How to download interim fixes to patch IBM JRE CVEs

Question A security bulletin indicates that you need to install an interim fix to patch the T6 JRE Java Runtime Environment. How do you download this interim fix? Answer IBM Security Bulletins list Common Vulnerabilities and Exposures CVE that need to be fixed in the JRE used by the T6 agent to r...

Security Bulletin: Security Bypass Vulnerability Addressed in Asset and Service Management (CVE-2014-3084)

Summary IBM Maximo Asset Management allows an authenticated attacker to modify calendar entries that they do not have access to by bypassing security restrictions. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry...

Security Bulletin: Cross-site Request Forgery Vulnerability Addressed in Asset and Service Management (CVE-2014-3024)

Summary IBM Maximo Asset Management is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request. An attacker could exploit this...

Security Bulletin: Fix available for Stored Cross Site Scripting (XSS) Vulnerability in IBM Cúram Social Program Management (CVE-2017-1739)

Summary IBM Cúram Social Program Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker might exploit this vulnerability by getting a victim to browse to the stored information and their browser will execute the script...

Security Bulletin: Vulnerability in Apache Commons FileUpload affects IBM Cúram Social Program Management (CVE-2016-1000031)

Summary IBM Cúram Social Program Management uses the Apache Commons FileUpload Library. Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileIte...

Security Bulletin: Multiple vulnerabilities affect Watson Explorer, Watson Content Analytics and Watson Explorer Content Analytics Studio (CVE-2017-10115, CVE-2017-10116)

Summary Security vulnerabilities have been identified in IBM® Runtime Environment Java™ Technology Edition that is used by Watson Explorer, Watson Content Analytics and Watson Explorer Content Analytics Studio. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An unspecified vulnerability ...

Security Bulletin: Vulnerability in Apache Batik affects IBM Cúram Social Program Management (CVE-2017-5662)

Summary IBM Cúram Social Program Management uses the Apache Batik Library. Apache Batik could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. Vulnerability Details CVEID: CVE-2017-5662 DESCRIPTION: Apache...

Security Bulletin: Vulnerability in Apache Taglibs affects IBM Cúram Social Program Management (CVE-2015-0254)

Summary IBM Cúram Social Program Management uses the Apache Taglibs Library. Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2015-0254...

Security Bulletin: IBM Cúram's Social Program Management is vulnerable to a phishing through redirection vulnerability (CVE-2017-1195)

Summary Phishing through redirection vulnerability in Resource Store servlet in Cúram's Social Program Management product Vulnerability Details CVEID: CVE-2017-1195 DESCRIPTION: IBM Cúram Social Program Management could allow a remote attacker to conduct phishing attacks, using an open redirect...

Security Bulletin: Fix available for Privilege Escalation Vulnerability in IBM Cúram Social Program Management (CVE-2017-1110)

Summary IBM Cúram Social Program Management is vulnerable to a privilege escalation vulnerability in the product. Vulnerability Details CVEID: CVE-2017-1110 DESCRIPTION: IBM Cúram Social Program Management contains an unspecified vulnerability that could allow an authenticated user to view the...

Security Bulletin: Fix available for DOM based Cross Site Scripting (XSS) Vulnerability in IBM Cúram Social Program Management (CVE-2016-9979)

Summary IBM Cúram Social Program Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker might exploit this vulnerability by using a specially crafted URL to run a script in a victim's web browser. Vulnerability Details CVEID:...

Security Bulletin: Fix available for Vulnerability in XML External Entity Injection (XXE) affecting IBM Cúram Social Program Management (CVE-2016-6111)

Summary IBM Cúram Social Program Management is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could use the vulnerability to expose highly sensitive information, or to use all available memory resources...

Security Bulletin: Fix available for Vulnerability in Cross-Site Scripting (XSS) affecting IBM Cúram Social Program Management (CVE-2016-0261)

Summary IBM Cúram Social Program Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker might exploit this vulnerability by using a specially crafted URL to run a script in a victim's web browser. Vulnerability Details CVEID:...

Security Bulletin: Fixes available for Vulnerabilities in IBM ACF (Active Content Filtering) affects IBM Cúram Social Program Management (CVE-2015-1917, CVE-2016-0243)

Summary IBM Cúram Social Program Management is shipped with IBM Active Content Filtering, which is vulnerable to cross-site scripting caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability by using a specially crafted URL to execute script in a...

Security Bulletin: Vulnerability in Apache Commons affects Watson Explorer and Watson Content Analytics (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by Watson Explorer and Watson Content Analytics. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on...

Security Bulletin: Vulnerabilities in WSS4J affects IBM Cúram (CVE-2015-0226 & CVE-2015-0227 )

Summary IBM Cúram is shipped with a third party library called WSS4J, which is vulnerable to an attack on XML Encryption. WSS4J also fails to properly enforce the requireSignedEncryptedDataElements property which leaves it vulnerable to XML Signature wrapping attacks . Vulnerability Details CVEID...

Security Bulletin: OpenSAML XML information disclosure (CVE-2013-6440)

Summary A version of OpenSAML shipped with Cúram could allow a remote authenticated attacker to obtain sensitive information. Customers that use opensaml.jar to secure web services may be affected. Vulnerability Details CVEID: CVE-2013-6440 DESCRIPTION: OpenSAML could allow a remote authenticated...

Security Bulletin: Cúram is vulnerable to cross site scripting attack (CVE-2014-3013)

Summary Cúram is vulnerable to cross site scripting attack. Vulnerability Details CVEID: CVE-2014-3013 DESCRIPTION: Cúram is vulnerable to cross site scripting attack caused by improper validation and sanitization of tags in custom JSPs or custom renderers that add text nodes to content that will...

Security Bulletin: IBM Cúram Social Program Management is vulnerable to Java reflection attack(CVE-2014-8903).

Summary IBM Cúram Social Program Management is vulnerable to Java reflection attack caused by external input that is used to specify a class. A remote attacker could exploit this vulnerability by injecting arbitrary class names which will be subsequently loaded. Vulnerability Details CVE-2014-890...

Security Bulletin: IBM Cúram Social Program Management is vulnerable to cross site scripting attack(CVE-2014-6191).

Summary IBM Cúram Social Program Management is vulnerable to cross site scripting attack caused by improper validation and sanitization of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the...