Security Bulletin: Vulnerabilities in tomcat affect IBM SmartCloud Provisioning 2.1 for Software Virtual Appliance (CVE-2013-4590, CVE-2014-0119)

Summary Vulnerabilities in tomcat6 packages affect IBM SmartCloud Provisioning 2.1 for Provided Software Virtual Appliance CVE-2013-4590, CVE-2014-0119. Vulnerability Details CVEID: CVE-2013-4590 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a...

Security Bulletin: Vulnerability in Apache POI affects IBM Maximo Asset Management (CVE-2017-12626)

Summary Apache POI used by IBM Maximo Asset Management is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when processing XML data. By using a specially-crafted OOXML file, a remote attacker could exploit this vulnerability to consume all available CPU...

Security Bulletin: IBM Tivoli Netcool Impact is affected by multiple vulnerabilities in IBM Tivoli Integrated Portal (TIP)

Summary IBM Tivoli Netcool Impact has addressed the following vulnerabilities in IBM Tivoli Integrated Portal TIP . Vulnerability Details CVEID: CVE-2015-5254 DESCRIPTION: Apache ActiveMQ could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the...

Security Bulletin: IBM Tivoli Netcool Impact is affected by an Open Source Apache Poi vulnerability (CVE-2017-5644)

Summary IBM Tivoli Netcool Impact has addressed the following vulnerability Open Source Apache Poi vulnerability CVE-2017-5644. Vulnerability Details CVEID: CVE-2017-5644 DESCRIPTION: Apache POI is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when...

Security Bulletin: Vulnerability in Apache POI affects IBM Maximo Asset Management (CVE-2017-5644)

Summary Apache POI used by IBM Maximo Asset Management is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when processing XML data. By using a specially-crafted OOXML file, a remote attacker could exploit this vulnerability to consume all available CPU...

Security Bulletin: IBM Tivoli Common Reporting (TCR) 2017Q2 Security Updater: TCR, a part of IBM Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities

Summary Fixes of Cognos Business Intelligence are provided as part of TCR fixes This bulletin addresses several security vulnerabilities. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 and the IBM® Runtime Environment Java™ Technology Edition,...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Composite Application Manager for Transactions (Multiple CVEs)

Summary There are multiple vulnerabilities in IBM Java Runtime, Version 6.0, 7.0 and 8.0 that is used by IBM Tivoli Composite Application Manager for Transactions. These issues were disclosed as part of the IBM Java SDK updates in April 2017. Vulnerability Details CVEID: CVE-2017-3514 DESCRIPTION...

Security Bulletin: Pivotal Spring Framework vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM)

Summary Multiple vulnerabilities have been identified in the OpenSource/Pivotal Spring Framework version that is embeddded in IBM Tivoli Application Dependency Discovery Manager TADDM thus requiring an upgrade to Spring Framework version 3.2.13. Vulnerability Details CVEID: CVE-2014-3578...

Security Bulletin: OpenSource Apache Taglibs Vulnerability in FastBack for Workstations Central Administration Console (CVE-2015-0254)

Summary There is a vulnerability in FastBack for Workstations Central Administration Console in the underlying IBM WebSphere Application Server with the Apache Standard Taglibs which could allow a remote attacker the ability to execute arbitrary code on the system . Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in Apache Standard Taglibs affects IBM WebSphere Application Server (CVE-2015-0254) shipped with IBM Tivoli Netcool Performance Manager

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: IBM Tivoli Monitoring embedded WebSphere Application Server (CVE-2016-3426, CVE-2016-3427, CVE-2016-0306, CVE-2015-0254)

Summary The following security issues have been identified in WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. Vulnerability Details CVEID: CVE-2016-3427 DESCRIPTION: An unspecified vulnerability related to the JMX component has complete confidentiality...

Security Bulletin: Jazz for Service Management is affected by Open Source Apache ActiveMQ vulnerability - Reported in 02/05/2015 X-Force Report

Summary Jazz for Service Management JazzSM bundles the Open Source Apache ActiveMQ jar files for use by the underlying DASH/TWL Component and a vulnerability was reported related to the jar used Vulnerability Details CVEID: CVE-2014-3600 DESCRIPTION: Apache ActiveMQ could allow a remote attacker ...

Security Bulletin: Vulnerability in Apache Taglibs affects IBM Cúram Social Program Management (CVE-2015-0254)

Summary IBM Cúram Social Program Management uses the Apache Taglibs Library. Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2015-0254...

Security Bulletin: Fix available for Vulnerability in XML External Entity Injection (XXE) affecting IBM Cúram Social Program Management (CVE-2016-6111)

Summary IBM Cúram Social Program Management is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could use the vulnerability to expose highly sensitive information, or to use all available memory resources...

Security Bulletin: Vulnerability in Castor library affects IBM Cúram(CVE-2014-3004)

Summary IBM Cúram is shipped with a third party library called Castor, which is vulnerable to an XML External Entity Injection XXE error. Vulnerability Details CVEID: CVE-2014-3004 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External...

Security Bulletin: IBM Content Navigator is affected by an XML External Entity Injection (XXE) vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1364 DESCRIPTION: IBM Content Navigator is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU affect IBM Content Collector for SAP Applications

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID:...

Security Bulletin: OpenSource Apache Taglibs Vulnerability affects Atlas Policy Suite (CVE-2015-0254)

Summary Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to...

Security Bulletin: A Vulnerability in OpenSource Apache Taglibs Vulnerability affect Content Integrator (CVE-2015-0254)

Summary A Vulnerability in OpenSource Apache Taglibs Vulnerability affect Content Integrator. Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. By sending specially-crafted...

Security Bulletin:Open Source Apache Poi Vulnerability in IBM eDiscovery Manager

Summary Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when XLSX2CSV example uses Java's XML components to parse OpenXML files. An attacker could exploit this vulnerability using an XML document containing an external...