Security Bulletin: Cross-site scripting in Oauth (CVE-2013-6738)

Summary Cross-site scripting in Oauth Vulnerability Details CVE ID: CVE-2013-6738 DESCRIPTION: OAuth /authorize endpoint will return an invalid query param in the response. This allows a script to be injected in the response. CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See for the current sco...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer and IBM Watson Content Analytics

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer and IBM Watson Content Analytics. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java S...

Security Bulletin: Vulnerability affects Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console and Watson Content Analytics

Summary A security vulnerability affects IBM Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console and Watson Content Analytics. Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in certain...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer, Watson Content Analytics and Watson Explorer Content Analytics Studio (CVE-2017-10115, CVE-2017-10116)

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer, Watson Content Analytics and Watson Explorer Content Analytics Studio. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An unspecified vulnerability ...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer and Watson Content Analytics (CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2017-3252, CVE-2016-5547, CVE-2016-2183)

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer and Watson Content Analytics. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An unspecified vulnerability in Oracle Java SE Java SE Embedded and...

Security Bulletin: Vulnerabilities exist in Watson Explorer Analytical Components, Watson Explorer Annotation Administration Console, and Watson Content Analytics

Summary Security vulnerabilities have been identified in IBM Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console, and IBM Watson Content Analytics. Vulnerability Details CVEID: CVE-2016-5986 DESCRIPTION: IBM WebSphere Application Server...

Security Bulletin: A vulnerability exists in Watson Explorer Analytical Components, Watson Explorer Annotation Administration Console, Watson Content Analytics, and IBM Content Analytics

Summary A security vulnerability has been identified in IBM Watson Explorer Analytical Components, IBM Watson Explorer Foundational Components Annotation Administration Console, IBM Watson Content Analytics, and IBM Content Analytics. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An...

Security Bulletin: Vulnerabilities exist in Watson Explorer Analytical Components, Watson Explorer Annotation Administration Console, Watson Content Analytics, IBM Content Analytics, and OmniFind Enterprise Edition

Summary Security vulnerabilities have been identified in IBM Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console, IBM Watson Content Analytics, IBM Content Analytics, and OmniFind Enterprise Edition. Not all vulnerabilites affect all...

Security Bulletin: Vulnerability in Flexera InstallAnywhere affects Watson Explorer and Watson Content Analytics (CVE-2016-4560)

Summary Some components of this product include a version of Flexera InstallAnywhere that could allow a remote attacker to execute arbitrary code on the system. This vulnerability can be avoided by following the instructions included in this bulletin. Vulnerability Details CVEID: CVE-2016-4560...

Security Bulletin: Weakness in generated service credentials affects multiple Watson Developer Cloud services (CVE-2016-0391)

Summary A weakness in generated service credentials that affects multiple Watson Developer Cloud offered through IBM Bluemix has been identified and fixed. Replacement of previously generated credentials is recommended. Vulnerability Details CVEID: CVE-2016-0391 DESCRIPTION: Multiple Watson...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2015-7575, CVE-2015-4872)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security...

Security Bulletin: Vulnerability in Apache Commons affects Watson Explorer and Watson Content Analytics (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by Watson Explorer and Watson Content Analytics. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on...

Security Bulletin: Vulnerability in RC4 stream cipher affects Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" attack for SSL/TLS affects Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Content Analytics with Enterprise Search and IBM OmniFind Enterprise Edition

Summary An Open Source Apache Struts V1 ClassLoader manipulation vulnerability affects the web application server that is used by the administration console in IBM Content Analytics with Enterprise Search now named IBM Watson Content Analytics and IBM OmniFind Enterprise Edition. Vulnerability...

Security Bulletin: Multiple vulnerabilities in usage of IBM Java SDK in IBM Content Analytics with Enterprise Search and IBM OmniFind Enterprise Edition (CVE-2013-5802, CVE-2013-4002, CVE-2013-5825, CVE-2013-5372)

Summary Potential security vulnerabilities exist in the IBM Java SDK that is shipped with the IBM Content Analytics with Enterprise Search and IBM OmniFind Enterprise Edition products. Vulnerability Details CVE ID: CVE-2013-5802 DESCRIPTION: JRE vulnerable to denial of service attacks via malform...

Security Bulletin: Financial Transaction Manager for Corporate Payment Services has a potential Cross Site Scripting vulnerability (CVE-2017-1535)

Summary Financial Transaction Manager FTM for Corporate Payment Services CPS has addressed a potential Cross Site Scripting vulnerability. Vulnerability Details CVEID: CVE-2017-1535 DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: IBM Tealeaf Customer Experience (CX) is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

Security Bulletin: IBM Netezza Host Management is affected by the vulnerabilities known as Spectre and Meltdown.

Summary IBM Netezza Host Management is affected by the vulnerabilities known as Spectre and Meltdown, which can enable CPU data cache timing to be abused to bypass conventional memory security restrictions to gain access to privileged memory that should be inaccessible. Vulnerability Details CVEI...

Security Bulletin: Vulnerability in SSLv3 affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710. Vulnerability Details CVE-ID: CVE-2014-3566...

Security Bulletin: TLS padding vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710. Vulnerability Details CVE-ID:...