KLA10511 Multiple vulnerabilities in Oracle products

An unspecified vulnerabilities were found in Oracle products. By exploiting this vulnerability malicious users can affect integrity, confidentiality and availability. This vulnerability can be exploited remotely via an unknown vectors related to 2D, Beans, CORBA, Deployment, Hotspot, Install, JAA...

CVE-2013-4044

IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request...

CVE-2013-4045

Cross-site scripting XSS vulnerability in the Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4046

Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4069

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2013-4070

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors...

Cross site request forgery (csrf)

IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request...

Open redirect

Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4069

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2013-4070

The Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to discover an internal password via unspecified vectors...

CVE-2013-4044

IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote authenticated users to read application log files via a direct HTTP request...

CVE-2013-4045

IBM SPSS Collaboration and Deployment Services is affected by CVE-2013-4045: a cross-site scripting vulnerability in the Deployment Portal, impacting SPSS C&D Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3. The root cause is a script/HTML injection vulnerability in the Portal application th...

CVE-2013-4070

IBM SPSS Collaboration and Deployment Services contains CVE-2013-4070 in the Portal application, affecting 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3. The issue allows remote attackers to discover an internal password via unspecified vectors. Remediation/fixes are available: SPSS C&D Services 4....

CVE-2013-4069

IBM SPSS Collaboration and Deployment Services is affected by CVE-2013-4069. The Deployment Portal mishandles XML external entities, enabling remote attackers to read arbitrary files via an XML external entity declaration with an entity reference. Affected versions: 4.2.1 before 4.2.1.3 IF3 and 5...

CVE-2013-4046

Open redirect vulnerability in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4046

Summary: A known open-redirect vulnerability (CVE-2013-4046) exists in IBM SPSS Collaboration and Deployment Services. It affects versions 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 and could enable redirects to arbitrary sites (phishing risk). Technical details confirmed in connected documents:...

CVE-2013-4044

IBM SPSS Collaboration and Deployment Services is affected by CVE-2013-4044. The issue allows an authenticated remote attacker to read application log files by issuing a direct HTTP request. Affected versions include 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3. The IBM bulletin documents the impa...

CVE-2013-4045

Cross-site scripting XSS vulnerability in the Portal application in IBM SPSS Collaboration and Deployment Services 4.2.1 before 4.2.1.3 IF3 and 5.0 before FP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Assessing risk for the December 2013 security updates

Today we released eleven security bulletins addressing 24 CVE’s. Five bulletins have a maximum severity rating of Critical while the other six have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

CVE-2013-5455

IBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify virtual-system deployment via deployer.virtualsystems CLI commands, as demonstrated by a deletion using a deployer.virtualsystems.delete command...