Security Bulletin: Unix File Parameter Alteration vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-3064).

Summary IBM® InfoSphere® Master Data Management - Collaborative Edition is vulnerable to a Unix file parameter alteration vulnerability. This vulnerability might allow unauthorized access to data; specifically, an authorized person might be able to copy files from the InfoSphere MDM - Collaborati...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability in GDS component of IBM® InfoSphere® Master Data Management - Collaborative Edition (CVE-2014-0114)

Summary Apache Struts 1.X could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability by using the class parameter of an ActionForm object to manipulate the ClassLoade...

Security Bulletin: QMF for WebSphere is affected by a vulnerability in Apache Commons FileUpload (CVE-2014-0050)

Summary Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header for multipart requests. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause the application to enter into an...

Security Bulletin: ClassLoader manipulation with Apache Struts affecting InfoSphere Identity Insight (CVE-2014-0114)

Summary There is a ClassLoader manipulation vulnerability in Apache Struts that is used by InfoSphere Identity Insight. Vulnerability Details CVEID: CVE-2014-0114 Apache Struts 1.X could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting...

Security Bulletin: A security vulnerability has been identified in WebSphere v6.1 and v7.x shipped with InfoSphere Warehouse v9.5, V9.7, V10.1,and v10.5 (CVE-2014-0114)

Summary WebSphere v6.1 and WebSphere v7.x is shipped as a component of InfoSphere Warehouse v9.5, V9.7, V10.1,and v10.5 . Information about a security vulnerability affecting WebSphere v6.1 and WebSphere v7.x has been published in a security bulletin. Vulnerability Details Please consult the...

Security Bulletin: InfoSphere Streams is possibly affected by vulnerabilities in the IBM® SDK, Java™ Technology Edition (CVE-2014-0453 and CVE-2014-0460)

Summary The IBM® Developers Kit, Java™ Technology Edition that is shipped with InfoSphere Streams has security vulnerabilities two of which could potentially affect InfoSphere Streams. Other vulnerabilities could be exposed by the use of custom Java code in InfoSphere Streams applications...

Security Bulletin: Local escalation of privilege vulnerability in IBM® DB2® (CVE-2014-0907).

Summary A vulnerability in IBM DB2 for Linux, Unix and Windows could allow a local user to gain elevated privilege. Vulnerability Details CVE ID: CVE-2014-0907 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability which allows a malicious user to gain root privilege. Thi...

Security Bulletin: IBM® DB2® is impacted by multiple TLS/SSL security vulnerabilities (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 for Linux, Unix and Windows is affected by multiple problems related to the SSL implementation, which, under very specific conditions, can cause DB2 server to become unresponsive, hang or crash. By default, DB2 does not use TLS/SSL for client-server communication and therefore,...

Security Bulletin: IBM InfoSphere Optim Workload Replay Cross Site Scripting Vulnerability (CVE-2014-0827)

Summary An attacker can trick a user into inserting a mal-formed URL address into a browser or clicking on a mal-formed URL link and exploit a cross-site scripting vulnerability to gain unauthorized access or collect sensitive information. Vulnerability Details CVE ID:CVE-2014-0827 CVSS: CVSS Bas...

Security Bulletin: Cross site scripting vulnerability in IBM InfoSphere Master Data Management Reference Data Management Hub (CVE-2014-0850)

Summary The IBM InfoSphere Master Data Management Reference Data Management RDM Hub is vulnerable to cross-site scripting Vulnerability Details CVE ID: CVE-2014-0850 DESCRIPTION: An attacker can trick a user into inserting a mal-formed URL address into a browser or clicking on a mal-formed URL li...

Security Bulletins - Cognos Command Center

Problem Cognos Command Center Security Bulletins. Resolving The Problem Tab navigation 10.2.x 10.1 Security bulletins for Cognos Command Center 10.2.x --- Published / Updated| Title May 2018| Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Command Center...

Security Bulletin: TLS padding vulnerability affects IBM Cognos Business Intelligence (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Cognos Business Intelligence. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: TLS padding vulnerability affects IBM Cognos Metrics Manager (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Cognos Metrics Manager Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Vulnerability in SSLv3 affects IBM Cognos Metrics Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Cognos Metrics Manager. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: Cognos BI Server is affected by the following vulnerabilities: CVE-2014-0107, CVE-2014-0075, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119, CVE-2014-0878, CVE-2014-0460

Summary Security vulnerabilities have been discovered in Tomcat, XalanJ and the IBM JRE that were reported in late May, 2014. Vulnerability Details CVE-ID: CVE-2014-0107 DESCRIPTION: Apache Xalan-Java could allow a remote attacker to bypass security restrictions, caused by the improper handling o...

Security Bulletin: IBM Cognos BI Server is affected by the following OpenSSL vulnerability: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients an...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos TM1 (CVE-2015-0410, CVE-2014-6593)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 Service Refresh 16-FP2 and earlier and 7 Service Refresh 8 and earlier, that is used by IBM TM1. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerabili...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos TM1 (CVE-2014-3566, CVE-2014-6457)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6 Service Refresh 16-FP1 and earlier and 7 Service Refresh 7-FP1 and earlier that is used by IBM Cognos TM1. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Cognos TM1 (CVE-2014-3567, CVE-2014-3513, CVE-2014-3568)

Summary OpenSSL vulnerabilities were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM Cognos TM1. IBM Cognos TM1 has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2014-3567 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a memory...

Security Bulletin: Multiple vulnerabilities in IBM OpenPages Platform with Application Server

Summary The following security vulnerabilities have been identified in versions of IBM OpenPages with Application Server. See Vulnerability Details for CVE IDs. Vulnerability Details Customers who have IBM OpenPages with Application Server are potentially impacted by the following vulnerabilities...