Security Bulletin: Vulnerabilities in OpenSSL affect Rational Application Developer for WebSphere Software (CVE-2016-0701, CVE-2015-3197)

Summary OpenSSL vulnerabilities were disclosed on January 28, 2016 by the OpenSSL Project. OpenSSL is used by IBM Rational Application Developer for WebSphere Software. IBM Rational Application Developer for WebSphere Software has addressed the applicable CVEs. Vulnerability Details CVEID:...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Application Developer for WebSphere Software (CVE-2015-4000, CVE-2015-1793)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project and affect Rational Application Developer for WebSphere Software. This includes the Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000. This also includes the alternate chains...

Security Bulletin: Multiple vulnerabilities in the IBM Java SDK affects IBM Rational Application Developer for WebSphere Software (CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916, CVE-2015-0204)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 6 and 7 that is used by IBM Rational Application Developer for WebSphere Software. These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses FREAK: Factoring...

Security Bulletin: Vulnerabilities in OpenSSL affects Rational Application Developer for WebSphere Software

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by the Cordova platform packaged with Rational Application Developer for WebSphere Software and has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0207 DESCRIPTION: OpenS...

Security Bulletin: Multiple vulnerabilities in the IBM SDK for Node.js affect the Cordova tools in IBM Rational Application Developer (CVE-2016-2086, CVE-2016-2216, CVE-2015-3197)

Summary Security vulnerabilities have been discovered in the IBM SDK for Node.js used by the Cordova platform packaged in IBM Rational Application Developer. Vulnerability Details CVEID: CVE-2016-2086 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the improper handling of...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational Application Developer for WebSphere Software (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational Application Developer for WebSphere Software. IBM Rational Application Developer for WebSphere Software has addressed the applicable CVEs. Vulnerability Details CVEID:...

CVE-2015-3611

A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report...

CVE-2015-2802

CVE-2015-2802 affects HP SiteScope 11.2/11.3 (Windows/Linux/S Solaris) and HP Asset Manager 9.30–9.32, 9.40–9.41, 9.50, plus Asset Manager Cloudsystem Chargeback 9.40. The vulnerability is a TLS RC4/Bar Mitzvah information disclosure, enabling a remote attacker to obtain sensitive information. Th...

CVE-2015-3613

FortiManager VM and FortiManager appliances with versions 5.2.1 and earlier, and 5.0.10 and earlier, expose a privilege management vulnerability in the WebUI FTP backup page. The issue, confirmed by multiple sources, can be exploited to compromise confidentiality, integrity, and availability of t...

CVE-2015-3612

CVE-2015-3612 describes a Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 5.2.1 and earlier and 5.0.10 and earlier, due to improper validation of client data in the FortiWeb auto update service page. The issue affects the web interface and can allow execution of client-side code...

CVE-2015-3611

CVE-2015-3611 is a FortiManager command injection vulnerability affecting FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier. The issue allows a malicious user to run system commands when executing a report, via unspecified vectors (the description does not specify exact vectors)....

CVE-2015-6815

The processtxdesc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service infinite loop and guest crash via unspecified vectors...

CVE-2015-6815

The processtxdesc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service infinite loop and guest crash via unspecified vectors...

CVE-2015-6815

The processtxdesc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service infinite loop and guest crash via unspecified vectors...

CVE-2015-6815

CVE-2015-6815 affects QEMU with e1000 NIC emulation. The process_tx_desc path in hw/net/e1000.c improperly handles transmit descriptor data, enabling a remote attacker within the local network to trigger an infinite loop and guest crash (Denial of Service). This vulnerability is tied to QEMU befo...

CVE-2015-0949

The System Management Mode SMM implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Bo...

CVE-2015-8851

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing...

CVE-2015-8851

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing...

CVE-2015-0949

The System Management Mode SMM implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Bo...

CVE-2015-0949

CVE-2015-0949 pertains to SMM (System Management Mode) call-outs that may run outside SMRAM in certain BIOS implementations (Dell Latitude E6430 A09, HP EliteBook 850 G1 L71 Ver. 01.09, and potentially others). Root cause: SMM code does not ensure function calls operate on SMRAM memory locations,...