IBM Sterling Secure Proxy Security Bulletin: Multiple Vulnerabilities (CVE-2024-41784, XSS, DoS)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Name: IBM Sterling Secure Proxy is vulnerable to multiple issues. 2. Affected Product: IBM Sterling Secure Proxy. 3. Affected Versions: - 6.0.0.0 - 6.0.1.0 - 6.0.2.0 - 6.0.3.0 - 6.1.0.0 4. Vulnerability Description: - Multiple vulnerabilities affect IBM Sterling Secure Proxy and have been resolved in the latest versions and iFixes. - The vulnerabilities include: - CVE-2024-30172: Denial of service vulnerability in Bouncy Castle Crypto Package for Java. - CVE-2024-21094: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-21085: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-21011: Undocumented vulnerability in the VM component of Java SE. - CVE-2023-38264: Denial of service vulnerability in the Object Request Broker (ORB) of IBM SDK. - CVE-2024-21147: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-21145: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-21140: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-21138: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-21131: Undocumented vulnerability in the VM component of Java SE. - CVE-2024-27267: Denial of service vulnerability in the Object Request Broker (ORB) of IBM SDK. - CVE-2024-22201: Denial of service vulnerability in Eclipse Jetty. - CVE-2024-41784: Directory traversal vulnerability in IBM Sterling Secure Proxy. - CVE-2021-40690: Unauthorized access vulnerability in Apache Santuario XML Security. - CVE-2024-3933: Buffer overflow vulnerability in Eclipse Openj9. - CVE-2023-29262: Cross-site scripting vulnerability in IBM Sterling Secure Proxy. 5. Remediation: - For affected versions, fixes are available in versions 6.0.3.1 and 6.1.0.1. 6. Reference Links: - Complete CVSS v3 Guide - On-line Calculator v3 - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog - Ernst&Young Internal Penetration Test This information helps users understand the affected products, versions, and specific vulnerabilities, as well as how to remediate them by updating to the latest versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Sterling Secure Proxy Security Bulletin: Multiple Vulnerabilities (CVE-2024-41784, XSS, DoS)