Security Bulletin: Privilege escalation in IBM® Db2® tool db2cacpy (CVE-2018-1685).

Summary A vulnerability exists in db2cacpy which could expose sensitive information to user. Vulnerability Details CVEID: CVE-2018-1685 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server contains a vulnerability in db2cacpy that could allow a local user to read any file ...

CVE-2018-15657

An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter...

CVE-2018-14992

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains a pre-installed platform app with a package name of com.asus.dm versionCode=1510500200, versionName=1.5.0.40171122 has an exposed interface...

Security Bulletin: IBM® Db2®'s RCAC rules are not being enforced by CTAS sub-select statements (CVE-2018-1857).

Summary Db2's Row and Column Access Control RCAC rules are not being enforced when creating a table using AS CTAS sub-select statements. RCAC is not enforced when Db2 uses the 'WITH DATA' clause to select and insert data into the target table. Vulnerability Details CVEID: CVE-2018-1857 DESCRIPTIO...

Security Bulletin: Multiple vulnerabilities affect db2exmig and db2exfmt tools shipped with IBM® Db2® (CVE-2018-1544, CVE-2018-1565)

Summary The Db2 tools db2exmig and db2exfmt are affected by a buffer overflow vulnerability. As installed these tools do not run with elevated privileges setuid and when called directly the vulnerability does not lead to privilege escalation. However, if a customer’s own application or script run...

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow (CVE-2018-1459).

Summary Db2's rah.exe is vulnerable to a stack-based buffer overflow, caused by improper bounds checking, which could lead an attacker to execute arbitrary code. Vulnerability Details CVEID: CVE-2018-1459 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable t...

Security Bulletin: Privilege escalation vulnerability affects IBM® DB2® LUW (CVE-2017-1134)

Summary DB2 LUW is affected by a vulnerability in IBM Tivoli System Automation for Multiplatforms TSAMP. Vulnerability Details A privilege escalation vulnerability affects IBM Reliable Scalable Cluster Technology shipped with IBM Tivoli System Automation for Multiplatforms. CVEID: CVE-2017-1134...

Security Bulletin: IBM® DB2® LUW contains a denial of service vulnerability in which a malformated DRDA message may cause the DB2 server to terminate abnormally (CVE-2016-0211)

Summary IBM DB2 LUW contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted DRDA message and cause DB2 server to terminate abnormally. Vulnerability Details CVEID: CVE-2016-0211 DESCRIPTION: IBM DB2 LUW contains ...

Security Bulletin: Vulnerabilities in GSKit affect IBM Data Server Client and Driver packages(CVE-2016-0201, CVE-2015-7420 and CVE-2015-7421)

Summary Vulnerabilities have been addressed in the GSKit component of IBM Data Server Client and Driver packages Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit th...

Security Bulletin: Local escalation of privilege vulnerability in IBM® DB2® LUW (CVE-2015-1947)

Summary A vulnerability in IBM DB2 for Linux, Unix and Windows could allow a local user to gain elevated privilege. Vulnerability Details CVEID: CVE-2015-1947 DESCRIPTION: IBM DB2 is vulnerable to a privilege escalation due to improper build of binaries CVSS Base Score: 7.2 CVSS Temporal Score: S...

Security Bulletin: Denial of Service Vulnerability in DB2's XSLT Library. (CVE-2013-5466)

Summary A vulnerability in IBM DB2's XSLT library could allow a remote, authenticated user to cause server denial of service. Vulnerability Details CVE ID: CVE-2013-5466 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability which could allow a remote, authenticated user ...

Security Bulletin: IBM OpenPages GRC Platform has addressed insecure object reference (CVE-2017-1148)

Summary IBM OpenPages GRC Platform with OpenPages Loss Event Entry LEE application addressed potential security exposure due to insecure object reference. Vulnerability Details CVEID: CVE-2017-1148 DESCRIPTION: IBM OpenPages GRC Platform with OpenPages Loss Event Entry LEE application could allow...

Security Bulletin: IBM OpenPages GRC Platform has addressed Cross-site Request Forgery (CVE-2017-1300)

Summary IBM OpenPages GRC Platform has addressed potential security exposure due to Cross-site request forgery. Vulnerability Details CVEID: CVE-2017-1300 DESCRIPTION: IBM OpenPages GRC Platform is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and...

Security Bulletin: A security vulnerability has been identified in IBM Cognos shipped with IBM OpenPages GRC Platform (CVE-2016-0234)

Summary IBM OpenPages GRC Platform has a potential security exposure, due to an issue found in bundled IBM Cognos Business Intelligence. Vulnerability Details CVEID: CVE-2016-0234 DESCRIPTION: IBM OpenPages GRC Platform could allow a local user to obtain sensitive information when a previous user...

Security Bulletin: IBM OpenPages GRC Platform HTML injection (CVE-2016-3049)

Summary IBM OpenPages GRC Platform has a potential security exposure due to a HTML injection vulnerability. Vulnerability Details CVEID: CVE-2016-3049 DESCRIPTION: IBM OpenPages GRC Platform is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed,...

Security Bulletin: Vulnerabilities in OpenSource Apache Tomcat affecting IBM Algo One - Core (CVE-2015-5345 and CVE-2015-5346)

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an error when accessing a protected directory. By redirecting to the URL, an attacker could exploit this vulnerability to determine the presence of a directory affecting IBM Algo One - Core. Vulnerabili...

Security Bulletin: Vulnerability OpenSource Apache Tomcat affects IBM Algorithmics Algo Risk Application - CVE-2015-5345 CVE-2015-5346 CVE-2016-0706 CVE-2016-0714 CVE-2016-0763

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an error when accessing a protected directory. By redirecting to the URL, an attacker could exploit this vulnerability to determine the presence of a directory that affects IBM Algorithmics Algo Risk...

Security Bulletin: Vulnerability in Web Browser XSS Protection affects IBM Algo One - Algo Risk Application (CVE-2016-0390)

Summary Vulnerability in Web Browser XSS Protection Vulnerability Details CVEID: CVE-2016-0390 DESCRIPTION: IBM Algo One - Algo Risk Application is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a...

Security Bulletin: Vulnerability in Apache Commons affects IBM Algo Credit Limits (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Algo Credit Limits. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by...

Security Bulletin: Vulnerability in SSLv3 affects Algo Credit Administrator (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Algo Credit Administrator Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...