Security Bulletin: Multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 1.5, 1.6 and 1.7 affect IBM SPSS Collaboration and Deployment Services: (CVE-2015-0138, CVE-2014-6593, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 1.5, 1.6 and 1.7 that are used by IBM SPSS Collaboration and Deployment Services. These issues were disclosed as part of the IBM Java SDK updates in January 2015 and the “FREAK: Factoring Attack on RSA-EXPORT...

Security Bulletin: Vulnerability in RC4 stream cipher in IBM SDK Java Technology Edition, Versions 1.6 and 1.7 affects IBM SPSS Collaboration and Deployment Services (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM SPSS Collaboration and Deployment Services. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An...

Security Bulletin: A security vulnerability has been identified in multiple products shipped with IBM Predictive Maintenance and Quality: CVE-2015-8126, CVE-2016-0494, CVE-2016-0483, CVE-2015-8472, CVE-2016-0475, CVE-2016-0466, CVE-2016-0402, CVE-2015-757

Summary IBM WebSphere Application Server, IBM DB2, IBM SPSS Modeler, IBM Cognos Business Intelligence Server, IBM SPSS Collaboration and Deployment Services,IBM Integration Bus, IBM ILOG CPLEX Optimization Studio, IBM SPSS Analytic Server and IBM SPSS Modeler are shipped as components of IBM...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, IBM HTTP Server, IBM DB2, IBM SPSS Modeler, IBM Cognos Business Intelligence Server, IBM SPSS Collaboration and Deployment Services and IBM WebSphere MQ s

Summary IBM WebSphere Application Server, IBM HTTP Server, IBM DB2, IBM SPSS Modeler, IBM Cognos Business Intelligence Server, IBM SPSS Collaboration and Deployment Services and IBM WebSphere MQ are shipped as components of IBM Predictive Maintenance and Quality. Information about a security...

Cross site request forgery (csrf)

The server in IBM SPSS Collaboration and Deployment Services 4.x before 4.2.1.3 IF3, 5.x before 5.0 FP3, and 6.x before 6.0 IF1 allows remote attackers to read arbitrary files via an unspecified HTTP request...

CVE-2013-4043

The server in IBM SPSS Collaboration and Deployment Services 4.x before 4.2.1.3 IF3, 5.x before 5.0 FP3, and 6.x before 6.0 IF1 allows remote attackers to read arbitrary files via an unspecified HTTP request...

CVE-2013-4043

IBM SPSS Collaboration and Deployment Services has an unauthenticated file-disclosure vulnerability (CVE-2013-4043) affecting 4.x before 4.2.1.3 IF3, 5.x before 5.0 FP3, and 6.x before 6.0 IF1. A remote attacker can issue an HTTP request to retrieve arbitrary server files. The IBM Security Bullet...

CVE-2013-4045

Cross-site scripting XSS vulnerability in the Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4046

Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4069

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Cross site request forgery (csrf)

IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request...

Open redirect

Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4045

IBM SPSS Collaboration and Deployment Services is affected by CVE-2013-4045: a cross-site scripting vulnerability in the Deployment Portal, impacting SPSS C&D Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3. The root cause is a script/HTML injection vulnerability in the Portal application th...

CVE-2013-4070

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors...

CVE-2013-4069

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2013-4069

IBM SPSS Collaboration and Deployment Services is affected by CVE-2013-4069. The Deployment Portal mishandles XML external entities, enabling remote attackers to read arbitrary files via an XML external entity declaration with an entity reference. Affected versions: 4.2.1 before 4.2.1.3 IF3 and 5...

CVE-2013-4070

IBM SPSS Collaboration and Deployment Services contains CVE-2013-4070 in the Portal application, affecting 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3. The issue allows remote attackers to discover an internal password via unspecified vectors. Remediation/fixes are available: SPSS C&D Services 4....

CVE-2013-4044

IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request...

CVE-2013-4046

Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4046

Summary: A known open-redirect vulnerability (CVE-2013-4046) exists in IBM SPSS Collaboration and Deployment Services. It affects versions 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 and could enable redirects to arbitrary sites (phishing risk). Technical details confirmed in connected documents:...