Monthly
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOPEN operations that are not properly validated for buffer size. The affected deployments identified in the CPE data are IBM MQ Operator and IBM MQ Advanced Container Images, with the provided feed using wildcard version fields rather than a precise version range. The vendor CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid MQ credentials and authority to open a queue or object; no public exploit was identified at time of analysis, and a vendor patch is available via IBM support advisory node 7292667.
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity.
A race condition was identified through which privilege escalation was possible in certain configurations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOPEN operations that are not properly validated for buffer size. The affected deployments identified in the CPE data are IBM MQ Operator and IBM MQ Advanced Container Images, with the provided feed using wildcard version fields rather than a precise version range. The vendor CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid MQ credentials and authority to open a queue or object; no public exploit was identified at time of analysis, and a vendor patch is available via IBM support advisory node 7292667.
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity.
A race condition was identified through which privilege escalation was possible in certain configurations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.