Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU affect IBM Content Collector for SAP Applications

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID:...

Security Bulletin: Content Collector for Email is affected by an Incorrect redirection for an OAuth authorization request in WebSphere Application Server both Traditional and Liberty

Summary Content Collector for Email has addressed the following vulnerability. IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Vulnerability...

Security Bulletin: Content Collector for Email is affected by a weaker then expected security in IBM WebSphere Application Server vulnerability

Summary Content Collector for Email has addressed the following vulnerability. IBM WebSphere Application Server could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to the admin console. Vulnerabili...

Security Bulletin: OpenSource Apache Struts vulnerability in IBM Content Collector for Microsoft SharePoint

Summary Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against unintended remote operations against components on server memory by the ActionForm instance. An attacker could exploit this vulnerability to execute arbitrary code...

Security Bulletin: OpenSource Apache Struts vulnerability in Content Collector for IBM Connections

Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...

Security Bulletin: OpenSource Apache Struts vulnerability in IBM Content Collector for File Systems

Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...

Security Bulletin: OpenSource Apache Struts vulnerability in Content Collector for IBM Connections

Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...

Security Bulletin: OpenSource Apache Struts vulnerability in IBM Content Collector for Microsoft SharePoint

Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...

Security Bulletin: OpenSource Apache Struts vulnerability in IBM Content Collector for Email

Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...

Security Bulletin: OpenSource Apache Struts vulnerabilities in IBM Content Collector for File Systems

Summary Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against unintended remote operations against components on server memory by the ActionForm instance. An attacker could exploit this vulnerability to execute arbitrary code...

Security Bulletin:Cross-site scripting vulnerability in WebSphere Application Server admin console in IBM Content Collector for Email

Summary IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details...

Security Bulletin:Cross-site scripting vulnerability in WebSphere Application Server admin console in IBM Content Collector for Email

Summary IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details...

Security Bulletin: WebSphere Application Server vulnerability in IBM Content Collector for Email

Summary IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources in IBM Content Collector for Email. Vulnerability Details CVEID: CVE-2016-8919 DESCRIPTION: IBM WebSphere...

Security Bulletin: WebSphere Application Server vulnerability with malformed SOAP requests in IBM Content Collector for Email

Summary WebSphere Application Server vulnerability with malformed SOAP requests Vulnerability Details CVEID: CVE-2016-9736 DESCRIPTION: IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. CVSS Base Score: 3.7 CVSS Temporal...

Security Bulletin: GSKit Sweet32: Birthday attacks in IBM Content Collector for Microsoft SharePoint

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: GSKit Sweet32: Birthday attacks in Content Collector for IBM Connections

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: GSKit Sweet32: Birthday attacks in IBM Content Collector for File Systems

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: GSKit Sweet32: Birthday attacks in IBM Content Collector for Email

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Content Collector for SAP Applications ( CVE-2016-5597)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6 and 7 that is used by IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Content Collector for SAP Applications (CVE-2016-5597)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6 and 7 that is used by IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An...