Security Bulletin: Multiple vulnerabilities in IBM Infosphere Optim Data Growth for Oracle E-Business Suite (CVE-2013-0577, CVE-2013-0579, CVE-2013-0580)

Abstract Multiple vulnerabilities exist in the Optim E-Business Console that can allow an attacker to view sensitive information, perform actions as an impersonated legitimate user, or upload, modify or delete web pages or scripts on the server. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-057...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2956

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2013-4063

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue concerns the transmission of login credentials in an unencrypted manner, allowing remote attackers to intercept sensitiv...

PT-2013-4059

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue allows remote attackers to gain access via a brute-force attack due to the lack of limitation on incorrect authenticatio...

PT-2013-4058

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to the use of the MD5 algorithm for signatures in X.509 certificates, which can be exploited by...

CVE-2013-2957: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2959: Undefined Security Weakness

The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-2953: Undefined Security Weakness

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate...

CVE-2013-2955: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue...

CVE-2013-2956: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2013-4061

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 6.x through 9.x before 9.1.0.3,...

CVE-2013-2954: Improper Authentication

The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

PT-2013-4062

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web...

PT-2013-4060

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to a stored cross-site scripting XSS vulnerability, which allows remote authenticated users to inject arbitra...