Security Bulletin: IBM Tealeaf Customer Experience servers allow unauthenticated access (CVE-2015-4987)

Summary IBM Tealeaf Customer Experience servers allow access to operational data and less privileged operations without authentication. Vulnerability Details CVEID: CVE-2015-4987 DESCRIPTION: The IBM Tealeaf Customer Experience search and replay servers could allow an unauthenticated attacker to...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM WebSphere Application Server affect IBM Emptoris Strategic Supply Management, and IBM Emptoris Services Procurement (CVE-2015-7575, CVE-2016-0466, CVE-2015-7417)

Summary The IBM Emptoris Strategic Supply Management Suite and IBM Emptoris Services Procurement products are affected by multiple security vulnerabilities that exist in IBM SDK Java Technology Edition and IBM WebSphere Application Server. The security bulletin includes issues disclosed as part o...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM QuickFile (CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM QuickFile. These issues were disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified vulnerability related ...

Security Bulletin: Multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 6, 7, 8 affect IBM Transformation Extender Hypervisor Edition for AIX (CVE-2016-0466, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 6, 7, 8 that are used by IBM Transformation Extender Hypervisor Edition for AIX. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and include the vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 6, 7, 8 affect IBM Transformation Extender Hypervisor Edition (CVE-2016-0466, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Versions 6, 7, 8 that are used by IBM Transformation Extender Hypervisor Edition. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and include the vulnerability commonl...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM B2B Advanced Communications (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 7.0 that is used by IBM B2B Advanced Communications. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575...

Security Bulletin: Vulnerability in IBM Java Runtime shipped with WebSphere Partner Gateway Advanced/Enterprise editions (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by WebSphere Partner Gateway Advanced/Enterprise editions. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Financial Transaction Manager (FTM) for Multi-Platform (MP) (CVE-2015-7417)

Summary IBM WebSphere Application Server is shipped as a component of Financial Transaction Manager FTM for Multi-Platform MP. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the securit...

Security Bulletin: IBM Forms Viewer may be affected by a known issue with libpng library (CVE-2015-8126, CVE-2015-8472)

Summary An IBM Form XFDL document that contains a specially crafted PNG image can crash IBM Forms Viewer. This can occur based on the Viewer's use of this library. Vulnerability Details CVEID: CVE-2015-8126 DESCRIPTION: libpng is vulnerable to a buffer overflow, caused by improper bounds checking...

Security Bulletin: Vulnerability in Apache Commons Collections affects IBM Forms Server (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Forms Server. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the...

Security Bulletin: Vulnerability in JSoup affects IBM Forms Experience Builder (CVE-2015-6748)

Summary A JSoup vulnerablity which allows a remote attacker to exploit a specially-crafted URL to access user authentication credentials was addressed by IBM Forms Experience Builder. Vulnerability Details CVE-ID: CVE-2015-6748 Description: JSoup is vulnerable to cross-site scripting, caused by...

Security Bulletin: IBM Sterling Order Management is affected by Apache Commons Collections security vulnerabilities (CVE-2015-7450)

Summary IBM Sterling Order Management use Apache Commons Collections and are affected by some of the vulnerabilities that exist in this component. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Partner Gateway Advanced/Enterprise editions(CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6.0 that is used by WebSphere Partner Gateway Advanced/Enterprise edition. These issues were disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Transformation Extender (CVE-2015-2613, CVE-2015-2601, CVE-2015-4749, CVE-2015-2625, CVE-2015-1931)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 5, 6, 7 that are used by WebSphere Transformation Extender. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTIO...

Security Bulletin: IBM Tealeaf Customer Experience PCA Web UI PHP security issues

Summary The IBM Tealeaf Customer Experience PCA Web UI uses a version of PHP with reported security issues. Vulnerability Details CVEID: CVE-2015-0273 DESCRIPTION: PHP could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error in unserialize with...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server used with IBM Emptoris Strategic Supply Management, and IBM Emptoris Services Procurement products (CVE-2015-4872)

Summary IBM WebSphere Application Server is used as a component of IBM Emptoris Strategic Supply Management and IBM Emptoris Services Procurement products. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerabilit...

Security Bulletin: IBM Tealeaf Customer Experience allows user authentication via unencrypted GET request (CVE-2015-4990)

Summary The IBM Tealeaf Customer Experience portal allows a user to authenticate via means that could result in exposure of credentials. Vulnerability Details CVEID: CVE-2015-4990 DESCRIPTION: The IBM Tealeaf Customer Experience could allow a local privileged user to obtain the authentication...

Security Bulletin: IBM Tealeaf Customer Experience allows unauthorized access to system files (CVE-2015-4988)

Summary The IBM Tealeaf Customer Experience replay server could allow an attacker to traverse directories and read any file on the Windows Server system hosting the server. Vulnerability Details CVEID: CVE-2015-4988 DESCRIPTION: The IBM Tealeaf Customer Experience replay server could allow an...

Security Bulletin: IBM Tealeaf Customer Experience is affected by a security vulnerability (CVE-2015-4989)

Summary The IBM Tealeaf Customer Experience portal is affected by a security vulnerability that might allow unauthorized access to images of charts generated by other users. Vulnerability Details CVEID: CVE-2015-4989 DESCRIPTION: The IBM Tealeaf Customer Experience portal allows an attacker with...

Security Bulletin: Security vulnerabilities in ActiveMQ 5.2.0 affect IBM Sterling B2B Integrator (CVE-2015-1830, CVE-2014-8110, CVE-2013-3060, CVE-2013-1880, CVE-2013-1879, CVE-2012-6551, CVE-2012-6092, CVE-2010-1587, CVE-2010-1244, CVE-2010-0684)

Summary Multiple directory traversal, cross-site scripting, denial of service and cross-site request forgery security vulnerabilities in ActiveMQ 5.2.0. IBM Sterling B2B Integrator has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1830 DESCRIPTION: Apache ActiveMQ could all...