Security Bulletin: Directory listing vulnerability in IBM InfoSphere Data Replication Dashboard (CVE-2012-4861)

Abstract InfoSphere Data Replication Dashboard includes a web server that can be used to list specific directories under the dashboard web application. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-4861 DESCRIPTION: It is possible to retrieve a directory listing by sending a request for specifi...

Security Bulletin: Potential security exposure when using InfoSphere BigInsights due to vulnerability in Java JDK Version 6

Abstract IBM InfoSphere BigInsights makes use of Java Development Kit JDK Version 6. An unspecified vulnerability affecting availability has been identified in IBM Java 6 that may affect InfoSphere BigInsights. Content VULNERABILITY DETAILS: CVE-2012-0501 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: IBM XIV Storage System (MTM 2810-A14, 2812-A14, MTM 2810-114, 2812-114) Fixed Passwords for Maintenance Accounts (CVE-2012-2166)

Abstract IBM XIV Storage Systems have maintenance accounts with fixed passwords. A fix is available to manage access to these accounts. Content VULNERABILITY DETAILS: DESCRIPTION: The XIV Storage Systems have preconfigured user accounts that are used for maintenance purposes. These accounts have...

Security Bulletin: Storwize V7000 Unified documentation update available for configuration of Storwize V7000 Unified with LDAP authentication (CVE-2012-0706)

Abstract Storwize V7000 Unified includes a version of the LDAP client which stores the username and the password of the LDAP user in clear text in the local file system. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-0706 DESCRIPTION: Storwize V7000 Unified requires LDAP username called binddn a...

Security Bulletin: Storwize V7000 Unified Fix Available for Code Injection via Command Line Interface and Graphical User Interface (CVE-2012-2163)

Abstract Storwize V7000 Unified has a vulnerability that allows the administrative users to execute commands as root. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-2163 DESCRIPTION: An error in the command execution of the Storwize V7000 Unified Command Line Interface and the Graphical User...

Security Bulletin: Storwize V7000 Unified V1.3.2.3 and V1.4.0.0 Include Fixes for Multiple Vendor Security Vulnerabilities

Abstract Storwize V7000 Unified includes multiple software components for which the vendors have provided fixes for security vulnerabilities in such components. Content VULNERABILITY DETAILS: CVE ID: Vendor| Vendor ID| Vendor Title| Included CVEs ---|---|---|--- Red Hat| RHSA-2012-0143| Critical:...

Security Bulletin: TS3310 Tape Library contains pre-configured default accounts (CVE-2012-1844)

Abstract Security Vulnerability in the TS3310 Tape Library. The tape library ships with certain pre-configured default accounts that have fixed passwords. A remote unauthorized user with knowledge of these accounts/passwords could use them to gain unauthorized access to the tape library. Content...

Security Bulletin: IBM TS3310 Tape Library update for security vulnerabilities in OpenSSL (CVE-2012-2333)

Abstract Download update to TS3310 Tape Library, which contains a newer version of OpenSSL that fixes certain security vulnerabilities that were present in older versions of OpenSSL. Content CVE ID: CVE-2012-2333 DESCRIPTION: OpenSSL versions prior to 1.0.0 do not follow best security practices a...

Security Bulletin: IBM TS2900 Tape Library update for security vulnerabilities in OpenSSL (CVE-2012-2333)

Abstract Download an update to the TS2900 Tape Library, which contains a newer version of OpenSSL that fixes certain security vulnerabilities that were present in older versions of OpenSSL. Content DESCRIPTION: OpenSSL versions prior to 1.0.0 do not follow best security practices and need to be...

Security Bulletin: SONAS Fix Available for Code Injection via Command Line Interface and SONAS Graphical User Interface (CVE-2012-2163)

Abstract SONAS has a vulnerability that allows SONAS administrative users to execute commands as root. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-2163 DESCRIPTION: An error in the command execution of the SONAS Command Line Interface and the SONAS Graphical User Interface could be leveraged ...

Security Bulletin: Multiple vulnerabilities exist in the OpenSSL component of IBM Initiate Master Data Service and IBM InfoSphere Master Data Management Standard Edition (CVE-2013-0166, CVE-2013-0166, CVE-2012-2686)

Abstract Three security vulnerabilities exist in the version of OpenSSL shipped with IBM Initiate Master Data Service and IBM InfoSphere Master Data Management Standard Edition. See the individual descriptions for the details. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0166 DESCRIPTION: A fl...

Security Bulletin: IBM SPSS SamplePower vsflex7l ActiveX control vulnerability (CVE-2012-5947)

Abstract There is a security vulnerability with the vsflex7l ActiveX control shipped by IBM SPSS SamplePower Version 3. The vulnerability allows remote attackers to execute arbitrary code on installations of SamplePower when the control is invoked as ActiveX by Microsoft Internet Explorer. Conten...

Security Bulletin: IBM Smart Analytics System 5600 clients affected by vulnerabilities in IBM JRE (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Abstract These vulnerabilities are only applicable to Java deployments where untrusted code may be executed e.g. Java applets running in a web browser. Content VULNERABILITY DETAILS CVE IDs: CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823 DESCRIPTION: The IBM Smart Analytics System 560...

Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826).

Abstract Vulnerability in IBM DB2 could allow an authenticated user to cause a stack-based buffer overflow and possibly attain remote code execution. Content VULNERABILITY DETAILS CVE ID: CVE-2012-4826 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allo...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.5

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.0.0.5 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...

Security Bulletin: Tivoli Federated Identity Manager Potential security exposure with IBM WebSphere Application Server APAR PM44303 (CVE-2012-3325)

Abstract If you have installed an interim fix for PM44303, Websphere Application Server Fixpack 21 or Fixpack 23 which includes APAR PM44303, there is the potential for an authenticated user to gain access to unauthorized resources. Content VULNERABILITY DETAILS: DESCRIPTION: The Tivoli Federated...

Security Bulletin: Tivoli Federated Identity Manager Business Gateway - Multiple Protocol XML signature validation bypass (CVE-2012-3314)

Abstract Tivoli Federated Identity Manager TFIM accepts specially crafted messages that can contain invalid or untrusted XML signatures for certain single sign-on protocols and token modules. TFIM could mistakenly accept a malicious message, allowing an attacker to perform actions as another user...

Security Bulletin: IBM SPSS Modeler - XML (CVE-2012-5769)

Abstract If an attacker makes a victim open a specially crafted XML document, IBM SPSS Modeler installed on the victim's system could be made to automatically send the contents of local or remote resource to the attacker's server. It could also be possible to conduct denial of service attacks...

Security Bulletin: Vulnerability in IBM® Sterling B2B Integrator can lead to ability to execute OS commands from CLA2 server without authentication (CVE-2012-5937).

Abstract A security vulnerability exists in the Sterling B2B Integrator CLA2 server which permits an unauthenticated user to execute arbitrary OS commands. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-5937 DESCRIPTION: A security vulnerability exists in the Sterling B2B Integrator CLA2 server...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.0.1

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.5.0.1 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...