Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server shipped with IBM Content Collector (CVE-2014-0114)

Summary There is a classloader manipulation vulnerability in the Apache Struts 1 used by the Administrative Console in IBM WebSphere Application Server that is shipped with IBM Content Collector. Vulnerability Details CVEID: CVE-2014-0114 Description: Apache Struts could allow a remote attacker t...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Web Interface for Content Management (WEBi)

Summary Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Content Navigator

Summary Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVE-2014-0114 in IBM Content Navigator Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVSS Base Score: 7.5 CVSS Temporal Scor...

Security Bulletin: IBM Datacap Taskmaster Capture ActiveX Vulnerability (CVE-2014-0879)

Summary Taskmaster Web uses ActiveX controls to perform scanning and to display images in the browser on the client computer. One of the controls was found vulnerable to crafted hacking. Vulnerability Details CVEID: CVE-2014-0879 DESCRIPTION: Security vulnerability with Datacap ActiveX installed ...

Security Bulletin: Improper authorization by non-admin user in IBM Content Navigator (CVE-2014-0858)

Summary Using 3rd party tools, a non-admin user can modify the URL action so that instead of a getAction, the user can perform a deleteAction against the configuration database. Vulnerability Details CVEID: CVE-2014-0858 DESCRIPTION: Improper authorization by non-admin user CVSS Base Score: 3.5...

Security Bulletin: IBM Content Navigator Potential Clickjacking Vulnerability (CVE-2013-5462)

Summary If the IBM Content Navigator application URL is opened within a frame in a web page, it's possible for the frame to record user input, potentially capturing sensitive information like login credentials. Vulnerability Details CVEID: CVE-2013-5462 DESCRIPTION: The IBM Content Navigator...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server affects Rational Reporting for Development Intelligence (CVE-2017-1681)

Summary The Rational Reporting for Development Intelligence RRDI is shipped with a version of the IBM WebSphere Application Server which contains a security vulnerability that could have a potential security impact. Vulnerability Details CVEID: CVE-2017-1681 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: Multiple vulnerabilities in Apache Solr affect IBM Rational ClearQuest (CVE-2013-6407, CVE-2013-6408)

Summary The Apache Solr that is shipped with IBM Rational ClearQuest contains multiple security vulnerabilities. IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2013-6407 DESCRIPTION: Apache Solr could allow a remote authenticated attacker to obtain...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational RequisitePro (CVE-2015-3194, CVE-2015-3196, CVE-2016-0702)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 and March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Rational RequisitePro. IBM Rational RequisitePro has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Method Composer (CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 that is used by Rational Method Composer. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”. Vulnerability Detail...

Security Bulletin: Vulnerabilities in GSKit affect IBM Rational ClearQuest (CVE-2015-1788)

Summary GSKit is an IBM component that is used by IBM Rational ClearQuest. The GSKit that is shipped with IBM Rational ClearQuest contains a security vulnerability. IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791)

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest . IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Rational ClearQuest(CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Rational ClearQuest. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...

Security Bulletin: Vulnerabilities in OpenSSL affect Rational RequisitePro (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791)

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational RequisitePro. RequisitePro has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an...

Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearQuest (CVE-2015-0209, CVE-2015-0286, CVE-2015-0288, CVE-2015-0293)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by cqperl and ratlperl for SSL communications. Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote...

Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in the Rational Change Help System (CVE-2012-2159, CVE-2012-2161)

Summary Some scripts in the help system used by IBM Rational Change are vulnerable to open redirect or cross-site scripting attacks. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires...

Security Bulletin: Vulnerabilities in OpenSSL affect Rational RequisitePro (CVE-2015-0209, CVE-2015-0286, CVE-2015-0289)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational RequisitePro. RequisitePro has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Rational RequisitePro (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Rational RequisitePro. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit thi...

Security Bulletin: Rational RequisitePro affected by Java vulnerabilities (CVE-2014-4244, CVE-2014-4263)

Summary This bulletin covers remediation measures for the CVEs published in Oracle's July 2014 CPU that affect Rational RequisitePro. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires...

Security Bulletin: Rational RequisitePro affected by OpenSSL vulnerabilities: (CVE-2014-5139, CVE-2014-3509, CVE-2014-3511)

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on August 7, 2014 by the OpenSSL Project. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login wi...