Security bulletin: Multiple vulnerabilities in IBM's Netezza WebAdmin 6.0.5, 6.0.8 and 7.0 (CVE-2012-5760, CVE-2012-5761, CVE-2012-5762, CVE-2012-5763, CVE-2012-5940, CVE-2012-5941)

Abstract Multiple vulnerabilities have been identified in the IBM Netezza WebAdmin application. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-5760 DESCRIPTION: Elements that could modify a SQL command are not neutralized correctly. The attack will not produce any visible outcome/output in the...

Security Bulletin: Open redirect and cross-site scripting vulnerabilities in the IBM Data Studio help system (CVE-2012-2159, CVE-2012-2161, CVE-2013-0467)

Abstract The Eclipse components that display the help content in IBM Data Studio version 3.1 and 3.1.1 are vulnerable to redirect and cross-site scripting attacks. Content...

Security Bulletin: GSKit SSL/TLS Record Length vulnerability in Tivoli Directory Server (CVE-2012-2191)

Abstract A vulnerability has been identified in the GSKit component utilized by Tivoli Directory Server TDS. A specifically crafted malformed SSL/TLS data packet can cause the TDS server using GSKit to segmentation fault.. Remediation for the issue consists of updating GSKit 7 to version 7.0.4.41...

Security Bulletin: IBM Tivoli Federated Identity Manager can be affected by a vulnerability in IBM Java Runtime Environment (CVE-2012-5081)

Abstract A vulnerability in the Java Runtime Environment JRE impacts IBM Tivoli Federated Identity Manager Content VULNERABILITY DETAILS: DESCRIPTION: An unspecified vulnerability in the Java Runtime Environment JRE component allows remote attackers to affect availability, related to JSSE. The...

Security Bulletin: IBM Tivoli Federated Identity Manager Business Gateway can be affected by a vulnerability in IBM Java Runtime Environment (CVE-2012-5081)

Abstract A vulnerability in the Java Runtime Environment JRE impacts IBM Tivoli Federated Identity Manager Business Gateway Content VULNERABILITY DETAILS: DESCRIPTION: An unspecified vulnerability in the Java Runtime Environment JRE component allows remote attackers to affect availability, relate...

Security Bulletin: IBM Smart Analytics System 7600, 7700, and 7710 are affected by vulnerabilities in OpenSSL

Abstract A number of security vulnerabilities have been identified in the OpenSSL libraries that are part of the operating system software included with the vulnerable systems. Content VULNERABILITY DETAILS CVE IDs: CVE-2012-2131, CVE-2012-2110, CVE-2012-0884, CVE-2012-0050, CVE-2011-4108,...

Security Bulletin: Multiple Vulnerabilities in InfoSphere BigInsights due to vulnerabilities in IBM Java JDK Version 6 (CVE-2012-1717, CVE-2012-1718)

Abstract IBM InfoSphere BigInsights makes use of IBM Java Development Kit JDK Version 6. Multiple vulnerabilities have been identified in IBM Java 6, and addressed in IBM Java 6 JDK SR 11. Content VULNERABILITYDETAILS: CVE-2012-1718, CVE-2012-1717 DESCRIPTION: Vulnerabilities in the Java...

Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 Java Stored Procedure Infrastructure (CVE-2012-2197).

Abstract Vulnerability in IBM DB2 could allow an authenticated user to cause a stack-based buffer overflow and possibly attain remote code execution. Content VULNERABILITY DETAILS CVE ID: CVE-2012-2197 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allo...

Security Bulletin: IBM WebSphere MQ File Transfer Edition Web Gateway vulnerable to CSRF attack (CVE-2012-3294)

Abstract A low risk security vulnerability in the "Web Gateway" component of IBM WebSphere MQ File Transfer Edition and WebSphere MQ - Managed File Transfer may be susceptible to a Cross Site Request Forgery attack. Content CVE ID: CVE-2012-3294 DESCRIPTION: When using the web gateway, an...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.4

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.0.0.4 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-2170 PM56183 DESCRIPTION: WebSphere Application Server could allow a network attacker to obtain sensitive information, caused by...

Security Bulletin: Two security vulnerabilities found and fixed in WebSphere Business Events V7.0, V7.0.1 and 7.0.1.1 in the DesignData Tooling (CVE-2012-2190, CVE-2012-2191)

Abstract A vulnerability in relation to Session ID Lengths and SSL/TLS Server has been discovered that impacts GSKit used with the Webshpere Business Events 7.0 product. Content VULNERABILITY DETAILS CVE IDs: CVE-2012-2191 and CVE-2012-2190 DESCRIPTION An error in the Global secure Toolkit GSKIT,...

Security Bulletin: IBM WebSphere MQ File Transfer Edition Web Gateway insufficient access control (CVE-2012-2206)

Abstract A low risk security vulnerability in the "Web Gateway" component of IBM WebSphere MQ File Transfer Edition may result in authenticated users being able to access other users' file transfers. Content CVE ID: CVE-2012-2206 DESCRIPTION: When using the web gateway, an authenticated user is...

Security Bulletin: IBM SPSS SamplePower vsview6 ActiveX Control vulnerabilities (CVE-2012-0189)

Abstract There are multiple security vulnerabilities with the VsVIEW6 ActiveX control shipped by IBM SPSS SamplePower Version 3. The vulnerabilities allow remote attackers to execute arbitrary code on installations of SamplePower when the control is invoked as ActiveX by Microsoft Internet...

Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)

Summary Apache Struts is used by IBM Call Center as part of its web application framework used for creating Java EE web applications. It is vulnerable to various CVEs, listed below. We recommend upgrading to the latest supported version of Struts that was released as part of the latest FixPack 12...

September 13, 2022—KB5017377 (Security-only update)

None None...

September 13, 2022—KB5017370 (Monthly Rollup)

None None...

Microsoft Windows Kerberos 安全漏洞

Microsoft Windows Kerberos is a software for authentication in network clusters from Microsoft Corporation.Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications via a key system. A security vulnerability exists i...

Microsoft Windows 代码注入漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A code injection vulnerability exists in Microsoft Windows OLE. The following products and versions are affected: Windows Server 2008 for 32-bit Systems Service Pack 2 Server Core...

Microsoft Windows Kerberos 安全漏洞

Microsoft Windows Kerberos is a software for authentication in network clusters from Microsoft Corporation.Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications via a key system. A security vulnerability exists i...

Microsoft Windows OLE 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows OLE. The following products and editions are affected:Windows Server 2008 for 32-bit Systems Service Pack 2 Serve...