Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise V11 ( CVE-2020-8244)

Summary IBM App Connect Enterprise V11 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below Vulnerability Details CVEID: CVE-2020-8244 DESCRIPTION: Node.js bl module could allow a remote attacker to obtain sensitive information,...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager (CVE-2019-2601).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2, which was disclosed in the Oracle January 2020 Critical Patch Update, but deferred until the release associated with the Oracle Oct 2020...

Security Bulletin: IBM® DB2® for LUW is affected by the OpenSSL vulnerability CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-3470 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the implementation of anonymous ECDH ciphersuites. A remote...

Security Bulletin: Cookie Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4763)

Summary IBM Sterling File Gateway has addressed a cookie vulnerability. Vulnerability Details CVEID: CVE-2020-4763 DESCRIPTION: IBM Sterling File Gateway does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:...

Security Bulletin: XSS Vulnerability Affects IBM Sterling B2B Integrator (CVE-2020-4705)

Summary IBM Sterling B2B Integrator has addressed an XSS vulnerability. Vulnerability Details CVEID: CVE-2020-4705 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Security Bulletin: Permisson Control Vulnerability Affects IBM Sterling B2B Integrator (CVE-2020-4700)

Summary IBM Sterling B2B Integrator has addressed a permisson control vulnerability. Vulnerability Details CVEID: CVE-2020-4700 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow an authenticated user belonging to a specific user group to create a user or group with...

Security Bulletin: Information Disclosure Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4476)

Summary IBM Sterling File Gateway has addressed a information dislcoure vulnerability. Vulnerability Details CVEID: CVE-2020-4476 DESCRIPTION: IBM Sterling File Gateway could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser...

Security Bulletin: Vulnerability in Java SE libraries could allow unauthenticated attacker to cause denial of service

Summary An unspecified vulnerability in Java SE related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Vulnerability in HTTPD affects IBM Integrated Analytics System

Summary Redhat provided HTTPD is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-15715 DESCRIPTION: Apache HTTPD could allow a remote attacker to bypass security restrictions, caused by the FilesMatch...

Security Bulletin: Vulnerability in httpd affects IBM Integrated Analytics System

Summary Redhat provided httpd is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-15710 DESCRIPTION: Apache HTTPD is vulnerable to a denial of service, caused by an out-of-bounds memory write error. By...

Security Bulletin: Vulnerability in NTP affects IBM Integrated Analytics System

Summary Redhat provided NTP is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-11868 DESCRIPTION: NTP is vulnerable to a denial of service, caused by a flaw in ntpd. By sending a server mode packet wi...

Security Bulletin: Vulnerability in Oracle Java SE and libjpeg affects IBM Integrated Analytics System

Summary Redhat provided Oracle Java SE and libjpeg package is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-11212 DESCRIPTION: libjpeg is vulnerable to a denial of service, caused by divide-by-zero...

Security Bulletin: IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on the system (CVE-2020-4650)

Summary IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on the system. Vulnerability Details CVEID: CVE-2020-4650 DESCRIPTION: IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on...

Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Netcool Configuration Manager.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Netcool Configuration Manager IP Edition v6.4.1 and v6.4.2, which were disclosed in the Oracle Jul 2020 Critical Patch Update. Vulnerability Details Refer to the security...

Security Bulletin: IBM i2 Analyst's Notebook Vulnerable to Memory Corruption Vulnerabilities

Summary IBM i2 Analyst's Notebook and Analyst's Notebook Premium addressed several memory corruption vulnerabilities. Vulnerability Details CVEID: CVE-2020-4724 DESCRIPTION: IBM i2 Analyst's Notebook could allow a local attacker to execute arbitrary code on the system, caused by a memory...

Security Bulletin: Cross-Site Scripting Security Vulnerability Affects IBM Sterling B2B Integrator Standard Edition ( CVE-2020-4564)

Summary IBM Sterling B2B Integrator Standard Edition has addressed XSS security vulnerability. Vulnerability Details CVEID: CVE-2020-4564 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition and IBM Sterling File Gateway are vulnerable to cross-site scripting. This vulnerability allows users...

Security Bulletin: Security vulnerabilities have been fixed in IBM Security Access Manager and IBM Security Verify Access (CVE-2020-4661, CVE-2020-4699, CVE-2020-4660)

Summary Several security vulneraabilties have been fixed in both IBM Security Access Manager and IBM Security Verify Access products. Vulnerability Details CVEID: CVE-2020-4661 DESCRIPTION: IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel...

Security Bulletin: IBM Cúram Social Program Management uses MD5 algorithm (CVE-2020-4778)

Summary IBM Cúram Social Program Management uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. Vulnerability Details CVEID: CVE-2020-4778 DESCRIPTION: IBM Cúram Social Program Management use...

Security Bulletin: An XML External Entity Injection (XXE) vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4772)

Summary An XML External Entity Injection XXE vulnerability may impact IBM Cúram Social Program Management. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, used by IBM Integration Bus & IBM App Connect Enterprise v11. These issues were disclosed as part of the IBM Java SDK updates in July 2020 Vulnerability Details CVEID: CVE-2020-14621 DESCRIPTION: An unspecified...