Search criteria

112 vulnerabilities found for Tivoli by IBM

CERTFR-2025-AVI-1013

Vulnerability from certfr_avis - Published: 2025-11-14 - Updated: 2025-11-14

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
IBM AIX AIX versions 7.2.5 sans le correctif de sécurité IJ55968 SP11
IBM Sterling Sterling Transformation Extender versions 11.0.2.0 sans le correctif de sécurité PH68819
IBM QRadar QRadar Network Packet Capture versions 7.5.x antérieures à QRadar Network Packet Capture 7.5.0 Update Package 14
IBM AIX AIX versions 7.3.2 sans le correctif de sécurité IJ56113
IBM Sterling Sterling Transformation Extender versions 11.0.1.1 sans le correctif de sécurité PH68819
IBM Sterling Sterling Transformation Extender versions 11.0.0.0 sans le correctif de sécurité PH68266
IBM WebSphere WebSphere Application Server versions 9.0.x sans le correctif de sécurité 9.0.5.27
IBM Sterling Sterling Transformation Extender versions 10.1.1.1 sans le correctif de sécurité PH68266
IBM Db2 Db2 versions 11.5.x sans le dernier correctif de sécurité
IBM Tivoli Tivoli Application Dependency Discovery Manager versions 7.3.x à 7.3.0.12 sans le correctif de sécurité efix_CVE-2025-48976_FP12250331.zip
IBM N/A QRadar DNS Analyzer App versions antérieures à 2.0.4
IBM Db2 Db2 versions 12.1.x antérieures à 12.1.3 sans le dernier correctif de sécurité
IBM WebSphere WebSphere Application Server Liberty versions 17.0.0.3 à 25.0.0.11 sans le correctif de sécurité 25.0.0.12
IBM WebSphere WebSphere Application Server versions 8.5.x sans le correctif de sécurité 8.5.5.29
IBM AIX AIX versions 7.3.1 sans le correctif de sécurité IJ56230
IBM Cognos Analytics Cognos Analytics Certified Containers versions 1.2.1.x antérieures à 12.1.1
IBM Sterling Sterling Transformation Extender versions 10.1.2.1 sans le correctif de sécurité PH68266
IBM Db2 Db2 versions 11.1.x sans le dernier correctif de sécurité
IBM Sterling Sterling Transformation Extender versions 10.1.0.2 sans le correctif de sécurité PH68266
IBM AIX AIX versions 7.3.3 sans le correctif de sécurité IJ55897 SP2
IBM Storage Protect Storage Protect Operations Center versions 8.1.x antérieures à 8.1.27.100
IBM QRadar SIEM QRadar SIEM versions 7.5 à 7.5.0 IP14 sans les correctif de sécurité QRadar 7.5.0 UP14 IF01 et 7.5.0 QRadar Protocol MicrosoftAzureEventHubs
References
Bulletin de sécurité IBM 7250959 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7249983 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7250785 2025-11-11 vendor-advisory
Bulletin de sécurité IBM 7249992 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7249994 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7250921 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7250486 2025-11-07 vendor-advisory
Bulletin de sécurité IBM 7250907 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7250395 2025-11-07 vendor-advisory
Bulletin de sécurité IBM 7250956 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7250763 2025-11-10 vendor-advisory
Bulletin de sécurité IBM 7250474 2025-11-07 vendor-advisory
Bulletin de sécurité IBM 7250971 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7250926 2025-11-12 vendor-advisory
Bulletin de sécurité IBM 7251173 2025-11-13 vendor-advisory

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "AIX versions 7.2.5 sans le correctif de s\u00e9curit\u00e9 IJ55968 SP11",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Transformation Extender versions 11.0.2.0 sans le correctif de s\u00e9curit\u00e9 PH68819",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar Network Packet Capture versions 7.5.x ant\u00e9rieures \u00e0 QRadar Network Packet Capture 7.5.0 Update Package 14",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "AIX versions 7.3.2 sans le correctif de s\u00e9curit\u00e9 IJ56113",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Transformation Extender versions 11.0.1.1 sans le correctif de s\u00e9curit\u00e9 PH68819",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Transformation Extender versions 11.0.0.0 sans le correctif de s\u00e9curit\u00e9 PH68266",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server versions 9.0.x sans le correctif de s\u00e9curit\u00e9  9.0.5.27",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Transformation Extender versions 10.1.1.1 sans le correctif de s\u00e9curit\u00e9 PH68266",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.5.x sans le dernier correctif de s\u00e9curit\u00e9 ",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Application Dependency Discovery Manager versions 7.3.x \u00e0 7.3.0.12 sans le correctif de s\u00e9curit\u00e9 efix_CVE-2025-48976_FP12250331.zip",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar DNS Analyzer App versions ant\u00e9rieures \u00e0 2.0.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 12.1.x ant\u00e9rieures \u00e0 12.1.3 sans le dernier correctif de s\u00e9curit\u00e9 ",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server Liberty versions 17.0.0.3 \u00e0 25.0.0.11 sans le correctif de s\u00e9curit\u00e9 25.0.0.12",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server versions 8.5.x sans le correctif de s\u00e9curit\u00e9  8.5.5.29",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "AIX versions 7.3.1 sans le correctif de s\u00e9curit\u00e9 IJ56230",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics Certified Containers versions 1.2.1.x ant\u00e9rieures \u00e0 12.1.1",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Transformation Extender versions 10.1.2.1 sans le correctif de s\u00e9curit\u00e9 PH68266",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.1.x sans le dernier correctif de s\u00e9curit\u00e9 ",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Transformation Extender versions 10.1.0.2 sans le correctif de s\u00e9curit\u00e9 PH68266",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "AIX versions 7.3.3 sans le correctif de s\u00e9curit\u00e9 IJ55897 SP2",
      "product": {
        "name": "AIX",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Storage Protect Operations Center versions 8.1.x ant\u00e9rieures \u00e0 8.1.27.100",
      "product": {
        "name": "Storage Protect",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar SIEM versions 7.5 \u00e0 7.5.0 IP14 sans les correctif de s\u00e9curit\u00e9 QRadar 7.5.0 UP14 IF01 et 7.5.0 QRadar Protocol MicrosoftAzureEventHubs ",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-6395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6395"
    },
    {
      "name": "CVE-2025-22026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22026"
    },
    {
      "name": "CVE-2024-1597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1597"
    },
    {
      "name": "CVE-2023-1370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370"
    },
    {
      "name": "CVE-2025-36236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36236"
    },
    {
      "name": "CVE-2025-49812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49812"
    },
    {
      "name": "CVE-2025-39757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39757"
    },
    {
      "name": "CVE-2023-46308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46308"
    },
    {
      "name": "CVE-2024-49350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49350"
    },
    {
      "name": "CVE-2025-36251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36251"
    },
    {
      "name": "CVE-2025-49146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49146"
    },
    {
      "name": "CVE-2025-55752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55752"
    },
    {
      "name": "CVE-2025-38461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38461"
    },
    {
      "name": "CVE-2025-7962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7962"
    },
    {
      "name": "CVE-2025-36250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36250"
    },
    {
      "name": "CVE-2024-35255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35255"
    },
    {
      "name": "CVE-2025-50106",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-50106"
    },
    {
      "name": "CVE-2025-38527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38527"
    },
    {
      "name": "CVE-2025-38449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38449"
    },
    {
      "name": "CVE-2022-41946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41946"
    },
    {
      "name": "CVE-2025-39730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39730"
    },
    {
      "name": "CVE-2025-1992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1992"
    },
    {
      "name": "CVE-2025-30754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30754"
    },
    {
      "name": "CVE-2025-36097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36097"
    },
    {
      "name": "CVE-2020-16971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16971"
    },
    {
      "name": "CVE-2022-3510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3510"
    },
    {
      "name": "CVE-2022-3509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3509"
    },
    {
      "name": "CVE-2025-4565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4565"
    },
    {
      "name": "CVE-2025-5318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5318"
    },
    {
      "name": "CVE-2025-36186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36186"
    },
    {
      "name": "CVE-2024-56347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56347"
    },
    {
      "name": "CVE-2025-37797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-37797"
    },
    {
      "name": "CVE-2025-61795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61795"
    },
    {
      "name": "CVE-2024-7254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
    },
    {
      "name": "CVE-2024-52533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52533"
    },
    {
      "name": "CVE-2023-53125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53125"
    },
    {
      "name": "CVE-2025-32990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-32990"
    },
    {
      "name": "CVE-2025-2518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2518"
    },
    {
      "name": "CVE-2025-41244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41244"
    },
    {
      "name": "CVE-2022-49985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49985"
    },
    {
      "name": "CVE-2025-50059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-50059"
    },
    {
      "name": "CVE-2025-1493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1493"
    },
    {
      "name": "CVE-2025-38556",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38556"
    },
    {
      "name": "CVE-2023-26133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26133"
    },
    {
      "name": "CVE-2024-47252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47252"
    },
    {
      "name": "CVE-2025-30761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30761"
    },
    {
      "name": "CVE-2025-36096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36096"
    },
    {
      "name": "CVE-2025-3050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3050"
    },
    {
      "name": "CVE-2025-38718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38718"
    },
    {
      "name": "CVE-2025-38392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38392"
    },
    {
      "name": "CVE-2023-53373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53373"
    },
    {
      "name": "CVE-2025-32988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-32988"
    },
    {
      "name": "CVE-2025-0915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0915"
    },
    {
      "name": "CVE-2024-52903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52903"
    },
    {
      "name": "CVE-2025-38352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38352"
    },
    {
      "name": "CVE-2025-30749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30749"
    },
    {
      "name": "CVE-2023-45287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45287"
    },
    {
      "name": "CVE-2024-56346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56346"
    },
    {
      "name": "CVE-2025-38350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38350"
    },
    {
      "name": "CVE-2025-1000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1000"
    },
    {
      "name": "CVE-2022-31197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31197"
    },
    {
      "name": "CVE-2025-40928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40928"
    },
    {
      "name": "CVE-2022-50087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-50087"
    },
    {
      "name": "CVE-2025-38498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38498"
    },
    {
      "name": "CVE-2025-53057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53057"
    },
    {
      "name": "CVE-2022-3171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3171"
    },
    {
      "name": "CVE-2025-49630",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49630"
    },
    {
      "name": "CVE-2025-53066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53066"
    },
    {
      "name": "CVE-2025-33150",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-33150"
    },
    {
      "name": "CVE-2025-47273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47273"
    },
    {
      "name": "CVE-2024-6345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6345"
    },
    {
      "name": "CVE-2024-57699",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57699"
    },
    {
      "name": "CVE-2024-47619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47619"
    }
  ],
  "initial_release_date": "2025-11-14T00:00:00",
  "last_revision_date": "2025-11-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-1013",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250959",
      "url": "https://www.ibm.com/support/pages/node/7250959"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7249983",
      "url": "https://www.ibm.com/support/pages/node/7249983"
    },
    {
      "published_at": "2025-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250785",
      "url": "https://www.ibm.com/support/pages/node/7250785"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7249992",
      "url": "https://www.ibm.com/support/pages/node/7249992"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7249994",
      "url": "https://www.ibm.com/support/pages/node/7249994"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250921",
      "url": "https://www.ibm.com/support/pages/node/7250921"
    },
    {
      "published_at": "2025-11-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250486",
      "url": "https://www.ibm.com/support/pages/node/7250486"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250907",
      "url": "https://www.ibm.com/support/pages/node/7250907"
    },
    {
      "published_at": "2025-11-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250395",
      "url": "https://www.ibm.com/support/pages/node/7250395"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250956",
      "url": "https://www.ibm.com/support/pages/node/7250956"
    },
    {
      "published_at": "2025-11-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250763",
      "url": "https://www.ibm.com/support/pages/node/7250763"
    },
    {
      "published_at": "2025-11-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250474",
      "url": "https://www.ibm.com/support/pages/node/7250474"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250971",
      "url": "https://www.ibm.com/support/pages/node/7250971"
    },
    {
      "published_at": "2025-11-12",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7250926",
      "url": "https://www.ibm.com/support/pages/node/7250926"
    },
    {
      "published_at": "2025-11-13",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7251173",
      "url": "https://www.ibm.com/support/pages/node/7251173"
    }
  ]
}

CERTFR-2025-AVI-0651

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
IBM Informix Dynamic Server Informix Dynamic Server versions 14.10.x sans le dernier correctif de sécurité
IBM Db2 Db2 versions 12.1.x antérieures à 12.1.2
IBM QRadar QRadar Investigation Assistant versions 1.x antérieures à 1.1.0
IBM Informix Dynamic Server Informix Dynamic Server versions 12.10.x sans le dernier correctif de sécurité
IBM Cognos Analytics Cognos Analytics 12.1.x antérieures à 12.1.0 IF2
IBM WebSphere WebSphere Hybrid Edition version 5.1 sans les correctifs de sécurité PH67120 et PH67183
IBM Db2 Db2 versions 11.1.x antérieures à 11.1.4 FP7 sans le dernier correctif de sécurité temporaire
IBM Tivoli Tivoli System Automation Application Manager 4.1 sans le correctif de sécurité pour WebSphere Application Server 9.0
IBM Cognos Analytics Cognos Analytics 11.2.x antérieures à 11.2.4 FP6
IBM Db2 Db2 versions 11.5.x antérieures à 11.5.9 sans le dernier correctif de sécurité temporaire
IBM Cognos Analytics Cognos Analytics 12.0.x antérieures à 12.0.4 FP1
IBM Db2 Db2 versions 10.5.x antérieures à 10.5 FP11 sans le dernier correctif de sécurité temporaire
References
Bulletin de sécurité IBM 7240941 2025-07-29 vendor-advisory
Bulletin de sécurité IBM 7240649 2025-07-25 vendor-advisory
Bulletin de sécurité IBM 7240898 2025-07-28 vendor-advisory
Bulletin de sécurité IBM 7240775 2025-07-28 vendor-advisory
Bulletin de sécurité IBM 7240798 2025-07-28 vendor-advisory
Bulletin de sécurité IBM 7239462 2025-07-25 vendor-advisory
Bulletin de sécurité IBM 7240952 2025-07-29 vendor-advisory
Bulletin de sécurité IBM 7240940 2025-07-29 vendor-advisory
Bulletin de sécurité IBM 7240946 2025-07-29 vendor-advisory
Bulletin de sécurité IBM 7240777 2025-07-28 vendor-advisory
Bulletin de sécurité IBM 7240899 2025-07-28 vendor-advisory
Bulletin de sécurité IBM 7240977 2025-07-29 vendor-advisory

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Informix Dynamic Server versions 14.10.x sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 12.1.x ant\u00e9rieures \u00e0 12.1.2",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar Investigation Assistant versions 1.x ant\u00e9rieures \u00e0 1.1.0",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 12.10.x sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics\t12.1.x ant\u00e9rieures \u00e0 12.1.0 IF2",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Hybrid Edition version 5.1 sans les correctifs de s\u00e9curit\u00e9 PH67120 et PH67183",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.1.x ant\u00e9rieures \u00e0 11.1.4 FP7 sans le dernier correctif de s\u00e9curit\u00e9 temporaire",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli System Automation Application Manager 4.1 sans le correctif de s\u00e9curit\u00e9 pour WebSphere Application Server 9.0",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics\t11.2.x ant\u00e9rieures \u00e0 11.2.4 FP6",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 11.5.x ant\u00e9rieures \u00e0 11.5.9 sans le dernier correctif de s\u00e9curit\u00e9 temporaire",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics\t12.0.x ant\u00e9rieures \u00e0 12.0.4 FP1",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions 10.5.x ant\u00e9rieures \u00e0 10.5 FP11 sans le dernier correctif de s\u00e9curit\u00e9 temporaire",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-0755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0755"
    },
    {
      "name": "CVE-2024-21144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21144"
    },
    {
      "name": "CVE-2024-49342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49342"
    },
    {
      "name": "CVE-2024-45492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45492"
    },
    {
      "name": "CVE-2025-30472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30472"
    },
    {
      "name": "CVE-2025-24970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
    },
    {
      "name": "CVE-2025-33092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-33092"
    },
    {
      "name": "CVE-2023-22081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
    },
    {
      "name": "CVE-2025-36097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36097"
    },
    {
      "name": "CVE-2024-45490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45490"
    },
    {
      "name": "CVE-2024-45491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45491"
    },
    {
      "name": "CVE-2025-50182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-50182"
    },
    {
      "name": "CVE-2025-50181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-50181"
    },
    {
      "name": "CVE-2023-22067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
    },
    {
      "name": "CVE-2024-21147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21147"
    },
    {
      "name": "CVE-2024-21140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21140"
    },
    {
      "name": "CVE-2024-49343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49343"
    },
    {
      "name": "CVE-2025-47278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47278"
    },
    {
      "name": "CVE-2024-21138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21138"
    },
    {
      "name": "CVE-2024-47081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47081"
    },
    {
      "name": "CVE-2023-5676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
    },
    {
      "name": "CVE-2024-21145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21145"
    },
    {
      "name": "CVE-2024-50602",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50602"
    },
    {
      "name": "CVE-2025-5889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5889"
    },
    {
      "name": "CVE-2025-27607",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27607"
    },
    {
      "name": "CVE-2025-48387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48387"
    },
    {
      "name": "CVE-2024-21131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21131"
    },
    {
      "name": "CVE-2024-27267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27267"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0651",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2025-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240941",
      "url": "https://www.ibm.com/support/pages/node/7240941"
    },
    {
      "published_at": "2025-07-25",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240649",
      "url": "https://www.ibm.com/support/pages/node/7240649"
    },
    {
      "published_at": "2025-07-28",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240898",
      "url": "https://www.ibm.com/support/pages/node/7240898"
    },
    {
      "published_at": "2025-07-28",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240775",
      "url": "https://www.ibm.com/support/pages/node/7240775"
    },
    {
      "published_at": "2025-07-28",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240798",
      "url": "https://www.ibm.com/support/pages/node/7240798"
    },
    {
      "published_at": "2025-07-25",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239462",
      "url": "https://www.ibm.com/support/pages/node/7239462"
    },
    {
      "published_at": "2025-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240952",
      "url": "https://www.ibm.com/support/pages/node/7240952"
    },
    {
      "published_at": "2025-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240940",
      "url": "https://www.ibm.com/support/pages/node/7240940"
    },
    {
      "published_at": "2025-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240946",
      "url": "https://www.ibm.com/support/pages/node/7240946"
    },
    {
      "published_at": "2025-07-28",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240777",
      "url": "https://www.ibm.com/support/pages/node/7240777"
    },
    {
      "published_at": "2025-07-28",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240899",
      "url": "https://www.ibm.com/support/pages/node/7240899"
    },
    {
      "published_at": "2025-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7240977",
      "url": "https://www.ibm.com/support/pages/node/7240977"
    }
  ]
}

CERTFR-2025-AVI-0590

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
IBM Sterling Sterling Connect:Direct Web Services versions 6.3.0.x antérieures à 6.3.0.14
IBM Tivoli Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans le dernier correctif de sécurité
IBM Sterling Sterling External Authentication Server versions 6.1.0.x antérieures à 6.1.0.2 iFix 03
IBM Db2 DB2 Data Management Console on CPD versions 4.7.1 antérieures à 4.7.2
IBM Db2 DB2 Data Management Console versions 3.1.11 à 3.1.13.x antérieures à 3.1.13.1
IBM QRadar QRadar SIEM versions 7.5.0 sans le dernier correctif de sécurité
IBM Tivoli Tivoli Composite Application Manager for Application Diagnostics version 7.1.0 sans le dernier correctif de sécurité
IBM Sterling Sterling Connect:Direct Web Services versions 6.4.0.x antérieures à 6.4.0.3
IBM WebSphere WebSphere Hybrid Edition versions 5.1 sans le correctif de sécurité PH66674
IBM Sterling Sterling Connect:Direct Web Services versions 6.2.0.x antérieures à 6.2.0.28
References
Bulletin de sécurité IBM 7239103 2025-07-08 vendor-advisory
Bulletin de sécurité IBM 7239009 2025-07-07 vendor-advisory
Bulletin de sécurité IBM 7239143 2025-07-08 vendor-advisory
Bulletin de sécurité IBM 7239362 2025-07-09 vendor-advisory
Bulletin de sécurité IBM 7239476 2025-07-11 vendor-advisory
Bulletin de sécurité IBM 7239247 2025-07-09 vendor-advisory
Bulletin de sécurité IBM 7239178 2025-07-08 vendor-advisory
Bulletin de sécurité IBM 7239475 2025-07-11 vendor-advisory

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sterling Connect:Direct Web Services versions 6.3.0.x ant\u00e9rieures \u00e0 6.3.0.14",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling External Authentication Server versions 6.1.0.x ant\u00e9rieures \u00e0 6.1.0.2 iFix 03",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "DB2 Data Management Console on CPD versions 4.7.1 ant\u00e9rieures \u00e0 4.7.2",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "DB2 Data Management Console versions 3.1.11 \u00e0 3.1.13.x ant\u00e9rieures \u00e0 3.1.13.1",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar SIEM versions 7.5.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Composite Application Manager for Application Diagnostics version 7.1.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct Web Services versions 6.4.0.x ant\u00e9rieures \u00e0 6.4.0.3",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Hybrid Edition versions 5.1 sans le correctif de s\u00e9curit\u00e9 PH66674",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct Web Services versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.28",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-4447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4447"
    },
    {
      "name": "CVE-2022-29162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29162"
    },
    {
      "name": "CVE-2020-13956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13956"
    },
    {
      "name": "CVE-2021-43816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43816"
    },
    {
      "name": "CVE-2023-21830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-21830"
    },
    {
      "name": "CVE-2023-27561",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27561"
    },
    {
      "name": "CVE-2022-31030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31030"
    },
    {
      "name": "CVE-2021-35516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35516"
    },
    {
      "name": "CVE-2022-32149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32149"
    },
    {
      "name": "CVE-2019-19921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19921"
    },
    {
      "name": "CVE-2021-35517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35517"
    },
    {
      "name": "CVE-2021-36090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36090"
    },
    {
      "name": "CVE-2021-43784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43784"
    },
    {
      "name": "CVE-2021-32760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-32760"
    },
    {
      "name": "CVE-2023-25173",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25173"
    },
    {
      "name": "CVE-2024-45296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
    },
    {
      "name": "CVE-2025-21587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21587"
    },
    {
      "name": "CVE-2023-25809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25809"
    },
    {
      "name": "CVE-2024-25710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25710"
    },
    {
      "name": "CVE-2023-25153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25153"
    },
    {
      "name": "CVE-2023-33850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
    },
    {
      "name": "CVE-2025-30698",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30698"
    },
    {
      "name": "CVE-2022-41721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41721"
    },
    {
      "name": "CVE-2023-28642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28642"
    },
    {
      "name": "CVE-2022-23471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23471"
    },
    {
      "name": "CVE-2025-2900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2900"
    },
    {
      "name": "CVE-2022-41723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
    },
    {
      "name": "CVE-2021-35515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35515"
    },
    {
      "name": "CVE-2022-23648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23648"
    },
    {
      "name": "CVE-2021-41103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41103"
    },
    {
      "name": "CVE-2025-36038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36038"
    },
    {
      "name": "CVE-2022-27664",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27664"
    },
    {
      "name": "CVE-2016-1000027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1000027"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0590",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2025-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239103",
      "url": "https://www.ibm.com/support/pages/node/7239103"
    },
    {
      "published_at": "2025-07-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239009",
      "url": "https://www.ibm.com/support/pages/node/7239009"
    },
    {
      "published_at": "2025-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239143",
      "url": "https://www.ibm.com/support/pages/node/7239143"
    },
    {
      "published_at": "2025-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239362",
      "url": "https://www.ibm.com/support/pages/node/7239362"
    },
    {
      "published_at": "2025-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239476",
      "url": "https://www.ibm.com/support/pages/node/7239476"
    },
    {
      "published_at": "2025-07-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239247",
      "url": "https://www.ibm.com/support/pages/node/7239247"
    },
    {
      "published_at": "2025-07-08",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239178",
      "url": "https://www.ibm.com/support/pages/node/7239178"
    },
    {
      "published_at": "2025-07-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7239475",
      "url": "https://www.ibm.com/support/pages/node/7239475"
    }
  ]
}

CERTFR-2024-AVI-0547

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
IBM Tivoli Tivoli Netcool Impact versions 7.1.0.x antérieures à 7.1.0.34
IBM Cognos Transformer Cognos Transformer version 11.2.4 sans le correctif FP4
IBM Tivoli Tivoli Application Dependency Discovery Manager versions 7.3.0.0 à 7.3.0.11 sans le correctif de sécurité efix_WLP_PSIRT_24006_FP11230825.zip
IBM Cognos Transformer Cognos Transformer versions 12.0.x antérieures à 12.0.3
References
Bulletin de sécurité IBM 7159323 2024-07-01 vendor-advisory
Bulletin de sécurité IBM 7159530 2024-07-02 vendor-advisory
Bulletin de sécurité IBM 7159308 2024-07-01 vendor-advisory
Bulletin de sécurité IBM 7159172 2024-09-26 vendor-advisory

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tivoli Netcool Impact versions 7.1.0.x ant\u00e9rieures \u00e0 7.1.0.34",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Transformer version 11.2.4 sans le correctif FP4",
      "product": {
        "name": "Cognos Transformer",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Application Dependency Discovery Manager versions 7.3.0.0 \u00e0 7.3.0.11 sans le correctif de s\u00e9curit\u00e9 efix_WLP_PSIRT_24006_FP11230825.zip",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Transformer versions 12.0.x ant\u00e9rieures \u00e0 12.0.3",
      "product": {
        "name": "Cognos Transformer",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-20919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
    },
    {
      "name": "CVE-2024-20926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
    },
    {
      "name": "CVE-2024-20921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
    },
    {
      "name": "CVE-2023-22081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
    },
    {
      "name": "CVE-2024-25026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25026"
    },
    {
      "name": "CVE-2023-22067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
    },
    {
      "name": "CVE-2023-51775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
    },
    {
      "name": "CVE-2024-27268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27268"
    },
    {
      "name": "CVE-2023-33850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
    },
    {
      "name": "CVE-2023-5676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
    },
    {
      "name": "CVE-2024-20918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
    },
    {
      "name": "CVE-2024-20945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
    },
    {
      "name": "CVE-2024-22354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22354"
    },
    {
      "name": "CVE-2024-20952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0547",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7159323",
      "url": "https://www.ibm.com/support/pages/node/7159323"
    },
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7159530",
      "url": "https://www.ibm.com/support/pages/node/7159530"
    },
    {
      "published_at": "2024-07-01",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7159308",
      "url": "https://www.ibm.com/support/pages/node/7159308"
    },
    {
      "published_at": "2024-09-26",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7159172",
      "url": "https://www.ibm.com/support/pages/node/7159172"
    }
  ]
}

CERTFR-2024-AVI-0279

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM N/A Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.2.x antérieures à 6.1.2.9
IBM Sterling Sterling Connect Direct pour UNIX versions 6.1.x antérieures à 6.1.0.4.iFix106
IBM WebSphere WebSphere Application Server Liberty versions postérieures à 21.0.0.2 et antérieures à 24.0.0.4
IBM Sterling Sterling Connect Direct pour UNIX versions 6.3.x antérieures à 6.3.0.2.iFix021
IBM Sterling Sterling Connect Direct pour UNIX versions 6.0.x antérieures à 6.0.0.2.iFix164
IBM Tivoli Tivoli Netcool Impact versions 7.1.0.x antérieures à 7.1.0.33
IBM N/A Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.9.x antérieures à 6.1.9.2
IBM WebSphere WebSphere Application Server versions 9.x antérieures à 9.0.5.19
IBM WebSphere WebSphere Application Server versions postérieures à 8.5.5.2 antérieures à 8.5.5.26
IBM Sterling Sterling Connect Direct pour UNIX versions 6.2.x antérieures à 6.2.0.7.iFix015
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.2.x ant\u00e9rieures \u00e0 6.1.2.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect Direct pour UNIX versions 6.1.x ant\u00e9rieures \u00e0 6.1.0.4.iFix106",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server Liberty versions post\u00e9rieures \u00e0 21.0.0.2 et ant\u00e9rieures \u00e0 24.0.0.4",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect Direct pour UNIX versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.2.iFix021",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect Direct pour UNIX versions 6.0.x ant\u00e9rieures \u00e0 6.0.0.2.iFix164",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Netcool Impact versions 7.1.0.x ant\u00e9rieures \u00e0 7.1.0.33",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.9.x ant\u00e9rieures \u00e0 6.1.9.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server versions 9.x ant\u00e9rieures \u00e0 9.0.5.19",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server versions post\u00e9rieures \u00e0 8.5.5.2 ant\u00e9rieures \u00e0 8.5.5.26",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect Direct pour UNIX versions 6.2.x ant\u00e9rieures \u00e0 6.2.0.7.iFix015",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-20919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
    },
    {
      "name": "CVE-2024-20926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
    },
    {
      "name": "CVE-2024-20921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-51775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
    },
    {
      "name": "CVE-2023-52428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52428"
    },
    {
      "name": "CVE-2023-33850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
    },
    {
      "name": "CVE-2024-20918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
    },
    {
      "name": "CVE-2023-46158",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46158"
    },
    {
      "name": "CVE-2024-20945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
    },
    {
      "name": "CVE-2024-20952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0279",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7145606 du 01 avril 2024",
      "url": "https://www.ibm.com/support/pages/node/7145606"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7145538 du 29 mars 2024",
      "url": "https://www.ibm.com/support/pages/node/7145538"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7145743 du 02 avril 2024",
      "url": "https://www.ibm.com/support/pages/node/7145743"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7145942 du 04 avril 2024",
      "url": "https://www.ibm.com/support/pages/node/7145942"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7145926 du 04 avril 2024",
      "url": "https://www.ibm.com/support/pages/node/7145926"
    }
  ]
}

CERTFR-2023-AVI-0798

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM MaaS360 Module VPN MaaS360 versions antérieures à 3.000.200
IBM QRadar QRadar Data Synchronization App versions 1.0.x à 3.1.1 antérieures à 3.1.2
IBM Tivoli Tivoli Netcool Impact versions 7.1.x antérieures à 7.1.0.31
IBM MaaS360 MaaS360 Mobile Enterprise Gateway versions antérieures à 3.000.200
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Module VPN MaaS360 versions ant\u00e9rieures \u00e0 3.000.200",
      "product": {
        "name": "MaaS360",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar Data Synchronization App versions 1.0.x \u00e0 3.1.1 ant\u00e9rieures \u00e0 3.1.2",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Tivoli Netcool Impact versions 7.1.x ant\u00e9rieures \u00e0 7.1.0.31",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "MaaS360 Mobile Enterprise Gateway versions ant\u00e9rieures \u00e0 3.000.200",
      "product": {
        "name": "MaaS360",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-28867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28867"
    },
    {
      "name": "CVE-2022-46175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175"
    },
    {
      "name": "CVE-2023-26049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049"
    },
    {
      "name": "CVE-2023-2650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
    },
    {
      "name": "CVE-2023-20863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20863"
    },
    {
      "name": "CVE-2022-25881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25881"
    },
    {
      "name": "CVE-2023-24998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
    },
    {
      "name": "CVE-2023-26048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0798",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-10-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es, une ex\u00e9cution de code arbitraire \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7043471 du 02 octobre 2023",
      "url": "https://www.ibm.com/support/pages/node/7043471"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7042785 du 29 septembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7042785"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7043103 du 29 septembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7043103"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7040883 du 29 septembre 2023",
      "url": "https://www.ibm.com/support/pages/node/7040883"
    }
  ]
}

CERTFR-2022-AVI-997

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans IBM Tivoli. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Tivoli IBM Tivoli Monitoring versions antérieures à 6.3.0.7 Plus Service Pack 5
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Monitoring versions ant\u00e9rieures \u00e0 6.3.0.7 Plus Service Pack 5",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-2163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-2163"
    },
    {
      "name": "CVE-2022-22473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22473"
    },
    {
      "name": "CVE-2022-22477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22477"
    },
    {
      "name": "CVE-2022-34336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34336"
    },
    {
      "name": "CVE-2022-40674",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40674"
    },
    {
      "name": "CVE-2022-34165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34165"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-997",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-11-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Tivoli.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des\ndonn\u00e9es et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6837645 du 07 novembre 2022",
      "url": "https://www.ibm.com/support/pages/node/6837645"
    }
  ]
}

CERTFR-2022-AVI-850

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Tivoli IBM Tivoli Netcool Impact versions 7.1.x antérieures à 7.1.25
IBM Spectrum IBM Spectrum Protect Plus versions 10.1.x antérieures à 10.1.12
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Netcool Impact versions 7.1.x ant\u00e9rieures \u00e0 7.1.25",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Spectrum Protect Plus versions 10.1.x ant\u00e9rieures \u00e0 10.1.12",
      "product": {
        "name": "Spectrum",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-26520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26520"
    },
    {
      "name": "CVE-2022-1292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
    },
    {
      "name": "CVE-2022-2068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2068"
    },
    {
      "name": "CVE-2021-4160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4160"
    },
    {
      "name": "CVE-2022-21724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21724"
    },
    {
      "name": "CVE-2022-0778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-850",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-09-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6622079 du 21 septembre 2022",
      "url": "https://www.ibm.com/support/pages/node/6622079"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6602599 du 16 juin 2022",
      "url": "https://www.ibm.com/support/pages/node/6602599"
    }
  ]
}

CERTFR-2022-AVI-647

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans IBM Tivoli Netcool/OMNIbus. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Tivoli Tivoli Netcool/OMNIbus WebGUI versions antérieures à 8.1.0 Fix Pack 27
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tivoli Netcool/OMNIbus WebGUI versions ant\u00e9rieures \u00e0 8.1.0 Fix Pack 27",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-3918",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-647",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans IBM Tivoli Netcool/OMNIbus. Elle\npermet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0\ndistance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans IBM Tivoli Netcool/OMNIbus",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6603645 du 13 juillet 2022",
      "url": "https://www.ibm.com/support/pages/node/6603645"
    }
  ]
}

CERTFR-2022-AVI-349

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans IBM Tivoli Network Manager. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Tivoli Tivoli Network Manager versions 4.2.x antérieures à 4.2.0.14
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tivoli Network Manager versions 4.2.x ant\u00e9rieures \u00e0 4.2.0.14",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-40865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40865"
    },
    {
      "name": "CVE-2021-38294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38294"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-349",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-04-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Tivoli Network\nManager. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Network Manager",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6572281 du 14 avril 2022",
      "url": "https://www.ibm.com/support/pages/node/6572281"
    }
  ]
}

CERTFR-2021-AVI-474

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Contournement provisoire

None
Impacted products
Vendor Product Description
IBM Tivoli IBM Tivoli Netcool/OMNIbus Integration - Transport Module Common Integration Library versions antérieures à common-transportmodule-29_0
IBM QRadar SIEM IBM QRadar SIEM versions 7.4 sans le dernier correctif
IBM QRadar SIEM IBM QRadar SIEM versions 7.3 sans le dernier correctif
IBM Tivoli IBM Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services versions antérieures à nco-p-ews-3_0
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Netcool/OMNIbus Integration - Transport Module Common Integration Library versions ant\u00e9rieures \u00e0 common-transportmodule-29_0",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM QRadar SIEM versions 7.4 sans le dernier correctif",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM QRadar SIEM versions 7.3 sans le dernier correctif",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services versions ant\u00e9rieures \u00e0 nco-p-ews-3_0",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\n## Contournement provisoire\n",
  "cves": [
    {
      "name": "CVE-2021-29425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29425"
    },
    {
      "name": "CVE-2021-21409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21409"
    },
    {
      "name": "CVE-2020-36282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-36282"
    },
    {
      "name": "CVE-2021-21295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21295"
    },
    {
      "name": "CVE-2021-21290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21290"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-474",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6464851 du 17 juin 2021",
      "url": "https://www.ibm.com/support/pages/node/6464851"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6462245 du 17 juin 2021",
      "url": "https://www.ibm.com/support/pages/node/6462245"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6462247 du 17 juin 2021",
      "url": "https://www.ibm.com/support/pages/node/6462247"
    }
  ]
}

CERTFR-2021-AVI-417

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Spectrum IBM Spectrum Scale versions 5.1.x antérieures à 5.1.1.0
IBM Tivoli IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.0 à 7.3.0.8
IBM Spectrum IBM Spectrum Scale versions 5.0.x antérieures à 5.0.5.7
IBM N/A Content Collector for Email versions 4.0.x antérieures à 4.0.1
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Spectrum Scale versions 5.1.x ant\u00e9rieures \u00e0 5.1.1.0",
      "product": {
        "name": "Spectrum",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.0 \u00e0 7.3.0.8",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Spectrum Scale versions 5.0.x ant\u00e9rieures \u00e0 5.0.5.7",
      "product": {
        "name": "Spectrum",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Content Collector for Email versions 4.0.x ant\u00e9rieures \u00e0 4.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22696"
    },
    {
      "name": "CVE-2021-29740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29740"
    },
    {
      "name": "CVE-2021-20454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20454"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-417",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6457629 du 31 mai 2021",
      "url": "https://www.ibm.com/support/pages/node/6457629"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6457727 du 01 juin 2021",
      "url": "https://www.ibm.com/support/pages/node/6457727"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6457777 du 01 juin 2021",
      "url": "https://www.ibm.com/support/pages/node/6457777"
    }
  ]
}

CERTFR-2021-AVI-254

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Tivoli IBM Tivoli Composite Application Manager (ITCAM) for Transactions versions 7.4.0.x antérieures à 7.4.0.1 avec le correctif IF0052
IBM N/A InfoSphere Information Server on Cloud versions antérieures à 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1
IBM Tivoli IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.x dans le dernier correctif
IBM N/A InfoSphere Information Server versions antérieures à 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Composite Application Manager (ITCAM) for Transactions versions 7.4.0.x ant\u00e9rieures \u00e0 7.4.0.1 avec le correctif IF0052",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "InfoSphere Information Server on Cloud versions ant\u00e9rieures \u00e0 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.x dans le dernier correctif",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "InfoSphere Information Server versions ant\u00e9rieures \u00e0 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-2654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2654"
    },
    {
      "name": "CVE-2020-2803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2803"
    },
    {
      "name": "CVE-2020-14803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14803"
    },
    {
      "name": "CVE-2019-2978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2978"
    },
    {
      "name": "CVE-2019-2945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2945"
    },
    {
      "name": "CVE-2019-2958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2958"
    },
    {
      "name": "CVE-2020-2773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2773"
    },
    {
      "name": "CVE-2020-2805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2805"
    },
    {
      "name": "CVE-2019-2987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2987"
    },
    {
      "name": "CVE-2020-2830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2830"
    },
    {
      "name": "CVE-2020-2781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2781"
    },
    {
      "name": "CVE-2019-2988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2988"
    },
    {
      "name": "CVE-2020-2601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2601"
    },
    {
      "name": "CVE-2020-2593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2593"
    },
    {
      "name": "CVE-2020-27221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27221"
    },
    {
      "name": "CVE-2020-2754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2754"
    },
    {
      "name": "CVE-2021-25329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25329"
    },
    {
      "name": "CVE-2020-2778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2778"
    },
    {
      "name": "CVE-2019-2962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2962"
    },
    {
      "name": "CVE-2019-2981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2981"
    },
    {
      "name": "CVE-2019-2989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2989"
    },
    {
      "name": "CVE-2020-2755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2755"
    },
    {
      "name": "CVE-2019-2933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2933"
    },
    {
      "name": "CVE-2020-2583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2583"
    },
    {
      "name": "CVE-2019-2964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2964"
    },
    {
      "name": "CVE-2021-25122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25122"
    },
    {
      "name": "CVE-2019-2999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2999"
    },
    {
      "name": "CVE-2020-2604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2604"
    },
    {
      "name": "CVE-2019-2949",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2949"
    },
    {
      "name": "CVE-2020-2800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2800"
    },
    {
      "name": "CVE-2020-2816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2816"
    },
    {
      "name": "CVE-2020-2757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2757"
    },
    {
      "name": "CVE-2020-2655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2655"
    },
    {
      "name": "CVE-2019-2894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2894"
    },
    {
      "name": "CVE-2020-2590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2590"
    },
    {
      "name": "CVE-2020-2767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2767"
    },
    {
      "name": "CVE-2019-2992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2992"
    },
    {
      "name": "CVE-2019-2973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2973"
    },
    {
      "name": "CVE-2020-2756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2756"
    },
    {
      "name": "CVE-2019-2977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2977"
    },
    {
      "name": "CVE-2019-2983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2983"
    },
    {
      "name": "CVE-2019-2975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-2975"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-254",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-04-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6436421 du 01 avril 2021",
      "url": "https://www.ibm.com/support/pages/node/6436421"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6440909 du 07 avril 2021",
      "url": "https://www.ibm.com/support/pages/node/6440909"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6442857 du 13 avril 2021",
      "url": "https://www.ibm.com/support/pages/node/6442857"
    }
  ]
}

CERTFR-2020-AVI-677

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM Tivoli Monitoring IBM Tivoli Monitoring version 6.3.0
IBM Tivoli IBM Tivoli System Automation Application Manager 4.1
IBM Tivoli IBM Tivoli System Automation pour Multiplatforms 4.1
IBM N/A Enterprise Content Management System Monitor version 5.5
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Tivoli Monitoring version 6.3.0",
      "product": {
        "name": "Tivoli Monitoring",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli System Automation Application Manager 4.1",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli System Automation pour Multiplatforms 4.1",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Enterprise Content Management System Monitor version 5.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-4449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4449"
    },
    {
      "name": "CVE-2020-14621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14621"
    },
    {
      "name": "CVE-2019-17566",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-17566"
    },
    {
      "name": "CVE-2020-14579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14579"
    },
    {
      "name": "CVE-2020-14593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14593"
    },
    {
      "name": "CVE-2020-14578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14578"
    },
    {
      "name": "CVE-2020-14556",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14556"
    },
    {
      "name": "CVE-2020-4578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4578"
    },
    {
      "name": "CVE-2019-4473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-4473"
    },
    {
      "name": "CVE-2019-11771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11771"
    },
    {
      "name": "CVE-2020-4329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4329"
    },
    {
      "name": "CVE-2020-4362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4362"
    },
    {
      "name": "CVE-2019-4720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-4720"
    },
    {
      "name": "CVE-2020-4534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4534"
    },
    {
      "name": "CVE-2020-4464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4464"
    },
    {
      "name": "CVE-2020-4365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4365"
    },
    {
      "name": "CVE-2020-14583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14583"
    },
    {
      "name": "CVE-2020-4643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4643"
    },
    {
      "name": "CVE-2020-4276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4276"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-677",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6351367 du 21 octobre 2020",
      "url": "https://www.ibm.com/support/pages/node/6351367"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6351365 du 21 octobre 2020",
      "url": "https://www.ibm.com/support/pages/node/6351365"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6351391 du 22 octobre 2020",
      "url": "https://www.ibm.com/support/pages/node/6351391"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6351443 du 22 octobre 2020",
      "url": "https://www.ibm.com/support/pages/node/6351443"
    }
  ]
}

CERTFR-2019-AVI-018

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
IBM N/A IBM Security Identity Manager versions 7.0.1 à 7.0.1.10
IBM N/A IBM Security Identity Manager versions 6.0.0 à 6.0.0.20
IBM Spectrum IBM Spectrum Control versions 5.2.8 à 5.2.13
IBM Tivoli IBM Tivoli Storage Productivity Center versions 5.2.0 à 5.2.7.1
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Security Identity Manager versions 7.0.1 \u00e0 7.0.1.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Security Identity Manager versions 6.0.0 \u00e0 6.0.0.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Spectrum Control versions 5.2.8 \u00e0 5.2.13",
      "product": {
        "name": "Spectrum",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Tivoli Storage Productivity Center versions 5.2.0 \u00e0 5.2.7.1",
      "product": {
        "name": "Tivoli",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-1956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1956"
    },
    {
      "name": "CVE-2018-1904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1904"
    },
    {
      "name": "CVE-2018-1967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1967"
    },
    {
      "name": "CVE-2017-1788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-1788"
    },
    {
      "name": "CVE-2018-1969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1969"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-018",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-01-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 10794615 du 11 janvier 2019",
      "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10794615"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 10794617 du 11 janvier 2019",
      "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10794617"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 10793725 du 11 janvier 2019",
      "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10793725"
    }
  ]
}