Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks (CVE-2017-1357)

Summary IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. Vulnerability Details CVEID: CVE-2017-1357 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to...

Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection(CVE-2017-1175)

Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1175 DESCRIPTION: IBM Maximo...

Security Bulletin: IBM TRIRIGA Application Platform Information Disclosure (CVE-2017-1374)

Summary IBM TRIRIGA Application Platform is vulnerable to an information disclosure attack. Vulnerability Details CVEID: CVE-2017-1374 DESCRIPTION: Sensitive data can be exposed in the IBM TRIRIGA Application platform that can lead to an attacker gaining unauthorized access to the system. CVSS Ba...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to include arbitrary files (CVE-2016-9976)

Summary IBM Maximo Asset Management could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. Vulnerability Details CVEID: CVE-2016-9976 DESCRIPTION: IB...

Security Bulletin: IBM TRIRIGA Document Manager Privilege Escalation (CVE-2017-1180)

Summary IBM TRIRIGA Document Manager is vulnerable to a privilege escalation attack. Vulnerability Details CVEID: CVE-2017-1180 DESCRIPTION: The IBM TRIRIGA Document Manager contains a vulnerability that could allow an authenticated user to execute actions they did not have access to. CVSS Base...

Security Bulletin: IBM TRIRIGA Application Platform Cross-Site Scripting (XSS) (CVE-2016-9737)

Summary The IBM TRIRIGA Application is vulnerable to a Cross-Site Scripting attack. Vulnerability Details CVEID: CVE-2016-9737 DESCRIPTION: IBM TRIRIGA is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...

Security Bulletin: IBM TRIRIGA Application Platform Reflected Cross-Site Scripting (XSS) (CVE-2016-5980)

Summary The IBM TRIRIGA Application is vulnerable to Reflected Cross-Site Scripting attacks. Vulnerability Details CVEID: CVE-2016-5980 DESCRIPTION: IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

Security Bulletin: IBM TRIRIGA Application Platform is vulnerable to a Cross-site scripting attack on login. (CVE-2016-0387)

Summary IBM TRIRIGA is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once t...

Security Bulletin: IBM TRIRIGA Application Platform builder tools are vulnerable to privilege escalation attacks. (CVE-2016-0374)

Summary IBM TRIRIGA builder tools are vulnerable to a privilege escalation attack that can result in a user without access having the ability to modify TRIRIGA Applications. Vulnerability Details CVEID: CVE-2016-0374 DESCRIPTION: CVSS Base Score: 8.8 CVSS Temporal Score: See...

Security Bulletin: IBM TRIRIGA Application Platform Cross Site Request Forgery Vulnerability (CVE-2016-0348)

Summary Unauthenticated requests can be made to a vulnerable web application, which then performs unauthorized action on behalf of the attacker. Vulnerability Details CVEID: CVE-2016-0348 DESCRIPTION: IBM Tririga is vulnerable to cross-site request forgery, caused by improper validation of...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to select items within the system that they should not have permission to do so (CVE-2016-0289)

Summary IBM Maximo Asset Management could allow an authenticated user to select items within the system that they should not have permission to do so. Vulnerability Details CVEID: CVE-2016-0289 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to select items within the...

Security Bulletin: A security vulnerability has been identified in IBM Maximo Asset Management which could allow an attacker to obtain sensitive information via REST API (CVE-2015-7452)

Summary A security vulnerability has been identified in IBM Maximo Asset Management which could allow an attacker to obtain sensitive information via REST API. Vulnerability Details CVEID: CVE-2015-7452 DESCRIPTION: A security vulnerability has been identified in IBM Maximo Asset Management which...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2015-7451)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-7451 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting, caused by improper validation of user-supplie...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to change or view information that the user should not have access to due to issues with the Scheduler functionality (CVE-2015-7396)

Summary IBM Maximo Asset Management could allow an authenticated user to change or view information that the user should not have access to due to issues with the Scheduler functionality. This vulnerability could allow a local attacker to compromise data integrity and confidentiality. The...

Security Bulletin: TLS padding vulnerability affects IBM MessageSight (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM MessageSight. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by th...

Security Bulletin: Jazz for Service Management is affected by Open Source Apache ActiveMQ vulnerability - Reported in 02/05/2015 X-Force Report

Summary Jazz for Service Management JazzSM bundles the Open Source Apache ActiveMQ jar files for use by the underlying DASH/TWL Component and a vulnerability was reported related to the jar used Vulnerability Details CVEID: CVE-2014-3600 DESCRIPTION: Apache ActiveMQ could allow a remote attacker ...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Netcool/Reporter (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Netcool/Reporter. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Tivoli Netcool Service Quality Manager is affected by the vulnerabilities in the IBM JRE and Tivoli Directory Server

Summary Tivoli Netcool Service Quality Manager is affected by the vulnerabilities in the IBM Java Runtime Environment Java Technology Edition, Version 5.0 and the IBM Tivoli Directory Server Vulnerability Details CVE-ID: CVE-2014-3065 DESCRIPTION: IBM Java SDK contains a vulnerability in which th...

Security Bulletin: Information Disclosure Vulnerability Addressed in Asset and Service Management (CVE-2014-4765)

Summary IBM Maximo Asset Management could allow an attacker to obtain directory information from an error message. This information could be used to aid in further attacks against the system. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management...

Determining which CVE fixes are included in a JRE

Question IBM Security Bulletins list CVEs that must be applied to the JRE that RPT scripts use to run tests. How can you determine whether a specific JRE version includes a particular CVE? Answer IBM Security Bulletins list Common Vulnerabilities and Exposures CVE that must be fixed in the T6...