Security Bulletin: Multiple Vulnerabilities in IBM Java SDK Affect IBM B2B Advanced Communications

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 10 Fix Pack 10 that is used by IBM B2B Advanced Communications. This issue was disclosed as part of the IBM Java SDK updates in October 2017 Vulnerability Details CVEID: CVE-2017-10295...

Security Bulletin: IBM B2B Advanced Communications is Affected by an XML External Entity Injection (XXE) Attack when Processing XML Data

Summary IBM B2B Advanced Communications has addressed a vulnerability originally found in IBM Financial Transaction Manager of an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory...

Security Bulletin: Vulnerabilities in WebSphere eXtreme Scale Version 8.6.0.8 Libraries Affect IBM B2B Advanced Communications (CVE-2015-4936)

Summary IBM B2B Advanced Communications uses objectgrid-8.6.0.8-201511241642.jar from Websphere eXtreme Scale where vulnerabilities have been identified. Vulnerability Details CVEID: CVE-2015-4936 DESCRIPTION: An unspecified vulnerability could cause a denial of service for WebSphere eXtreme Scal...

Security Bulletin: Vulnerabilities in Apache HTTP Components Libraries Affect IBM B2B Advanced Communications

Summary The Apache httpclient-4.0.2.jar used by IBM B2B Advanced Communications has vulnerabilities. Vulnerability Details CVEID: CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to apply a configured connection during the initial handshake of ...

Security Bulletin: A security vulnerability has been identified in IBM Java SDK shipped with IBM B2B Advanced Communications (CVE-2016-5597)

Summary IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 9 Fix Pack 50 is shipped as a component of IBM B2B Advanced Communications . This issue was disclosed as part of the IBM Java SDK updates in October 2016 Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM B2B Advanced Communications

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 9 Fix Pack 50 that is used by IBM B2B Advanced Communications. This issue was disclosed as part of the IBM Java SDK updates in January 2017 Vulnerability Details CVEID: CVE-2016-5546...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM B2B Advanced Communications.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 9 Fix Pack 40 that is used by IBM B2B Advanced Communications. These issues were disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3485...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM B2B Advanced Communications (CVE-2016-3427 and CVE-2016-3426)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7.0 that is used by IBM B2B Advanced Communications. These issues were disclosed as part of the IBM Java SDK updates for April 2016. Vulnerability Details CVEID: CVE-2016-3427 DESCRIPTION: An...

Security Bulletin: Information disclosure vulnerability in IBM B2B Advanced Communications (CVE-2016-0341).

Summary IBM B2B Advanced Communications can disclose sensitive information such as usernames, passwords, machine name, sensitive file locations, or any combination of that information. This information could be used to aid in further attacks against the system. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM B2B Advanced Communications (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 7.0 that is used by IBM B2B Advanced Communications. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM B2B Advanced Communications (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM B2B Advanced Communications. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM B2B Advanced Communications (CVE-2015-0138, CVE-2014-6593, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR8 that is used by IBM B2B Advanced Communications. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on RSA-EXPORT...

IBM Multi-Enterprise Integration Gateway and B2B Advanced Communications Cross-Site Scripting Vulnerability

IBM Multi-Enterprise Integration Gateway MEIG and IBM B2B Advanced Communications are both products of IBM Corporation, U.S.A. IBM MEIG is a cross-enterprise integration communications gateway product.IBM B2B Advanced IBM MEIG is a cross-enterprise integrated communications gateway product.IBM B2...

CVE-2016-5892

Cross-site scripting XSS vulnerability in IBM 10x, as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications before 1.0.0.52, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-5892

The CVE-2016-5892 XSS vulnerability affects IBM 10x used in Multi-Enterprise Integration Gateway (MEIG) 1.x up to 1.0.0.1 and IBM B2B Advanced Communications up to 1.0.0.5_1/1.0.0.5_2. The root cause is cross‑site scripting in the Web UI, potentially enabling credential disclosure within a truste...

CVE-2016-5892: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM 10x, as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications before 1.0.0.52, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2016-6722

Name of the Vulnerable Software and Affected Versions IBM 10x versions 1.x through 1.0.0.1 Multi-Enterprise Integration Gateway versions 1.x through 1.0.0.1 B2B Advanced Communications versions prior to 1.0.0.5 2 Description A cross-site scripting XSS issue allows remote authenticated users to...

CVE-2016-0341

CVE-2016-0341 affects IBM Multi-Enterprise Integration Gateway 1.0–1.0.0.1 and B2B Advanced Communications 1.0.0.2–1.0.0.4. The root cause is missing HTTPS configuration, allowing remote attackers to obtain highly sensitive information via network sniffing. IBM security bulletins for IBM 10x, B2B...

PT-2016-4156

Name of the Vulnerable Software and Affected Versions IBM Multi-Enterprise Integration Gateway versions 1.0 through 1.0.0.1 B2B Advanced Communications versions 1.0.0.2 through 1.0.0.4 Description The issue allows remote attackers to potentially obtain sensitive information by sniffing the networ...

CVE-2016-0341: Exposure of Sensitive Information to an Unauthorized Actor

IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 through 1.0.0.4 do not require HTTPS, which might allow remote attackers to obtain sensitive information by sniffing the network...