Security Bulletin: Vulnerability in SSLv3 affects IBM PureApplication System (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM PureApplication System. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: The product might allow a remote attacker to obtain sensiti...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM PureApplication System (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM PureApplication System. Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafted, but...

Security Bulletin: File path traversal vulnerabilities affect IBM PureApplication System (CVE-2014-6158)

Summary File upload functionality within IBM PureApplication System might lead to server compromise and Denial of Service DoS. Vulnerability Details CVEID: CVE-2014-6158 DESCRIPTION: IBM PureApplication System’s file upload functions might lead to server compromise and DoS when authorized users...

Security Bulletin: Vulnerabilities in Bash affect IBM PureApplication System (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM PureApplication System. Vulnerability Details CVE-ID: CVE-2014-627...

Directory traversal

Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a 1 Script Package, ...

CVE-2014-6158

Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a 1 Script Package, ...

CVE-2014-6158

CVE-2014-6158 is a directory-traversal flaw affecting IBM PureApplication System (versions 1.0 up to 1.0.0.4 iFix 10; 1.1 up to 1.1.0.5; 2.0 up to 2.0.0.1) and IBM Workload Deployer (3.1.0.7 up to IF5). The vulnerability arises in the file-upload mechanism where authenticated users can manipulate...

CVE-2014-0960

IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed virtual machine...