IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.

The following flaw was found in Jenkins:

Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.

This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.

Mitigation:

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

It was found that a flaw in commons-collection library allowed remote code execution wherever deserialization occurs. While JBoss doesnt expose the JMXInvokerServlet by default, other interfaces where deserialization occur might be vulnerable.

Note: classes directly referenced by this flaw: InvokerTransformer, InstantiateFactory, and InstantiateTransformer

External References:

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ https://access.redhat.com/solutions/2045023

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

IBM Financial Transaction Manager (FTM) 4.x is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.

IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.

IBM Financial Transaction Manager (FTM) could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.

IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.

IBM Financial Transaction Manager (FTM) could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.

IBM Financial Transaction Manager (FTM) 4.x is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.

IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

Last updated 25 August 2025

IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents

IBM Financial Transaction Manager (FTM) could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.

IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.