Security Bulletin: Multiple vulnerabilities in IBM Multi-Enterprise Integration Gateway (CVE-2014-0460, CVE-2014-0878, CVE-2014-0453)

Summary IBM Multi-Enterprise Integration Gateway is shipped with IBM® SDK, Java™ Technology Edition the “IBM SDK”, that is based on an Oracle Java Development Kit JDK. Oracle has released the April 2014 critical patch updates CPU that contain security vulnerability fixes for the JDK. The IBM SDK...

Security Bulletin: IBM WebSphere Transformation Extender Secure Adapter Collection 8.4.1.1 CPU utilization and insecure Elliptic Curve Digital Signature Algorithm (CVE-2014-0963, CVE-2014-0076)

Summary IBM WebSphere Transformation Extender Secure Adapter Collection product is affected by two issues: one related to the TLS implementation which, under very specific conditions, can cause CPU utilization to rapidly increase, the other related to an insecure Elliptic Curve Digital Signature...

Security Bulletin: IBM Tealeaf Customer Experience is affected by a vulnerability in the Apache HTTP server, caused by an error in the mod_log_config module (CVE-2014-0098)

Summary Apache HTTP Server is vulnerable to a denial of service, caused by an error in the modlogconfig module. Vulnerability Details CVE-ID: CVE-2014-0098 DESCRIPTION: IBM Tealeaf Customer Experience’s PCA uses the Apache HTTP server to render its web console. Apache HTTP server is vulnerable to...

Security Bulletin: IBM Tealeaf Customer Experience (CX) is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

Security Bulletin: InfoSphere Replication Dashboard is affected by a vulnerability in the IBM Runtime Environment, Java Technology Edition (CVE-2014-4263)

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 7.1.1.0 that is used by InfoSphere Replication Dashboard. These issues were disclosed as part of the IBM Java SDK updates in July 2014. IBM InfoSphere Replication Dashboard is affected by a sing...

Security Bulletin: InfoSphere Data Replication Dashboard is affected by a vulnerability in the IBM Runtime Environment, Java™ Technology Edition (CVE-2014-0453)

Summary An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact. Vulnerability Details CVE ID: CVE-2014-0453 CVSS: CVSS Base Score: 4 CVSS Temporal Score: See for the current score CVSS Environmental...

Security Bulletin: IBM Informix Server CPU utilization (CVE-2014-0963)

Summary Informix Server is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: Informix Server is affected by a problem with the handling of certain S...

Security Bulletin: IBM Informix Client SDK CPU utilization (CVE-2014-0963)

Summary Informix Client SDK is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: Informix Client SDK is affected by a problem with the handling of...

Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in IBM Dojo Toolkit (CVE-2014-8917)

Summary Multiple components of IBM InfoSphere Information Server may be affected by an XSS vulnerability in IBM Dojo Toolkit. Vulnerability Details CVE-ID: CVE-2014-8917 DESCRIPTION: IBM Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server (CVE-2014-6457, CVE-2014-6558, CVE-2014-3566, CVE-2014-3065, CVE-2014-6468)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These were disclosed as...

Security Bulletin: A security vulnerability has been identified in IBM PureApplication System shipped with IBM InfoSphere Information Server Hypervisor edition (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6278)

Summary IBM PureApplication System is shipped as a component of IBM InfoSphere Information Server Hypervisor edition. Information about a security vulnerability affecting IBM PureApplication System has been published in a security bulletin. Other than the Information Server Hypervisor edition,...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Information Server and IBM InfoSphere Data Click (CVE-2014-04263, CVE-2014-4244)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 7 that are used by IBM InfoSphere Information Server and IBM InfoSphere Data Click.These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263...

Security Bulletin: IBM InfoSphere Information Server and IBM InfoSphere Data Click are affected by the following OpenSSL vulnerability (CVE-2014-0224)

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE ID:CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and...

Security Bulletin: IBM InfoSphere Data Quality Console is vulnerable to a Cross-Site Scripting (XSS) attack when adding new project connections (CVE-2014-3071)

Summary IBM InfoSphere Data Quality Console is vulnerable to a Cross-Site Scripting XSS attack while adding new project connections. An attacker can trick a signed on user to clicking on a link, and then the attacker could obtain the user's cookie and act with the user's privileges in the...

Security Bulletin: IBM InfoSphere Metadata Asset Manager is subject to a denial of service vulnerability from its use of Apache Tomcat (CVE-2014-0095)

Summary Apache Tomcat is vulnerable to a denial of service caused by the improper handling of an AJP request. A remote attacker could exploit this vulnerability to consume a request processing thread and cause a denial of service. Vulnerability Details CVE ID: CVE-2014-0095 CVSS: CVSS Base Score:...

Security Bulletin: A vulnerability in the IBM SDK Java™ Technology Edition affects IBM InfoSphere Information Server and IBM InfoSphere Data Click (CVE-2014-0453)

Summary A vulnerability affecting both IBM InfoSphere Information Server and IBM InfoSphere Data Click has been identified in a security component. The vulnerability has partial confidentiality impact and partial integrity impact. Vulnerability Details CVE ID: CVE-2014-0453 CVSS: CVSS Base Score:...

Security Bulletin: Multiple IBM InfoSphere Information Server components are vulnerable due to ClassLoader manipulation vulnerability in Open Source Apache Struts version 1 (CVE-2014-0114)

Summary Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with IBM InfoSphere Information Server and IBM InfoSphere DataClick (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM InfoSphere Information Server and IBM InfoSphere Data Click. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM DB2 is impacted by...

Security Bulletin: A vulnerability in the IBM SDK Java™ Technology Edition affects IBM InfoSphere Information Server and IBM InfoSphere Data Click (CVE-2014-0411)

Summary A vulnerability affecting both IBM InfoSphere Information Server and IBM InfoSphere Data Click has been identified in relation to the JSSE component. The vulnerability may have partial confidentiality and integrity impacts. Vulnerability Details CVE ID: CVE-2014-0411 DESCRIPTION: An...

Security Bulletin: Privilege Escalation and Cross Site Scripting vulnerabilities in IBM® InfoSphere® Master Data Management Collaborative Edition (CVE-2014-8896, CVE-2014-8897, CVE-2014-8898, CVE-2014-8899)

Summary Privilege Escalation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition could allow an escalation of privilege attack. Cross Site Scripting vulnerabilities in IBM InfoSphere Master Data Management - Collaborative Edition are caused by improper validation of...