the trusted subnet from connecting to the affected bus.\n\nWarning:\nReloading the firewall rules or altering the D-Bus server configuration requires restarting the affected D-Bus service, which will drop existing connections and temporarily disrupt communications."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-05-11T20:27:44.000Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-08-19T16:20:17.572Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-13T21:42:20.482Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-129137",
|
||||
"assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "DEVOLUTIONS",
|
||||
"dateReserved": "2026-11-13T16:27:13.602Z",
|
||||
"datePublished": "2026-11-13T21:22:47.164Z",
|
||||
"dateUpdated": "2026-11-13T21:22:47.164Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
|
||||
"shortName": "DEVOLUTIONS",
|
||||
"dateUpdated": "2026-11-13T21:22:47.164Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-276",
|
||||
"description": "CWE-276 Incorrect Default Permissions",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Devolutions",
|
||||
"product": "PowerShell Universal",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "2026.3.5",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://devolutions.net/security/advisories/DEVO-2026-0042/"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.2"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-13T16:38:46.763Z",
|
||||
"datePublished": "2026-11-13T17:22:08.201Z",
|
||||
"dateUpdated": "2026-11-13T17:22:08.201Z"
|
||||
"dateUpdated": "2026-11-13T21:20:02.120Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -136,6 +136,40 @@
|
||||
"x_generator": {
|
||||
"engine": "vulncheck-endgame"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:19:55.030136Z",
|
||||
"id": "CVE-2026-129142",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:20:02.120Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,178 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-129173",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-13T17:24:24.246Z",
|
||||
"datePublished": "2026-11-13T22:15:11.985Z",
|
||||
"dateUpdated": "2026-11-13T22:15:11.985Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-13T22:15:11.985Z"
|
||||
},
|
||||
"title": "Stirling-Tools Stirling-PDF Participant Details Endpoint WorkflowParticipantController.java session timeout",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-1463",
|
||||
"lang": "en",
|
||||
"description": "Insufficient Session Timeout Value"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-1462",
|
||||
"lang": "en",
|
||||
"description": "Improper Session Management"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Stirling-Tools",
|
||||
"product": "Stirling-PDF",
|
||||
"versions": [
|
||||
{
|
||||
"version": "3.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "3.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "3.2",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "3.3.0",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:stirling-tools:stirling-pdf:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"modules": [
|
||||
"Participant Details Endpoint"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 6.9,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 5,
|
||||
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-13T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-13T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-13T18:29:30.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Vu Hoang Dat (VulDB User)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB CNA Team",
|
||||
"type": "coordinator"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/437206",
|
||||
"name": "VDB-437206 | Stirling-Tools Stirling-PDF Participant Details Endpoint WorkflowParticipantController.java session timeout",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/437206/cti",
|
||||
"name": "VDB-437206 | CTI Indicators (IOB, IOC, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-129173",
|
||||
"name": "CVE-2026-129173 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1042368",
|
||||
"name": "Submit #1042368 | Stirling-Tools Stirling-PDF 3.2.0 Insufficient Session Expiration (CWE-613)",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,20 +8,20 @@
|
||||
"assignerShortName": "zephyr",
|
||||
"dateReserved": "2026-07-22T19:47:52.428Z",
|
||||
"datePublished": "2026-11-13T00:23:00.336Z",
|
||||
"dateUpdated": "2026-11-13T00:23:00.336Z"
|
||||
"dateUpdated": "2026-11-13T21:59:04.545Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
|
||||
"shortName": "zephyr",
|
||||
"dateUpdated": "2026-11-13T00:23:00.336Z"
|
||||
"dateUpdated": "2026-11-13T21:59:04.545Z"
|
||||
},
|
||||
"title": "Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record.\n\nThe defect is reachable only under MCUBOOT_MEASURED_BOOT, and only when the image reaching boot_save_boot_status() was not hash-validated on that boot. bootutil_img_validate() rejects a hash TLV whose length is not exactly sizeof(hash) (boot/bootutil/src/image_validate.c:345), and primary-slot validation is on by default (Zephyr's CONFIG_BOOT_VALIDATE_SLOT0 defaults to y), so in a default build the malformed image never reaches this code. The direct-XIP and RAM-load strategies in boot/bootutil/src/loader.c validate the selected slot unconditionally and are not affected. The short TLV survives only where the integrator has turned primary-slot validation off: the swap and overwrite loader built without MCUBOOT_VALIDATE_PRIMARY_SLOT, which checks only the image magic before calling boot_add_shared_data(), and the Zephyr single-slot loader (boot/zephyr/single_loader.c) built without it, including the MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE variant, which skips validation once the trailer records an earlier successful one. It is also reachable through a time-of-check/time-of-use change to tamperable external flash between validation and the boot-record read. Placing the crafted image requires physical or flash-write access to the device; in a single-slot build with serial recovery enabled, the serial-recovery upload writes the primary slot directly and can place it as well.\n\nIn these configurations the boot record's measurement is already not trustworthy: with validation off, the hash copied into the record is the image's own unverified EXPECTED_HASH_TLV, which the attacker chooses. The defect therefore does not weaken attestation integrity any further. What it adds is a path for bootloader memory to leave the device: up to 63 bytes (IMAGE_HASH_SIZE - 1) of uninitialised bootloader stack are embedded in the measurement field that a downstream attestation service sends to a remote verifier. In the configurations analysed the residue is bootloader internal state (TLV offsets and lengths, flash addresses, loop state), not key material, but what occupies that stack region depends on configuration and on which code ran before boot_save_boot_status(). It is reported as a low-severity, defense-in-depth disclosure with no integrity or availability impact.\n\nThis is distinct from the already-fixed record_len integer underflow in the same routine (GHSA-8hrv-4cp5-4rg3). The fix rejects any EXPECTED_HASH_TLV whose length is not exactly IMAGE_HASH_SIZE."
|
||||
"value": "boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record.\n\nThe defect is reachable only under MCUBOOT_MEASURED_BOOT, and only when nothing has checked the length of the hash TLV before boot_save_boot_status() reads it. bootutil_img_validate() rejects a hash TLV whose length is not exactly sizeof(hash) (boot/bootutil/src/image_validate.c:345), and primary-slot validation is on by default (Zephyr's CONFIG_BOOT_VALIDATE_SLOT0 defaults to y), so in a default build the malformed image never reaches this code. Two kinds of build let a short TLV through:\n\nBuilds that use pure signatures (MCUBOOT_SIGN_PURE, Zephyr CONFIG_BOOT_SIGNATURE_TYPE_PURE). The signature covers the image itself, so the hash-TLV check in bootutil_img_validate() is compiled out, and a pure-signed image normally carries no hash TLV. A hash TLV is still allowed in the unprotected TLV area, which the signature does not cover, so a short one can be added to a correctly signed image without invalidating it. This applies with every upgrade strategy, including direct-XIP and RAM-load, and the modified image can be delivered through any path that accepts a signed image.\nBuilds with primary-slot validation turned off: the swap and overwrite loader built without MCUBOOT_VALIDATE_PRIMARY_SLOT, which checks only the image magic before calling boot_add_shared_data(), and the Zephyr single-slot loader (boot/zephyr/single_loader.c) built without it, including the MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE variant, which skips validation once the trailer records an earlier successful one. Placing the crafted image requires physical or flash-write access to the device; in a single-slot build with serial recovery enabled, the serial-recovery upload writes the primary slot directly and can place it as well. Outside pure-signature builds, the direct-XIP and RAM-load strategies in boot/bootutil/src/loader.c validate the selected slot unconditionally and are not affected.\n\nIt is also reachable through a time-of-check/time-of-use change to tamperable external flash between validation and the boot-record read.\n\nIn these configurations the boot record's measurement is already not trustworthy: the hash copied into the record is the image's own EXPECTED_HASH_TLV, which nothing has verified and which the attacker chooses. The defect therefore does not weaken attestation integrity any further. What it adds is a path for bootloader memory to leave the device: up to 63 bytes (IMAGE_HASH_SIZE - 1) of uninitialised bootloader stack are embedded in the measurement field that a downstream attestation service sends to a remote verifier. In the configurations analysed the residue is bootloader internal state (TLV offsets and lengths, flash addresses, loop state), not key material, but what occupies that stack region depends on configuration and on which code ran before boot_save_boot_status(). It is reported as a low-severity, defense-in-depth disclosure with no integrity or availability impact.\n\nThis is distinct from the already-fixed record_len integer underflow in the same routine (GHSA-8hrv-4cp5-4rg3). The fix rejects any EXPECTED_HASH_TLV whose length is not exactly IMAGE_HASH_SIZE."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -8,20 +8,20 @@
|
||||
"assignerShortName": "zephyr",
|
||||
"dateReserved": "2026-07-22T19:47:54.908Z",
|
||||
"datePublished": "2026-11-13T00:23:05.652Z",
|
||||
"dateUpdated": "2026-11-13T00:23:05.652Z"
|
||||
"dateUpdated": "2026-11-13T21:59:26.710Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
|
||||
"shortName": "zephyr",
|
||||
"dateUpdated": "2026-11-13T00:23:05.652Z"
|
||||
"dateUpdated": "2026-11-13T21:59:26.710Z"
|
||||
},
|
||||
"title": "Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without any range check. It then passes img_num straight to flash_area_id_from_multi_image_slot(img_num, 0), which on the Zephyr port resolves to __flash_area_ids_for_slot() in boot/zephyr/include/sysflash/sysflash.h and indexes the static const int all_slots[] table as all_slots[img_num 2]. That table holds only MCUBOOT_IMAGE_NUMBER 2 entries, so any img_num >= MCUBOOT_IMAGE_NUMBER is an out-of-bounds read.\n\nThe path is reachable by anyone with access to the serial / SMP recovery console, which is unauthenticated by design, and the bad value is supplied before any image signature is verified. The defect is specific to the default non-direct upload path (MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD disabled) on the Zephyr port with the array-backed slot layout (not CONFIG_SINGLE_APPLICATION_SLOT). It is not gated on a multi-image configuration: MCUBOOT_IMAGE_NUMBER defaults to 1, so even a default single-image build is affected for any image >= 1. The MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD path is safe (its flash_area_id_from_direct_image() switch returns -EINVAL for unknown indices).\n\nflash_area_id_from_multi_image_slot() takes a signed int image_index while img_num is uint32_t, so the attacker controls the sign of the index as well as its magnitude: an image of 0xFFFFFFFF converts to -1 and reads all_slots[-2], off the front of the table, while large positive values read off the end (CWE-192). Either way the index multiply img * 2 is performed in int, so a wild offset yields a bus/hard fault, giving a reliable denial of service of the bootloader during recovery. For moderately out-of-range indices the read returns adjacent .rodata as a garbage flash-area id that is handed to flash_area_open(); this normally fails with MGMT_ERR_EINVAL, but if the garbage id happens to match a valid non-image partition, the subsequent erase/write can target a partition outside the image set (CWE-787). The attacker-supplied value is never echoed back, so there is no information disclosure. The fix is to reject img_num >= BOOT_IMAGE_NUMBER on the off == 0 packet, before the slot lookup. The comparison must be made on the unsigned img_num: an equivalent guard applied after the conversion to int would not reject the negative case above. __flash_area_ids_for_slot() should bounds-check its own arguments as defence in depth.\nThis vulnerability was reported independently twice: by NVIDIA Project Vanessa on 2026-06-22, and by Kai Phan (@kaimandalic) on 2026-07-19 as GHSA-8v33-88p6-jffj, which is closed as a duplicate of this advisory. Both original reports are reproduced in full below."
|
||||
"value": "MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without any range check. It then passes img_num straight to flash_area_id_from_multi_image_slot(img_num, 0), which on the Zephyr port resolves to __flash_area_ids_for_slot() in boot/zephyr/include/sysflash/sysflash.h and indexes the static const int all_slots[] table as all_slots[img_num 2]. That table holds only MCUBOOT_IMAGE_NUMBER 2 entries, so any img_num >= MCUBOOT_IMAGE_NUMBER is an out-of-bounds read.\n\nThe path is reachable by anyone with access to the serial / SMP recovery console, which is unauthenticated by design, and the bad value is supplied before any image signature is verified. The defect is specific to the default non-direct upload path (MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD disabled) on the Zephyr port with the array-backed slot layout (not CONFIG_SINGLE_APPLICATION_SLOT). It is not gated on a multi-image configuration: MCUBOOT_IMAGE_NUMBER defaults to 1, so even a default single-image build is affected for any image >= 1. The MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD path is safe (its flash_area_id_from_direct_image() switch returns -EINVAL for unknown indices).\n\nflash_area_id_from_multi_image_slot() takes a signed int image_index while img_num is uint32_t, so the attacker controls the sign of the index as well as its magnitude: an image of 0xFFFFFFFE converts to -2 and reads all_slots[-4], off the front of the table, while large positive values read off the end (CWE-192). (0xFFFFFFFF itself is the \"no image given\" sentinel and selects image 0.) Either way the index multiply img * 2 is performed in int, so a wild offset yields a bus/hard fault, giving a reliable denial of service of the bootloader during recovery. For moderately out-of-range indices the read returns adjacent .rodata as a garbage flash-area id that is handed to flash_area_open(); this normally fails with MGMT_ERR_EINVAL, but if the garbage id happens to match a valid non-image partition, the subsequent erase/write can target a partition outside the image set (CWE-787). The attacker-supplied value is never echoed back, so there is no information disclosure. The fix is to reject img_num >= BOOT_IMAGE_NUMBER on the off == 0 packet, before the slot lookup. The comparison must be made on the unsigned img_num: an equivalent guard applied after the conversion to int would not reject the negative case above. __flash_area_ids_for_slot() should bounds-check its own arguments as defence in depth.\nThis vulnerability was reported independently twice: by NVIDIA Project Vanessa on 2026-06-22, and by Kai Phan (@kaimandalic) on 2026-07-19 as GHSA-8v33-88p6-jffj, which is closed as a duplicate of this advisory. Both original reports are reproduced in full below."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
@@ -56,7 +56,21 @@
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/mcu-tools/mcuboot/commit/183a05f256bdbbac86edcb048958da59018f814e",
|
||||
"name": "Fix commit",
|
||||
"name": "Fix commit 183a05f256bd",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/mcu-tools/mcuboot/commit/b35d623fc44b873cbb244a4fb0930f259ff45eb8",
|
||||
"name": "Fix commit b35d623fc44b",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/mcu-tools/mcuboot/commit/f30be48bcc58d18c22e61be914e8f7b380abcf53",
|
||||
"name": "Fix commit f30be48bcc58",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
|
||||
@@ -0,0 +1,150 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-19194",
|
||||
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "HashiCorp",
|
||||
"dateReserved": "2026-08-06T20:09:20.603Z",
|
||||
"datePublished": "2026-11-13T21:17:56.457Z",
|
||||
"dateUpdated": "2026-11-13T21:30:34.534Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unaffected",
|
||||
"platforms": [
|
||||
"64 bit",
|
||||
"32 bit",
|
||||
"x86",
|
||||
"ARM",
|
||||
"MacOS",
|
||||
"Windows",
|
||||
"Linux"
|
||||
],
|
||||
"product": "Shared library",
|
||||
"repo": "https://github.com/hashicorp/cap",
|
||||
"vendor": "HashiCorp",
|
||||
"versions": [
|
||||
{
|
||||
"lessThan": "0.14.0",
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This issue was reported to HashiCorp by anaximand3r and doyensec-mohamed."
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<p>The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.</p><br/>"
|
||||
}
|
||||
],
|
||||
"value": "The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0."
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-71",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-71: Using Unicode Encoding to Bypass Validation Logic"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"baseScore": 5.9,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-178",
|
||||
"description": "CWE-178: Improper Handling of Case Sensitivity",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
|
||||
"shortName": "HashiCorp",
|
||||
"dateUpdated": "2026-11-13T21:17:56.457Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://discuss.hashicorp.com/t/hcsec-2026-60-cap-jwt-claims-validation-bypass-using-non-canonical-claim-names/78258"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "HCSEC-2026-60",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"title": "CAP JWT claims validation bypass using non-canonical claim names"
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:30:24.747414Z",
|
||||
"id": "CVE-2026-19194",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:30:34.534Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,110 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-5514",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-04-03T21:10:16.398Z",
|
||||
"datePublished": "2026-11-13T21:51:23.679Z",
|
||||
"dateUpdated": "2026-11-13T21:51:23.679Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:51:23.679Z"
|
||||
},
|
||||
"title": "IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-200",
|
||||
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Bob",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:bob:2.0.3:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296454",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "LOW",
|
||||
"baseScore": 3.3,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to V 2.0.4 https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1 \n\n\n\nWe recommend reviewing the documentation for guidance on installing IBM Bob IDE https://internal.bob.ibm.com/docs/ide",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to the latest IBM Bob to <a href=\"https://internal.bob.ibm.com/docs/ide/getting-started/install#download-ibm-bob-1\" rel=\"nofollow\">V 2.0.4</a></p><p>We recommend reviewing the documentation for guidance on installing <a href=\"https://internal.bob.ibm.com/docs/ide\" rel=\"nofollow\">IBM Bob IDE</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-07-20T17:12:12.891Z",
|
||||
"datePublished": "2026-11-13T18:51:06.844Z",
|
||||
"dateUpdated": "2026-11-13T18:51:06.844Z"
|
||||
"dateUpdated": "2026-11-13T21:19:27.941Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -97,6 +97,48 @@
|
||||
"advisory": "GHSA-mmg6-p4pr-cj6h",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:19:09.622280Z",
|
||||
"id": "CVE-2026-64675",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "yes"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:19:27.941Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-07-30T19:56:44.102Z",
|
||||
"datePublished": "2026-11-13T19:14:35.246Z",
|
||||
"dateUpdated": "2026-11-13T19:14:35.246Z"
|
||||
"dateUpdated": "2026-11-13T21:20:37.560Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -113,6 +113,48 @@
|
||||
"advisory": "GHSA-576g-r8m3-q9vp",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vp",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:20:18.692189Z",
|
||||
"id": "CVE-2026-68551",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:20:37.560Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-08-04T20:17:18.298Z",
|
||||
"datePublished": "2026-08-06T15:38:22.994Z",
|
||||
"dateUpdated": "2026-11-08T14:08:33.530Z"
|
||||
"dateUpdated": "2026-11-13T21:26:51.973Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -220,6 +220,25 @@
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-08-07T16:18:40.029Z"
|
||||
}
|
||||
},
|
||||
{
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-13T21:26:51.973Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.youtube.com/watch?v=_FKX5hDwgVE&t=1079s"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cyera.com/research/breaking-local-ai-runtimes-10-vulnerabilities-in-the-engine-behind-your-open-source-models"
|
||||
}
|
||||
],
|
||||
"title": "CVE Program Container",
|
||||
"x_generator": {
|
||||
"engine": "ADPogram 0.0.1"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,110 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-82102",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-08-28T04:58:54.628Z",
|
||||
"datePublished": "2026-11-13T22:08:09.210Z",
|
||||
"dateUpdated": "2026-11-13T22:08:09.210Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T22:08:09.210Z"
|
||||
},
|
||||
"title": "DataStage on Cloud Pak for Data has vulnerabilities due to open source software",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-918",
|
||||
"description": "CWE-918 Server-Side Request Forgery",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "DataStage on Cloud Pak for Data",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "5.4.0.0"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296194",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0\n\nUpgrade to 5.4 patch 9 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x .",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>DataStage on Cloud Pak for Data</td><td>5.4.0.0</td><td><p>Upgrade to 5.4 patch 9 or later by following these <a href=\"https://www.ibm.com/docs/en/software-hub/5.4.x?topic=overview-available-patches-software-hub-version-540\" rel=\"nofollow\">instructions</a>.</p></td></tr></tbody></table></div><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "GitHub_M",
|
||||
"dateReserved": "2026-08-28T22:00:43.514Z",
|
||||
"datePublished": "2026-11-13T18:40:31.749Z",
|
||||
"dateUpdated": "2026-11-13T18:40:31.749Z"
|
||||
"dateUpdated": "2026-11-13T21:18:08.561Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -94,6 +94,48 @@
|
||||
"advisory": "GHSA-8456-m9x4-j6mc",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc",
|
||||
"tags": [
|
||||
"exploit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:17:48.680575Z",
|
||||
"id": "CVE-2026-82414",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "poc"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "total"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:18:08.561Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-91868",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-09-15T10:02:26.503Z",
|
||||
"datePublished": "2026-11-13T22:07:40.779Z",
|
||||
"dateUpdated": "2026-11-13T22:07:40.779Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T22:07:40.779Z"
|
||||
},
|
||||
"title": "IBM Security QRadar EDR Improper Access Control",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-284",
|
||||
"description": "CWE-284 Improper Access Control",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Security QRadar EDR",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "3.12.0",
|
||||
"lessThanOrEqual": "3.12.26",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296309",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM encourages customers to update their systems promptly.\nProductFix versionIBM Security QRadar EDR3.12.27\nThe IBM Security QRadar EDR operator can be upgraded automatically when new compatible versions are available. However, you can control whether an operator is upgraded automatically by setting an approval strategy.\nTwo approval strategies are available:\nAutomatic (default) - New operator versions are installed automatically when they are available on the subscription channel.\nManual - When a new operator version is available on the subscription channel, the subscription indicates that an update is available, but you must approve the update manually.\nFor more information about the manual installation process, view Installing QRadar EDR",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM encourages customers to update their systems promptly.</p><div><table><tbody><tr><td>Product</td><td>Fix version</td></tr><tr><td>IBM Security QRadar EDR</td><td>3.12.27</td></tr></tbody></table></div><p></p><p>The IBM Security QRadar EDR operator can be upgraded automatically when new compatible versions are available. However, you can control whether an operator is upgraded automatically by setting an approval strategy.</p><div><p>Two approval strategies are available:</p><ul><li>Automatic (default) - New operator versions are installed automatically when they are available on the subscription channel.</li><li>Manual - When a new operator version is available on the subscription channel, the subscription indicates that an update is available, but you must approve the update manually.</li></ul><p>For more information about the manual installation process, view <a href=\"https://www.ibm.com/docs/en/security-qradar-edr/3.12?topic=overview-whats-new-changed\" rel=\"noopener noreferrer nofollow\">Installing QRadar EDR</a></p></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-91869",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-09-15T10:03:48.497Z",
|
||||
"datePublished": "2026-11-13T22:07:38.289Z",
|
||||
"dateUpdated": "2026-11-13T22:07:38.289Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T22:07:38.289Z"
|
||||
},
|
||||
"title": "IBM Security QRadar EDR Improper Restriction of Excessive Authentication Attempts",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-307",
|
||||
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Security QRadar EDR",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "3.12.0",
|
||||
"lessThanOrEqual": "3.12.26",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296309",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM encourages customers to update their systems promptly.\n\nProductFix versionIBM Security QRadar EDR3.12.27\n\n\n\n\n\n\n\nThe IBM Security QRadar EDR operator can be upgraded automatically when new compatible versions are available. However, you can control whether an operator is upgraded automatically by setting an approval strategy.\n\n\n\nTwo approval strategies are available:\n\n * Automatic (default) - New operator versions are installed automatically when they are available on the subscription channel.\n * Manual - When a new operator version is available on the subscription channel, the subscription indicates that an update is available, but you must approve the update manually.\n\n\n\n\nFor more information about the manual installation process, view Installing QRadar EDR https://www.ibm.com/docs/en/security-qradar-edr/3.12",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM encourages customers to update their systems promptly.</p><div><table><tbody><tr><td>Product</td><td>Fix version</td></tr><tr><td>IBM Security QRadar EDR</td><td>3.12.27</td></tr></tbody></table></div><p></p><p>The IBM Security QRadar EDR operator can be upgraded automatically when new compatible versions are available. However, you can control whether an operator is upgraded automatically by setting an approval strategy.</p><div><p>Two approval strategies are available:</p><ul><li>Automatic (default) - New operator versions are installed automatically when they are available on the subscription channel.</li><li>Manual - When a new operator version is available on the subscription channel, the subscription indicates that an update is available, but you must approve the update manually.</li></ul><p>For more information about the manual installation process, view <a href=\"https://www.ibm.com/docs/en/security-qradar-edr/3.12?topic=overview-whats-new-changed\" rel=\"noopener noreferrer nofollow\">Installing QRadar EDR</a></p></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-94407",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-09-21T14:03:52.354Z",
|
||||
"datePublished": "2026-11-13T21:43:35.363Z",
|
||||
"dateUpdated": "2026-11-13T21:43:35.363Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:43:35.363Z"
|
||||
},
|
||||
"title": "IBM ContextForge MCP Gateway is affected by a regular expression denial of service",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-1333",
|
||||
"description": "CWE-1333 Inefficient Regular Expression Complexity",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "ContextForge MCP Gateway",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.0.11",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.11:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is potentially vulnerable to denial of service due to uncontrolled regular expression complexity (CWE-400 / ReDoS). An authenticated user with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool's JSON Schema `pattern` field; when ContextForge validates arguments against that schema, the validation call may consume unbounded CPU, potentially degrading gateway availability.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is potentially vulnerable to denial of service due to uncontrolled regular expression complexity (CWE-400 / ReDoS). An authenticated user with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool's JSON Schema `pattern` field; when ContextForge validates arguments against that schema, the validation call may consume unbounded CPU, potentially degrading gateway availability.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7296667",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "None. IBM strongly recommends upgrading to the fixed version.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div>None. IBM strongly recommends upgrading to the fixed version.</div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\n\n\n\nv1.0.0 - v1.0.11Upgrade to v1.1.0. See [ v1.1.0 release notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range </strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td><div><div>IBM ContextForge MCP Gateway</div></div></td><td>v1.0.0 - v1.0.11</td><td><div><div>Upgrade to v1.1.0. See [<a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0\" rel=\"nofollow\">v1.1.0 release notes</a>]</div></div></td></tr></tbody></table></div><p></p><p></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Zenitel",
|
||||
"dateReserved": "2026-09-22T05:16:26.266Z",
|
||||
"datePublished": "2026-11-13T15:43:32.974Z",
|
||||
"dateUpdated": "2026-11-13T15:43:32.974Z"
|
||||
"dateUpdated": "2026-11-13T21:42:12.008Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -242,6 +242,40 @@
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:42:03.268405Z",
|
||||
"id": "CVE-2026-95379",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:42:12.008Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,147 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-97683",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-09-24T20:56:29.625Z",
|
||||
"datePublished": "2026-11-13T21:36:07.726Z",
|
||||
"dateUpdated": "2026-11-13T21:49:12.852Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:36:07.726Z"
|
||||
},
|
||||
"title": "IBM Cyber Fraud includes components with multiple known vulnerabilities",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-693",
|
||||
"description": "CWE-693 Protection Mechanism Failure",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Cyber Fraud",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7295966",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "LOW",
|
||||
"baseScore": 2.5,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p>Please upgrade to at least version 1.1.1 according to the following instructions:<br/><br/><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud</a></p><p><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-13T21:49:04.702035Z",
|
||||
"id": "CVE-2026-97683",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-13T21:49:12.852Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,163 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-9661",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-05-26T21:50:46.277Z",
|
||||
"datePublished": "2026-11-13T21:40:35.827Z",
|
||||
"dateUpdated": "2026-11-13T22:10:14.165Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-13T21:41:13.780Z"
|
||||
},
|
||||
"title": "Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise."
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-13T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uncontrolled Search Path Element",
|
||||
"cweId": "CWE-427",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unknown",
|
||||
"vendor": "Poste Italiane",
|
||||
"product": "Postecert FIRMAOK!",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.6.29",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.3,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://seclists.org/fulldisclosure/2026/Nov/14",
|
||||
"name": "Researcher Disclosure",
|
||||
"tags": [
|
||||
"technical-description",
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://postecert.poste.it/firma/download.shtml",
|
||||
"name": "Product Download",
|
||||
"tags": [
|
||||
"product"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/postecert-firmaok-local-privilege-escalation-via-openssl-search-path",
|
||||
"name": "VulnCheck Advisory: Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Andrea Intilangelo",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2026/Nov/14"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-13T22:10:14.165Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-9821",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-05-28T11:27:43.155Z",
|
||||
"datePublished": "2026-11-13T21:34:23.559Z",
|
||||
"dateUpdated": "2026-11-13T21:34:23.559Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:34:23.559Z"
|
||||
},
|
||||
"title": "IBM Cyber Fraud includes components with multiple known vulnerabilities",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-117",
|
||||
"description": "CWE-117 Improper Output Neutralization for Logs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Cyber Fraud",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7295966",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p>Please upgrade to at least version 1.1.1 according to the following instructions:<br/><br/><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud</a></p><p><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-9870",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-05-28T17:18:38.929Z",
|
||||
"datePublished": "2026-11-13T21:35:56.221Z",
|
||||
"dateUpdated": "2026-11-13T21:35:56.221Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:35:56.221Z"
|
||||
},
|
||||
"title": "IBM Cyber Fraud includes components with multiple known vulnerabilities",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-79",
|
||||
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Cyber Fraud",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7295966",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p>Please upgrade to at least version 1.1.1 according to the following instructions:<br/><br/><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud</a></p><p><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user