/
← Voltar ao feed
high exploit público

CERT-FR: Multiple vulnerabilities in IBM products including WebSphere, QRadar SIEM, Db2, Sterling and AIX

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 21:00 · coletado há 3 dias

CERT-FR advisory CERTFR-2026-AVI-1336, published 16 October 2026, reports multiple vulnerabilities across IBM products. Per the advisory, exploitation could allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass, SSRF, XSS, CSRF, and data confidentiality and integrity compromise. Affected products include AIX, Db2, QRadar SIEM, Sterling products and WebSphere Application Server. The advisory is based on about 30 IBM security bulletins dated 8-15 October 2026. It gives no exploitation status, IOCs or attribution. The CVE list is long and mixes old CVEs (e.g. CVE-2021-44228) with 2026 CVEs, and the source text is truncated.

5 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2021-44228, CVE-2022-35583, CVE-2016-5725. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-51183 ↗ · remoto · java · pub. 01/04/2023 não verificado

    AD Manager Plus 7122 - Remote Code Execution (RCE)

    This entry describes Log4Shell (CVE-2021-44228) in ManageEngine ADManager Plus builds before 7122, reached through a request parameter on the product's search function in its web interface. The write-up needs only network access to the login page, with no valid credentials, and an unpatched version that still logs attacker-controlled input with a vulnerable Log4j. The authors first confirmed it with an out-of-band DNS callback, then claim full remote code execution on another target after evading a firewall and antivirus, but they publish no working exploit code. It is really a short research narrative and detection hint, not a ready exploit. Defenders should upgrade past 7122 and watch for JNDI lookup strings in web logs.

    CVE-2021-44228 · autor: Chan Nyein Wai · explicação gerada por IA
  2. exploit-db.com · EDB-51039 ↗ · aplicação web · asp · pub. 23/03/2023 não verificado

    wkhtmltopdf 0.12.6 - Server Side Request Forgery

    This file describes a Server Side Request Forgery against wkhtmltopdf 0.12.6 (CVE-2022-35583), reached through a web application's HTML-to-PDF conversion feature. The attacker sends a form request to the conversion function with HTML that embeds an iframe pointing to an internal address, so the PDF renderer fetches it and includes the content. It needs network access to the app, a valid anti-forgery token, and an app that passes user-controlled HTML to the tool. It is a short proof of concept, unverified, with no automation, and it matches the listed CVE.

    CVE-2022-35583 · autor: Momen Eldawakhly · explicação gerada por IA
  3. exploit-db.com · EDB-50592 ↗ · remoto · java · pub. 14/12/2021 não verificado

    Apache Log4j 2 - Remote Code Execution (RCE)

    This script exploits CVE-2021-44228 (Log4Shell) in Apache Log4j 2 versions 2.0-beta9 to 2.14.1, where a logged string with a JNDI lookup makes the application fetch and load remote code. The attacker needs no authentication, only a way to get text into something the target logs, and the target must be able to reach the attacker's server. The tool runs a rogue directory and web server that deliver a class opening a reverse shell, giving remote code execution. It is a working proof of concept, not verified by Exploit-DB.

    CVE-2021-44228 · autor: kozmer · explicação gerada por IA

Detalhes técnicos

  • AIX 7.3.x without the latest security fix.
  • Db2 Developer Extension prior to 1.2.1; Db2 intelligence center prior to 1.1.0; Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data prior to v5.3.1 patch 15.
  • QRadar SIEM 7.5.x prior to 7.5.0 UP16 IF02; 7.6.x prior to 7.6.0.5; Security QRadar Log Management AQL Plugin prior to 1.1.10.
  • Sterling Connect:Direct for UNIX 6.3.x prior to 6.3.0.7.iFix033 and 6.4.x prior to 6.4.0.6.iFix025; Sterling Control Center 6.3.1.0 prior to iFix12 and 6.4.2.0 prior to iFix08; Sterling External Authentication Server 6.1.x prior to 6.1.1.5; Sterling Partner Engagement Manager Essentials and Standard editions (6.2.4.x prior to 6.2.4.6, 6.3.0.x prior to 6.3.0.4).
  • WebSphere Application Server 8.x prior to 8.5.5.31 and 9.x prior to 9.0.5.29; WebSphere Application Server Liberty 17.0.0.3 to 26.0.0.9 without the latest fix, or prior to 26.0.0.11 (planned for Q4 2026).

Remediação

  • Consult the IBM security bulletins referenced in the advisory (e.g. 7291777, 7292010, 7292117, 7292743) and apply the fixed versions or interim fixes.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 15/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple vulnerabilities in IBM products including WebSphere, QRadar SIEM, Db2, Sterling and AIX

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1336, published 16 October 2026, reports multiple vulnerabilities across IBM products. Per the advisory, exploitation could allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass, SSRF, XSS, CSRF, and data confidentiality and integrity compromise. Affected products include AIX, Db2, QRadar SIEM, Sterling products and WebSphere Application Server. The advisory is based on about 30 IBM security bulletins dated 8-15 October 2026. It gives no exploitation status, IOCs or attribution. The CVE list is long and mixes old CVEs (e.g. CVE-2021-44228) with 2026 CVEs, and the source text is truncated.

    Technical Details

    • AIX 7.3.x without the latest security fix.
    • Db2 Developer Extension prior to 1.2.1; Db2 intelligence center prior to 1.1.0; Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data prior to v5.3.1 patch 15.
    • QRadar SIEM 7.5.x prior to 7.5.0 UP16 IF02; 7.6.x prior to 7.6.0.5; Security QRadar Log Management AQL Plugin prior to 1.1.10.
    • Sterling Connect:Direct for UNIX 6.3.x prior to 6.3.0.7.iFix033 and 6.4.x prior to 6.4.0.6.iFix025; Sterling Control Center 6.3.1.0 prior to iFix12 and 6.4.2.0 prior to iFix08; Sterling External Authentication Server 6.1.x prior to 6.1.1.5; Sterling Partner Engagement Manager Essentials and Standard editions (6.2.4.x prior to 6.2.4.6, 6.3.0.x prior to 6.3.0.4).
    • WebSphere Application Server 8.x prior to 8.5.5.31 and 9.x prior to 9.0.5.29; WebSphere Application Server Liberty 17.0.0.3 to 26.0.0.9 without the latest fix, or prior to 26.0.0.11 (planned for Q4 2026).

    Remediation

    • Consult the IBM security bulletins referenced in the advisory (e.g. 7291777, 7292010, 7292117, 7292743) and apply the fixed versions or interim fixes.