Security Bulletin: Potential Security Vulnerability fixed in WebSphere Virtual Enterprise (CVE-2013-5425)

Abstract Potential Security vulnerability fixed in WebSphere Virtual Enterprise Content VULNERABILITY DETAILS: CVE ID:CVE-2013-5425PM93828 DESCRIPTION: IBM WebSphere Virtual Enterprise may be vulnerable to cross-site scripting in the Administration Console caused by improper validation of...

Security Bulletin: Multiple vulnerabilities exist in the SOAP Gateway component of IMS Enterprise Suite (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169, CVE-2013-3003)

Abstract The SOAP Gateway component of IMS™ Enterprise Suite versions 1.1, 2.1, and 2.2 is affected by multiple vulnerabilities in IBM® Java™ and could allow remote, arbitrary command execution. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0440 DESCRIPTION: An unspecified vulnerability could...

Security Bulletin: InfoSphere Streams is affected by multiple vulnerabilities in the IBM Java JDK (CVE-2013-1500, CVE-2013-2412, CVE-2013-1571)

Abstract The IBM JDK shipped with InfoSphere Streams has security vulnerabilities which can potentially impact InfoSphere Streams. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1500 An unspecified vulnerability in the Java Runtime Environment JRE component allows local users to affect...

Security Bulletin: Tivoli Federated Identity Manager and Tivoli Federated Identity Manager Business Gateway redirect to an insufficiently validated URL (CVE-2013-5431)

Abstract Under certain conditions, IBM Tivoli Federated Identity Manager TFIM/ IBM Tivoli Federated Identity Manager Business Gateway TFIMBG could send a redirect to a URL provided by an external client without performing sufficient validation of the URL Content VULNERABILITY DETAILS: CVE ID:...

Security Bulletin: IBM Records Manager Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: IBM SPSS Modeler - XML (CVE-2013-2407)

Abstract If an attacker makes a victim open a specially crafted XML document, it could be possible to conduct denial of service attacks using IBM SPSS Modeler installed on the victim's system. Content VULNERABILITY DETAILS CVE ID: CVE-2013-2407 DESCRIPTION: If an attacker makes a victim open a...

Security Bulletin: Multiple vulnerabilities in the IBM Java SDK

Abstract Issues disclosed in the Oracle June 2013 Java SE Critical Patch Update, plus 8 additional vulnerabilities. Content VULNERABILITY DETAILS: CVE IDs: CVE-2013-3006 CVE-2013-3007 CVE-2013-3008 CVE-2013-3009 CVE-2013-3010 CVE-2013-3011 CVE-2013-3012 CVE-2013-4002 CVE-2013-2468 CVE-2013-2469...

Security Bulletin: Information regarding security vulnerability in IBM SDK for Java that is shipped with IBM WebSphere Application Server and addressed by Oracle CPU April 2013 (CVE-2013-0169)

Abstract Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM WebSphere Application Server and included in the products that are listed in this document. Content VULNERABILITY DETAILS: DESCRIPTION: This Security Bulletin addresses the security vulnerabilities...

Security Bulletin: IBM Intelligent Operations Center 1.5 WebSphere Application Server - Oracle Java CPU April 2013

Abstract The Java vulnerabilities identified in the April 2013 Oracle Java security alert need to be fixed in IBM Intelligent Operations Center 1.5. The procedures in this security bulletin identify appropriate IBM patches for these Java vulnerabilities and directs how to apply them. No reference...

Security Bulletin: IBM Tivoli Composite Application Manager for Transactions affected by vulnerabilities in IBM JRE (Multiple CVEs)

Abstract IBM Tivoli Composite Application Manager for Transactions is shipped with two IBM JREs that are based on Oracle Java. It is also dependent on ITM 6.2.1 Framework, which also has it own JRE. Oracle has released a June 2013 Critical Patch Update CPU that contains security vulnerability fix...

Security Bulletin: IBM Smart Analytics System 5600 is affected by vulnerabilities in the IBM Java SDK

Abstract The IBM Smart Analytics System 5600 contains a management host that is installed with the Mozilla Firefox browser. The browser is configured to use IBM Java SDK for Java Web Start applications. The browser software is configured in this manner to allow the use of the Remote Control...

Security Bulletin: IBM Security SiteProtector System can be affected by a vulnerability in the IBM Eclipse Help System (IEHS) (CVE-2013-0467)

Abstract IBM Security SiteProtector System can be affected by a vulnerability in the IBM Eclipse Help System IEHS. This vulnerability could allow a remote attacker to obtain the source code of the Help System. Content VULNERABILITY DETAILS: CVEID: CVE-2013-0467 DESCRIPTION: IBM Security...

Security Bulletin: Multiple vulnerabilities exist in IBM InfoSphere BigInsights (CVE-2013-3996, CVE-2013-3995, CVE-2013-3992)

Abstract Vulnerabilities have been identified in IBM InfoSphere BigInsights which make the product vulnerable to attacks using cross-site scripting, phishing through frames and cross-site request forgery. Content VULNERABILITY DETAILS CVE ID: CVE-2013-3996 Description: An attacker can initiate a...

Security Bulletin: IBM FileNet Business Process Manager – Oracle Critical Patch Updates April 2013 (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169)

Abstract Potential security vulnerabilities exist in the IBM Java SDK that is shipped with the IBM FileNet Business Process Manager Content The products listed below might be affected by security vulnerabilities reported by Oracle’s April 2013 Critical Patch Updates: · IBM FileNet Business Proces...

Security Bulletin: Denial of Service Vulnerability in DB2 for Unix, Linux and Windows's Fast Communications Manager. (CVE-2013-4032)

Abstract Vulnerability in IBM DB2 for Unix, Linux and Windows server products could allow arbitrary data sent to the Fast Communications Manager FCM to cause server denial of service. Content VULNERABILITY DETAILS CVE ID: CVE-2013-4032 DESCRIPTION: A vulnerability in the IBM DB2 products listed...

Security Bulletin: IBM Tivoli Access Manager for e-business (TAMeb) Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool used by TAMeb contains a security vulnerability. The vulnerability allows an attacker to craft a malicious li...

Security Bulletin: WebSphere Application Server Community Edition 3.0.0.3 RMI classloader exposure

Abstract A problem in the RMI classloader may enable an attacker to send a serializated object via JMX that could compromise the system. Content Vulnerability Details A specially crafted serialized object sent via the JMX connector could compromise the system due to a misconfigured RMI classloade...

Security Bulletin: Atlas Suite and potential Apache Xerces-J XML parser Denial of Service attack (CVE-2013-4002)

Abstract Potential denial of service attack against Atlas Suite due to usage of the XML parser Apache Xerces-J. Content VULNERABILITY DETAILS: DESCRIPTION: The Apache Xerces-J XML parser is vulnerable to a denial of service attack, triggered by malformed XML data. The malformed data causes the XM...

Security Bulletin: Informix Open Admin Tool (OAT) cross-site scripting vulnerability (CVE-2013-0492)

Abstract An attacker can trick a user into inserting a mal-formed URL address into a browser or clicking on a mal-formed URL link and exploit a cross-site scripting vulnerability that can be used to gain unauthorized access or collect sensitive information. Content CVEID: CVE-2013-0492 CVSS Base...

Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, and D5100 and IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 are affected by an unauthorized access to table vulnerability in IBM DB2 (CVE-2013-4033)

Abstract A vulnerability in IBM DB2 for Linux, UNIX, and Windows could allow an authenticated user holding EXPLAIN authority to temporarily gain SELECT, INSERT, UPDATE or DELETE privilege on a table. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-4033 IBM InfoSphere Balanced Warehouse C3000,...