Multiple vulnerabilities in IBM Netcool Operations Insight



Published: 2022-06-14 | Updated: 2022-08-02
Risk High
Patch available YES
Number of vulnerabilities 20
CVE-ID CVE-2022-21299
CVE-2019-14540
CVE-2021-33503
CVE-2022-21366
CVE-2022-21365
CVE-2022-21360
CVE-2022-21341
CVE-2022-21340
CVE-2022-21305
CVE-2022-21296
CVE-2021-23450
CVE-2022-21294
CVE-2022-21293
CVE-2022-21291
CVE-2022-21283
CVE-2022-21282
CVE-2022-21277
CVE-2022-21248
CVE-2021-4122
CVE-2021-3521
CWE-ID CWE-20
CWE-200
CWE-400
CWE-94
CWE-345
CWE-347
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
Subscribe
Netcool Operations Insight
Server applications / Other server solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 20 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU59727

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21299

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Information disclosure

EUVDB-ID: #VU21135

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-14540

CWE-ID: CWE-200 - Information Exposure

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue in the "com.zaxxer.hikari.HikariConfig". A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Resource exhaustion

EUVDB-ID: #VU54077

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-33503

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in urllib3 when processing URL with multiple "@" characters in the authority component. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Improper input validation

EUVDB-ID: #VU59724

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21366

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the ImageIO component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Improper input validation

EUVDB-ID: #VU59723

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21365

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the ImageIO component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Improper input validation

EUVDB-ID: #VU59722

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21360

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the ImageIO component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Improper input validation

EUVDB-ID: #VU59733

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21341

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Improper input validation

EUVDB-ID: #VU59732

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21340

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Improper input validation

EUVDB-ID: #VU59720

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21305

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) Improper input validation

EUVDB-ID: #VU59726

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21296

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) Code Injection

EUVDB-ID: #VU60834

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-23450

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code via the setObject function.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

12) Improper input validation

EUVDB-ID: #VU59731

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21294

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

13) Improper input validation

EUVDB-ID: #VU59730

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21293

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

14) Improper input validation

EUVDB-ID: #VU59719

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21291

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

15) Improper input validation

EUVDB-ID: #VU59729

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21283

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

16) Improper input validation

EUVDB-ID: #VU59725

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21282

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

17) Improper input validation

EUVDB-ID: #VU59721

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-21277

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the ImageIO component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

18) Improper input validation

EUVDB-ID: #VU59734

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-21248

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

19) Insufficient verification of data authenticity

EUVDB-ID: #VU63770

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-4122

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to improper handling of the LUKS2 reencryption recover. A local attacker with physical access to the medium can send a specially crafted LUKS header and trick cryptsetup into disabling encryption during the recovery of the device.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

20) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU59993

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-3521

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an error in RPM's signature functionality, as RPM does not check the binding signature of subkeys before importing them. A remote attacker with ability to add malicious subkey to a legitimate public key can run malicious code on the system.


Mitigation

Install update from vendor's website.

Vulnerable software versions

Netcool Operations Insight: 1.4 - 1.6


CPE2.3 External links

http://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insight-v1-6-4-contains-fixes-for-multiple-security-vulnerabilities/
http://www.ibm.com/support/pages/node/6594459

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###