Security Bulletin: Vulnerabilities in Apache Struts affects IBM WebSphere Application Server (CVE-2016-1181 and CVE-2016-1182)

Summary Apache Struts vulnerabilities affect WebSphere Application Server and WebSphere Application Server Hypervisor Edition Administration Console. Vulnerability Details CVEID: CVE-2016-1181 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused...

Security Bulletin: Potential denial of service with SIP Services (CVE-2016-2960)

Summary There is a potential denial of service with IBM WebSphere Application Server when using SIP services. Vulnerability Details CVEID: CVE-2016-2960 DESCRIPTION: IBM WebSphere Application Server could be vulnerable to a denial of service when using SIP services. A remote attacker could cause ...

Security Bulletin: WebSphere Application Server Liberty API Discovery feature has potential vulnerability (CVE-2016-2945)

Summary There is a potential for weaker than expected security when using the WebSphere Application Server Liberty profile API Discovery feature and Swagger documents. Vulnerability Details CVEID: CVE-2016-2945 DESCRIPTION: IBM WebSphere Application Server Liberty Profile using the API Discovery...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2016-2923)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty for any users of the JAX-RS API. Vulnerability Details CVEID: CVE-2016-2923 DESCRIPTION: IBM WebSphere Application Server Liberty using JAX-RS API could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM MQ AMS (CVE-2015-3194, CVE-2015-3195, CVE-2015-3196)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM MQ Advanced Message Security AMS on IBM i. IBM MQ has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to a denial of...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM WebSphere MQ (CVE-2016-0264, CVE-2016-3426 and CVE-2016-3427)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6 and 7 that are used by IBM WebSphere MQ. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered...

Security Bulletin: HTTP Response Splitting in WebSphere Application Server (CVE-2016-0359)

Summary There is a potential HTTP response splitting vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability usi...

Security Bulletin: Bypass security restrictions in WebSphere Application Server (CVE-2016-0385)

Summary There is a potential bypass security restriction vulnerability in IBM WebSphere Application Server. This will only occur in environments that have the webcontainer custom property HttpSessionIdReuse enabled. Vulnerability Details CVEID: CVE-2016-0385 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: Information disclosure vulnerability in IBM WebSphere Application Server Liberty (CVE-2016-0389)

Summary There is a potential information disclosure vulnerability in Admin Center for IBM WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2016-0389 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM WebSphere MQ (CVE-2015-4872)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6 & 7 that are used by IBM WebSphere MQ. This issue was disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified...

Security Bulletin: Information Disclosure in IBM WebSphere Application Server Liberty (CVE-2016-0378)

Summary There is an Information Disclosure Vulnerability in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by improper handling of...

Security Bulletin: Information Disclosure in IBM WebSphere Application Server in the Admin Console (CVE-2016-0377)

Summary There is an Information Disclosure Vulnerability in IBM WebSphere Application Server that affects the Administrative Console. Vulnerability Details CVEID: CVE-2016-0377 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information caused by th...

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.9

Summary Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server, IBM WebSphere Application Server Hypervisor, WebSphere Application Server Liberty Profile and IBM HTTP Server. Affected Products and Versions The following IBM WebSphere Application Server Version...

Security Bulletin: Potential security vulnerability in IBM WebSphere Application Server if FIPS 140-2 is enabled (CVE-2016-0306)

Summary There is a potential security vulnerability in IBM WebSphere Application Server if FIPS 140-2 is enabled. Vulnerability Details CVEID: CVE-2016-0306 DESCRIPTION: IBM WebSphere Application Server could provide weaker than expected security, caused by the improper TLS configuration. A remot...

Security Bulletin: Vulnerability in Apache Standard Taglibs affects IBM WebSphere Application Server (CVE-2015-0254)

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM WebSphere MQ (CVE-2016-0475, CVE-2015-7575, CVE-2016-0448)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM WebSphere MQ. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and include the vulnerability commonly referred to as “SLOTH”. Vulnerability Details...

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.12

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server, IBM WebSphere Application Server Hypervisor, WebSphere Application Server Liberty Profile and IBM HTTP Server. Vulnerability Details CVEID: CVE-2015-1936 DESCRIPTION: IBM WebSphere Application Serv...

Security Bulletin: IBM MQ Appliance potentially vulnerable to remote servlet spoof attack (CVE-2015-4938)

Summary A potential remote servlet spoof attack vulnerability was addressed by IBM MQ Appliance. Vulnerability Details CVEID: CVE-2015-4938 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof a servlet. An attacker could exploit this vulnerability to persuade the...

Security Bulletin: Vulnerabilities in GSKit affect IBM MQ Appliance (CVE-2015-7421, CVE-2015-7420)

Summary Vulnerabilities in GSKit affect IBM MQ Appliance. IBM MQ Appliance has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-7421 DESCRIPTION: An unspecified vulnerability in GSKit could allow a remote attacker to obtain sensitive information. CVSS Base Score: 3.7 CVSS...

Security Bulletin: Vulnerability in OpenSSL affects IBM MQ Appliance (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. IBM MQ Appliance uses GSKit and addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when processing...