Security Bulletin: IBM Storwize V7000 Unified Fix Available for Storwize V7000 Cross Protocol Vulnerability (CVE-2013-0500)

Abstract IBM Storwize V7000 Unified includes a flaw in the handling of special files created by an NFS client resulting in a vulnerability reported against IBM Storwize V7000 Unified. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0500 DESCRIPTION: A flaw in the IBM Storwize V7000 Unified code f...

Security Bulletin: SONAS Fix Available for SONAS CIFS Attribute Vulnerability (CVE-2013-0454)

Abstract SONAS includes a version of Samba that is affected by a vulnerability that sets incorrect attributes to a SONAS CIFS export. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0454 DESCRIPTION: A flaw in the Samba code for handling attributes of SONAS CIFS shares is resulting in a serious...

Security Bulletin: Storwize V7000 Unified Fix Available for CIFS Attribute Vulnerability (CVE-2013-0454)

Abstract Storwize V7000 Unified includes a version of Samba that is affected by a vulnerability that sets incorrect attributes to a Storwize V7000 Unified CIFS export. Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0454 DESCRIPTION: A flaw in the Samba code for handling attributes of Storwize V70...

Security Bulletin: Vulnerabilities in IBM SPSS Collaboration and Deployment Services (CVE-2013-5370 & CVE-2013-4042)

Abstract Vulnerabilities have been identified in IBM SPSS Collaboration and Deployment Services which make the product vulnerable to remote code execution. Content VULNERABILITY DETAILS: CVEID:CVE-2013-4042 DESCRIPTION: All users of Collaboration and Deployment Services are vulnerable. CVSS Base...

Security Bulletin: Multiple vulnerabilities exist in the OpenSSL component of IBM Initiate Master Data Service and IBM InfoSphere Master Data Management Standard Edition (CVE-2013-0166, CVE-2013-0166, CVE-2012-2686)

Abstract Three security vulnerabilities exist in the version of OpenSSL shipped with IBM Initiate Master Data Service and IBM InfoSphere Master Data Management Standard Edition. See the individual descriptions for the details. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0166 DESCRIPTION: A fl...

Security Bulletin: IBM Prerequisite Scanner 1.2 Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Vulnerability in the JVM (CVE-2013-1500)

Abstract In SmartCloud Provisioning, when AWT code is run, a vulnerability of the JVM can be exploited. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1500 DESCRIPTION: An unspecified vulnerability related to the Java Runtime Environment 2D component has partial confidentiality impact, partial...

Security Bulletin: Application not signed properly in IBM Sterling External Authentication Server (CVE-2013-0521)

Abstract IBM Sterling External Authentication Server is vulnerable to running untrusted code. Content VULNERABILITY DETAILS CVE ID: CVE-2013-0521 DESCRIPTION: Java Webstart App is not signed correctly The IBM Sterling External Authentication Server Webstart GUI is signed with a self-signed...

Security Bulletin: IBM Sterling Order Management - Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Vulnerability IBM Java XML Parser used in IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed (CVE-2013-4002)

Abstract IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed ships with IBM Java JRE. This JRE contains a variant of Apache-J XML parser XM4J that is vulnerable to a denial of service attack triggered by malformed XML data. Content CVE ID: CVE-2013-4002 IBM CVSS SCORE: 7.1CVSS...

Security Bulletin: IBM InfoSphere Streams Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. InfoSphere Streams ships javadoc files in it's install tree. If these files are made accessible from the internet this vulnerability could be exploited. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML...

Security Bulletin: InfoSphere Guardium Data Redaction Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Sterling External Authentication Server Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Information Server (CVE-2013-4066 and CVE-2013-4067)

Abstract Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Information Server CVE-2013-4066 and CVE-2013-4067 Content Security vulnerabilities exist in various versions of IBM Information Server or constituent products. See the individual descriptions for details...

Security Bulletin: TADDM Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation shipped in IBM Tivoli Storage Manager TSM 6.1, 6.2, and 6.3 Windows client packages contains a frame injection vulnerability Content VULNERABILITY DETAILS: The TSM 6.1 Windows client packages and some TSM 6.2 and 6.3 Windows client packages contain documentation...

Security Bulletin: Elevated privileges vulnerability in Connect:Direct for UNIX on AIX 6.1 and above (CVE-2013-2989)

Abstract A user who has been successfully authenticated by Connect:Direct for UNIX executes Connect:Direct’s file copying functionality with elevated file system privileges. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2989 DESCRIPTION: A user who has been successfully authenticated by...

Security Bulletin: Potential security exposure when using IBM® InfoSphere® Streams due to vulnerabilities in IBM Java™ SE Version 6 SDK.

Abstract IBM InfoSphere Streams makes use of IBM Java SE Version 6 SR12 SDK. Potential security exposures exist in IBM InfoSphere Streams due to vulnerabilities in IBM Java SE Version 6 SDK. Content VULNERABILITY DETAILS: CVE-2013-0440, CVE-2013-0443 DESCRIPTION: Vulnerabilities in the IBM Java S...

Security Bulletin: Cross-Site Scripting vulnerability in IBM InfoSphere Information Server (CVE-2013-0502)

Abstract Security Bulletin: Cross-Site Scripting vulnerability in IBM InfoSphere Information Server CVE-2013-0502 Content SUMMARY: A Cross-Site Scripting vulnerability exists in the Web Console of IBM InfoSphere Information Server that may lead to unauthorized access when a user is tricked into...

Security Bulletin: IBM DB2 is impacted by a vulnerability in the IBM GSKit library (CVE-2013-0169).

Abstract GSKit is used by IBM DB2 for SSL support. The version of GSKit iused by DB2 is vulnerable to the “Lucky Thirteen” security vulnerability. By default, DB2 does not use SSL for client-server communication and therefore DB2 is vulnerable only if SSL is enabled. Content VULNERABILITY DETAILS...