Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-7575, CVE-2016-0475, CVE-2016-0466)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6, 7, and 8, that are used by FileNet Content Manager, IBM Content Foundation and FileNet BPM. These issues were disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability...

Security Bulletin: A vulnerability in the GSKit component of Content Manager OnDemand for Multiplatforms (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of Content Manager OnDemand for Multiplatforms. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit...

Security Bulletin: Vulnerability in Apache Commons (CVE-2015-7450), affects FileNet Content Manager and IBM Content Foundation

Summary An Apache Commons Collections vulnerability for handling Java object deserialization is addressed in the FileNet Content Manager and IBM Content Foundation products. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute...

Security Bulletin: Four vulnerabilities exist in IBM FileNet Content Manager and IBM Content Foundation (CVE-2015-4809, CVE-2015-4811, CVE-2015-4877, CVE-2015-4878)

Summary There are four security vulnerabilities in the Oracle Outside In Technology OIT software used in the IBM FileNet Content Manager and IBM Content Foundation products. See the individual descriptions below for details. These issues are addressed in the OIT October 2015 Critical Patch Update...

Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime Environment (JRE) affect the FileNet Content Manager, IBM Content Foundation and FileNet BPM products (CVE-2015-4872, CVE-2015-5006, CVE-2015-4911, CVE-2015-4893, CVE-2015-4803)

Summary There are multiple vulnerabilities in the IBM Runtime Environment Java Technology Edition used by the FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager products. These issues are addressed in Version 1.6.0 SR16 FP15, Version 1.7.0 SR9 FP20, and Java 1.8....

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931)

Summary There are multiple vulnerabilities in the IBM Runtime Environment Java Technology Edition used in the FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager products. These issues are addressed in Version 1.6.0 SR16 FP7, Version 1.7.0 SR9 FP10, and 1.8.0 SR1...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916)

Summary There are multiple vulnerabilities in the IBM Runtime Environment Java Technology Edition used by FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager. These issues are addressed in Version 1.6.0 SR16 FP4 which is part of the IBM Java SDK April 2015 update...

Security Bulletin: IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2015-1888)

Summary IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-1888 IBM Content Navigator is vulnerable to cross-site scripting. The vulnerability is caused by improper validation of user...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM FileNet Content Manager and IBM Content Foundation (CVE-2015-0138)

Summary The Factoring Attack on RSA-EXPORT keys "FREAK", TLS/SSL client and server security vulnerability affects IBM® SDK Java™ Technology Edition, Version 1.6.0 SR16 FP3 and earlier. TLS/SSL is a configurable option in IBM FileNet Content Manager and IBM FileNet BPM products to provide secure...

Security Bulletin: Three vulnerabilities in IBM FileNet Content Manager, IBM Content Foundation and IBM FileNet BPM (CVE-2014-6593, CVE-2015-0410, and CVE-20150-0383)

Summary Three security vulnerabilities exist in IBM FileNet Content Manager, IBM Content Foundation and IBM FileNet BPM. See the individual description for the details. Vulnerability Details CVEID: CVE-2014-6593 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and JRockit related to th...

Security Bulletin: IBM Content Navigator affected by reflected cross-site scripting issue <CVE-2014-8911>

Summary Reflected cross-site scripting issue using the "Accept-Language" header parameter affects IBM Content Navigator. Vulnerability Details CVEID: CVE-2014-8911 DESCRIPTION: IBM Content Navigator is vulnerable to reflected cross-site scripting, caused by improper validation of user supplied...

Security Bulletin: Vulnerability in SSLv3 affects IBM Content Navigator (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in the Knowledge Center for IBM Content Navigator V2.0.3. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote...

Security Bulletin: Open Source Apache Xalan-Java reported in April X-Force Report in IBM Content Navigator

Summary Apache Xalan-Java could allow a remote attacker to bypass security restrictions, caused by the improper handling of output properties. An attacker could exploit this vulnerability to bypass the secure processing feature to load arbitrary restricted classes. Vulnerability Details Apache...

Security Bulletin: Apache Commons FileUpload is vulnerable to a denial of service (CVEID: CVE-2014-0050) in IBM Content Manager Services for Lotus Quickr

Summary Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header for multipart requests. By sending a specially-crafted request, an attacker could exploit this vulnerability to cause the application to enter into an...

Security Bulletin: ClassLoader manipulation with Apache Struts affecting IBM Records Manager, IBM Content Manager Records Enabler and WebSphere Application Server shipped with IBM Records Manager (CVE-2014-0114)

Summary There is a ClassLoader manipulation vulnerability in Apache Struts that is used by IBM Records Manager and IBM Content Manager Records Enabler. The security vulnerability has also been identified in WebSphere Application Server shipped with IBM Records Manager. Vulnerability Details CVEID...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Content Navigator

Summary Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVE-2014-0114 in IBM Content Navigator Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVSS Base Score: 7.5 CVSS Temporal Scor...

Security Bulletin: Improper authorization by non-admin user in IBM Content Navigator (CVE-2014-0858)

Summary Using 3rd party tools, a non-admin user can modify the URL action so that instead of a getAction, the user can perform a deleteAction against the configuration database. Vulnerability Details CVEID: CVE-2014-0858 DESCRIPTION: Improper authorization by non-admin user CVSS Base Score: 3.5...

Security Bulletin: Reflected Cross-Site Scripting Vulnerability in IBM Content Navigator (CVE-2014-0874)

Summary Reflected Cross-Site Scripting Vulnerability in IBM Content Navigator Vulnerability Details CVEID: CVE-2014-0874 DESCRIPTION: Arbitrary characters inserted into request parameters are not properly encoded. Not encoding user-supplied input may expose a web application to cross-site...

Security Bulletin: IBM FileNet P8 Platform Documentation Installable Info Center cross-site scripting vulnerability (CVE-2013-6746)

Summary A cross-site scripting vulnerability has been identified in the IBM FileNet P8 Platform Documentation Installable Info Center that is shipped with the IBM FileNet Business Process Manager, IBM FileNet Content Manager, and IBM Case Foundation. Vulnerability Details The following components...