Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2020-14781)

Summary Under certain circumstances, encrypted LDAP connections can be downgraded to unencrypted connections. The fix ensures that encrypted LDAP connections cannot be downgraded in this way. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related ...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-35550)

Summary A flaw in the JSSE component causes cipher suites to be offered in the wrong order, with some weaker cipher suites ahead of stronger cipher suites. The fix ensures that stronger cipher suites are offered before weaker cipher suites. Vulnerability Details CVEID: CVE-2021-35550 DESCRIPTION:...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-2369)

Summary A flaw in the JAR validation implementation may, under certain limited circumstances, lead to a failure to detect signedJAR files that have been modified. The fix ensures that JARs that have been modified since they were signed are properly detected and treated asunsigned. Vulnerability...

Security Bulletin: Vulnerabilities in Java SE and Eclipse OpenJ9 affect IBM Control Center (CVE-2020-14803 & CVE-2020-27221)

Summary A buffer overflow flaw has been found in a widely used function in the OpenJ9 JVM, which is employed when writingcharacters to a file. We have not identified any specific exploits, but it is very likely that the flaw is exploitable to trigger a crash or run arbitrary code. The fix ensures...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-2161)

Summary A flaw in the java.lang.ProcessBuilder API on the Windows platform leads to mishandling of escaped quotes inargument strings in certain circumstances. This allows an attacker to manipulate the Process command line andpotentially run unexpected commands.The fix ensures that quotes are...

Security Bulletin: A vulnerability in Java SE affects IBM Control Center (CVE-2021-35603)

Summary A number of operations in the JSSE component are implemented in a way that means they could be exploited by anattacker in a side-channel attack due to timing differences. The fix ensures that the operations complete in constant-time. Vulnerability Details CVEID: CVE-2021-35603 DESCRIPTION...

Security Bulletin: Multiple Websphere Vulnerabilities Impact IBM Control Center (CVE-2021-35517, CVE-2021-36090)

Summary There are multiple vulnerabilities in Websphere that is used by Control Center. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts of memory. By persuading a...

Security Bulletin: Apache PDFBox Vulnerabilities Affect IBM Control Center (CVE-2021-31811, CVE-2021-31812)

Summary Apache PDFBox is vulnerable to denial of service due to possible out of memory or infinite looping conditions. Vulnerability Details CVEID: CVE-2021-31811 DESCRIPTION: Apache PDFBox is vulnerable to a denial of service, caused by an out-of-memory exception while loading a file. By...

Security Bulletin: Apache Log4j Vulnerability Affects IBM Control Center (CVE-2020-9488)

Summary Apache Log4j is vulnerable to a man-in-the-middle attack Vulnerability Details CVEID: CVE-2020-9488 DESCRIPTION: Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appender. An attacker could exploit this...

Security Bulletin: Castor Vulnerability Affects IBM Control Center (CVE-2014-3004)

Summary Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2014-3004 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information...

Security Bulletin: ICU Vulnerability Affects IBM Control Center (CVE-2020-10531)

Summary International Components for Unicode ICU for C/C++ is vulnerable to a heap-based buffer overflow, caused by an integer overflow. Vulnerability Details CVEID: CVE-2020-10531 DESCRIPTION: International Components for Unicode ICU for C/C is vulnerable to a heap-based buffer overflow, caused ...

Security Bulletin: Multiple JasperReports Vulnerabilities Affect IBM Control Center (CVE-2020-9410, CVE-2018-18809)

Summary JasperReports Library and JasperReports Server are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2020-9410 DESCRIPTION: TIBCO JasperReports Library and JasperReports Server are vulnerable to cross-site scripting,...

IBM Cognos Analytics Information Disclosure Vulnerability (CNVD-2021-38674)

IBM Cognos Analytics is a suite of business intelligence software from IBM in the United States. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. An information disclosure...

CVE-2021-20528

IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761...

CVE-2021-20529

IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 198763...

CVE-2021-20528

IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761...

Security Bulletin: Multiple CKEditor Vulnerabilities Affect IBM Control Center

Summary Muliple CKEditor vulnerablities affect IBM Control Center. See vulnerability details for descriptions. Vulnerability Details CVEID: CVE-2018-17960 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could...

Security Bulletin: Apache Ant Vulnerabilities Affect IBM Control Center (CVE-2020-1945, CVE-2020-11979)

Summary Apache Ant could allow a remote attacker to bypass security restrictions. Vulnerability Details CVEID: CVE-2020-1945 DESCRIPTION: Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sendin...

Security Bulletin: Multiple IBM MQ Vulnerabilities Affect IBM Control Center

Summary Multiple IBM MQ vulnerabilities affect IBM Control Center. See vulnerability details for descriptions. Vulnerability Details CVEID: CVE-2020-4320 DESCRIPTION: IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the...

Security Bulletin: Multiple Apache Tomcat Vulnerabilities Affect IBM Control Center

Summary Multiple Apache Tomcat vulnerabilities affect IBM Control Center. See vulnerability details for descriptions. Vulnerability Details CVEID: CVE-2020-9484 DESCRIPTION: Apache Tomcat could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe...