Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVEID: 180875

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details Third Party Entry: 180875 DESCRIPTION: jQuery cross-site scripting CVSS Base score: 6.1 CVSS Temporal Scor...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in IBM® SDK Java™ Technology Edition

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by Enterprise Content Management System Monitor. Enterprise Content Management System Monitor has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2830 DESCRIPTION: An unspecified...

Security Bulletin: Use of a Broken or Risky Cryptographic Algorithm in Resilient App Host (CVE-2020-4637)

Summary Resilient App Host Beta was using weaker than expected Cryptographic Algorithm. Vulnerability Details CVEID: CVE-2020-4637 DESCRIPTION: IBM Resilient uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base score: 5...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Netcool Configuration Manager (CVE-2019-2949).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Netcool Configuration Manager v6.4.2, which was disclosed in the Oracle October 2019 Critical Patch Update, but deferred until the release associated with the Oracle April 2020 Critical Pat...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Connect:Direct FTP+

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 8.0.5.40 and 8.0.5.35, used by IBM Sterling Connect:Direct FTP+. IBM Sterling Connect:Direct FTP+ has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14579 DESCRIPTION: An unspecified...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Connect:Direct FTP+

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 8.0.5.40 and 8.0.5.35, used by IBM Sterling Connect:Direct FTP+. IBM Sterling Connect:Direct FTP+ has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect TPF Toolkit

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by TPF Toolkit. TPF Toolkit has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the...

Security Bulletin: A Vulnerability in IBM Java Runtime Affects IBM Sterling Connect:Direct File Agent

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 6, 7 and 8 used by IBM Sterling Connect:Direct File Agent. The issue was disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2602 DESCRIPTION: An unspecified vulnerability...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime Affect IBM Sterling Connect:Direct FTP+

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.10 used by IBM Sterling Connect:Direct FTP+. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2633 DESCRIPTION: An unspecified...

Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2019-1559)

Summary A security vulnerability has been disclosed on 26th February 2019 by the OpenSSL Project. OpenSSl is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an...

Security Bulletin: Vulnerability in OpenSSL affects IBM Sterling Connect:Express for Unix (CVE-2016-2842).

Summary This bulletin addresses CVE-2016-2842 for IBM Sterling Connect:Express for Unix. Vulnerability Details OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Sterling Connect:Express for Unix. IBM Sterling Connect:Express for Unix addressed...

Security Bulletin: Vulnerabilities in zlib affect IBM Sterling Connect:Direct FTP+ (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

Summary Vulnerabilities were reported in zlib. zlib is used by IBM Sterling Connect:Direct FTP+. IBM Sterling Connect:Direct FTP+ has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointe...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Connect:Direct Browser User Interface (CVE-2015-7575, CVE-2016-0475, CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7.0 that is used by IBM Sterling Connect:Direct Browser User Interface. These issues were disclosed as part of the IBM Java Runtime updates in October 2015 and January 2016 and include the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Connect:Direct FTP+ (CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 7.0.5.0 and 6.0.14.0, that are used by Sterling Connect:Direct FTP+. These issues were disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-48...

Security Bulletin: Java Vulnerability Impacts IBM Control Center (CVE-2018-1656)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 7 and 8 that is used by IBM Control Center. This issue was disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION:The IBM Java Runtime...

Security Bulletin: IBM Java Runtime Vulnerability Affects IBM Sterling Secure Proxy (CVE-2020-2781)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling Secure Proxy. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2781 DESCRIPTION: An unspecified vulnerability in Java SE related to the...

Security Bulletin: IBM Java Runtime Vulnerability Affects IBM Sterling External Authentication Server (CVE-2020-2781)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling External Authentication Server. IBM Sterling External Authentication Server has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-2781 DESCRIPTION: An unspecified...

Security Bulletin: TLS padding vulnerability affects Sterling Connect:Direct for UNIX (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects Sterling Connect:Direct for UNIX. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM Connect:Direct for UNIX is Vulnerable to a Privilege Escalation Attack via its C/C++ API

Summary IBM Sterling Connect:Direct for UNIX could allow a user who is authorized for limited Connect:Direct privileges to attack through a custom application written using the Connect:Direct for UNIX C/C++ API by replacing the system implementation of getuid with a malicious implementation and...