Security Bulletin: Java specific SLOTH - Weak MD5 Signature Hash

Summary There is vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6, 7, and 8, that are used by FileNet Content Manager, IBM Content Foundation and FileNet BPM. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and include the vulnerabilit...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-7575, CVE-2016-0475, CVE-2016-0466)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6, 7, and 8, that are used by FileNet Content Manager, IBM Content Foundation and FileNet BPM. These issues were disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability...

Security Bulletin: Multiple Security Vulnerabilities in IBM Java Runtime affect IBM RLKS Administration and Reporting Tool Admin and Agent

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6.0.16.0 and 7.0.9.10, that are used by IBM Rational License Key Server Administration and Reporting Tool Admin and Agent. These issues were disclosed as part of the IBM Java Runtime updates ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Method Composer (CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 that is used by Rational Method Composer. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”. Vulnerability Detail...

Security Bulletin: A vulnerability in the GSKit component of IBM Rational RequisitePro (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of Rational RequisitePro. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to...

Security Bulletin: A vulnerability in the GSKit component of IBM Security Access Manager for Mobile (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Security Access Manager for Mobile. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this...

Security Bulletin: A security vulnerability has been identified in the GSKit component of IBM Security Access Manager for Web (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Security Access Manager for Web. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this...

Security Bulletin: Vulnerabilities in the GSKit component of Transformation Extender (CVE-2016-0201, CVE-2015-7421, CVE-2015-7420)

Summary Vulnerabilities have been addressed in the GSKit component of Transformation Extender. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Initiate Master Data Service (CVE-2015-4872, CVE-2016-0466, CVE-2015-7575, CVE-2016-0448)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM Initiate Master Data Service. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”. Vulnerabilit...

Security Bulletin: Vulnerabilities in GSKit affect IBM Data Server Client and Driver packages(CVE-2016-0201, CVE-2015-7420 and CVE-2015-7421)

Summary Vulnerabilities have been addressed in the GSKit component of IBM Data Server Client and Driver packages Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit th...

Security Bulletin: A vulnerability in the GSKit component of Cognos Analytics (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of Cognos Analytics Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain...

Security Bulletin: A vulnerability in the GSKit component of IBM Cognos Business Intelligence Server (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Cognos Business Intelligence Server . Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this...

Security Bulletin: A vulnerability in the GSKit component of IBM Cognos Controller (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Cognos Controller. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to...

Security Bulletin:A vulnerability in IBM Java SDK affects IBM Workload Deployer. (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition Version 6 that is used by IBM Workload Deployer. The issue was disclosed as part of the IBM Java SDK updates in January 2016 and this vulnerability is commonly referred to as “SLOTH”. Vulnerability Details CVEID: CVE-2015-7575...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer and WebSphere Integration Developer (CVE-2016-0475, CVE-2016-0466, CVE-2015-7575, CVE-2016-0448)

Summary There are multiple vulnerabilities in IBM SDK Java™ Technology Edition that is used by IBM Integration Designer and WebSphere Integration Developer. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM API Management (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM API Management. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...

Security Bulletin: A vulnerability in the GSKit component of IBM DataPower Gateways (CVE-2016-0201)

Summary IBM DataPower Gateways uses GSKit in certain modules - namely MQ, ISAM/TAM, JMS. A vulnerability has been addressed in the GSKit component of IBM DataPower Gateways. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive...

Security Bulletin: A vulnerability in the GSKit component of IBM MQ Appliance (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM MQ Appliance Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain...

jsonwebtoken node module bypass authentication vulnerability

The jsonwebtoken node module is a JSON Web Taken JWT implementation for node.js. A security vulnerability exists in the jsonwebtoken node module prior to version 4.2.2, which stems from the program using the same signature to validate two types of tokens. An attacker could use this vulnerability ...

Code injection

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks...