Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to zlib (CVE-2018-25032)

Summary IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to zlib. The fix includes zlib 1.2.12. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By...

Security Bulletin: IBM TS3500 Tape Library Update for Security Vulnerability in Web User Interface (CVE-2012-5767)

Abstract Download an update to the TS3500 Tape Library which contains a fix for a security vulnerability that could allow unauthorized access to restricted actions. Content DESCRIPTION: An authorized user of the TS3500 web user interface could exploit a vulnerability that would give that user a...

Security Bulletin: IBM TS3400 Tape Library update for security vulnerabilities in OpenSSL (CVE-2012-2333)

Abstract Download an update to the TS3400 Tape Library, which contains a newer version of OpenSSL that fixes certain security vulnerabilities that were present in older versions of OpenSSL. Content DESCRIPTION: OpenSSL versions prior to 1.0.0 do not follow best security practices and need to be...

Security Bulletin: Open redirect and cross-site scripting vulnerabilities in the InfoSphere Streams help system (CVE-2012-2159, CVE-2012-2161)

Abstract Open redirect vulnerability in IBM Eclipse Help System IEHS, as used in IBM InfoSphere Streams Information Center 2.0.0.3 or 2.0.0.4 and InfoSphere Streams Studio 2.0 or later, allows potential redirection of users to arbitrary web sites. Cross-site scripting vulnerability in IBM Eclipse...

Security Bulletin: TXSeries for Multiplatforms V7.1 : Security vulnerability in using GSKit 8 version with IBM TXSeries for Multiplatforms Version 7.1 (CVE-2013-6329)

Abstract Vulnerabilities in relation to SSL/TLS Handshake Processing related to the Session Resumption when using SSLV2 of GSKit 8 with TXSeries for Multiplatforms V7.1 have been addressed Content VULNERABILITY DETAILS: CVEID: CVE-2013-6329 DESCRIPTION: A SSLV2 ClientHello that successfully resum...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2016-0399)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the a specially-crafted URL to execute script in a victim's Web browser within the security context of the...

Security Bulletin: IBM Maximo Asset Management could allow an attacker to cause a runtime error using a specially crafted HTTP request, that could disclose sensitive information (CVE-2016-5987)

Summary IBM Maximo Asset Management could allow an attacker to cause a runtime error using a specially crafted HTTP request, that could disclose sensitive information. Vulnerability Details CVEID: CVE-2016-5987 DESCRIPTION: IBM Maximo Asset Management could allow an attacker to cause a runtime...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow a user to log in with an expired password (CVE-2015-5017)

Summary IBM Maximo Asset Management contains a vulnerability which could allow a user to log into the system with an expired password. This vulnerability could allow a local attacker to obtain sensitive information or compromise the integrity of the system. The vulnerability affects Maximo Asset...

Security Bulletin: IBM Maximo Asset Management contains a misconfiguration that could allow an authenticated user to view backup and debug application files which could contain sensitive information (CVE-2015-4965)

Summary IBM Maximo Asset Management configuration allows an authenticated user to view backup and debug application files. This vulnerability could allow a local attacker to obtain sensitive information. The vulnerability affects Maximo Asset Management, Maximo Asset Management Essentials, Maximo...

Security Bulletin: Rational Asset Analyzer is vulnerable to an Information disclosure (CVE-2022-22393)

Summary IBM WebSphere Application Server Liberty used by Rational Asset Analyzer could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. This has been addressed. Vulnerability Details CVEID:CVE-2022-22393...

Security Bulletin: Rational Asset analyzer is vulnerable to spoofing due to Eclipse Paho (CVE-2019-11777)

Summary IBM WebSphere Application Server Liberty used by Rational Asset Analyzer is vulnerable to spoofing in the Eclipse Paho library with the rtcomm-1.0 or rtcommGateway-1.0 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2019-11777 DESCRIPTION: Eclipse Paho Java clien...

Security Bulletin: Rational Asset Analyzer is vulnerable to Identity Spoofing (CVE-2022-22475)

Summary IBM WebSphere Application Server Liberty used by Rational Asset analyzer is vulnerable to identity spoofing with the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0 or appSecurity-4.0 feature enabled. This has been addressed. Vulnerability Details CVEID:CVE-2022-22475 DESCRIPTION: IBM...

Security Bulletin: IBM Connect:Direct Web Services vulnerable to remote security bypass due to PostgreSQL (CVE-2022-1552)

Summary IBM Sterling Connect:Direct Web Service uses PostgreSQL. IBM Sterling Connect:Direct Web Services has addressed an applicable issue from PostgreSQL. Vulnerability Details CVEID:CVE-2022-1552 DESCRIPTION: PostgreSQL remote authenticated attacker to bypass security restrictions, caused by a...

Security Bulletin: IBM Netezza for Cloud Pak for Data is vulnerable to denial of service due to Golang net package (CVE-2021-33194)

Summary Golang packages are used in IBM Netezza for Cloud Pak for Data. Golang net sub module is vulnerable to denial of service. Vulnerability is addressed by upgrading Golang to version 1.17. Vulnerability Details CVEID:CVE-2021-33194 DESCRIPTION: Golang Go is vulnerable to a denial of service,...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Information Disclosure (CVE-2020-4463)

Summary IBM Maximo Asset Management is vulnerable to Information Disclosure. Vulnerability Details CVEID:CVE-2020-4463 DESCRIPTION: IBM Maximo Asset Management is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability...

Security Bulletin: Vulnerability in Java SE related to the JSSE component affects DB2 Recovery Expert for Linux, Unix and Windows

Summary DB2 Recovery Expert for Linux, UNIX and Windows has addressed the vulnerability CVE-2021-35550. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to remote SQL execution due to PostgreSQL (CVE-2022-1552)

Summary There is a vulnerability in PostgreSQL used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-1552 DESCRIPTION: PostgreSQL remote authenticated attacker to bypass...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to sensitive information disclosure due to PostgreSQL (CVE-2021-3677)

Summary There is a vulnerability in PostgreSQL used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3677 DESCRIPTION: Postgresql could allow a remote authenticated...

Security Bulletin: Enterprise Content Management System Monitor is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Enterprise Content Management System Monitor is vulnerable to arbitrary code execution due to Apache Log4j CVE-2021-45105 and CVE-2021-45046. Apache Log4j is used by Enterprise Content Management System Monitor as part of its logging infrastructure.The fix includes Apache Log4j v2.17.1...

Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-22436)

Summary IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2022-22436 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows...