CVE-2013-0474

CVE-2013-0474 affects the Manual Explore browser plug-in used with IBM Security AppScan Enterprise (versions 5.6 and 8.x prior to 8.7) and IBM Rational Policy Tester (versions 5.6 and 8.x prior to 8.5.0.4). The vulnerability allows remote attackers to disclose test Platform Authentication credent...

CVE-2013-0473

CVE-2013-0473 describes multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise (versions 5.6 and 8.x prior to 8.7) and IBM Rational Policy Tester (versions 5.6 and 8.x prior to 8.5.0.4). The issue allows remote attackers to inject arbitrary web script or HTML via a...

PT-2013-2398

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 IBM Rational Policy Tester versions 5.6 and 8.x through 8.5.0.3 Description The issue allows local users to gain privileges via a Trojan horse program due to an unquoted service...

CVE-2013-0474: Exposure of Sensitive Information to an Unauthorized Actor

The Manual Explore browser plug-in in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to discover test Platform Authentication credentials via a crafted web site...

PT-2013-2368

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 IBM Rational Policy Tester versions 5.6 and 8.x through 8.5.0.3 Description The issue allows remote attackers to discover test Platform Authentication credentials via a crafted w...

PT-2013-2395

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 Description The issue allows man-in-the-middle attackers to hijack the test account by capturing session cookies sent to a specific external server. Recommendations For IBM...

PT-2013-2408

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 IBM Rational Policy Tester versions 5.6 and 8.x through 8.5.0.3 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary...

CVE-2013-0512: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the Manual Explore browser plug-in for Firefox in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to cause a denial of service plug-in crash via a crafted web page...

PT-2013-2396

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x before 8.7 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is due to multiple SQL injection vulnerabilities. Recommendations For IBM Security...

CVE-2013-0511: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified parameters...

CVE-2013-0473: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allow remote attackers to inject arbitrary web script or HTML via a crafted report...

CVE-2013-0510: Undefined Security Weakness

IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies...

CVE-2013-0513: Undefined Security Weakness

IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 create a service that lacks " double quote characters in the service path, which allows local users to gain privileges via a Trojan horse program, related to an "Unquoted Service Path...

PT-2013-2367

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 IBM Rational Policy Tester versions 5.6 and 8.x through 8.5.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted report,...

PT-2013-2397

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 IBM Rational Policy Tester versions 5.6 and 8.x through 8.5.0.3 Description The issue is a stack-based buffer overflow in the Manual Explore browser plug-in, which can be exploit...

CVE-2013-0532: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that cause a denial of service via malformed HTTP...

Multiple OpenSSL vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Fri Mar 15 03:20:11 CDT 2013 The most recent version of this document is available here: | Updated: Wed Jun 5 10:22:29 CDT 2013 | Update: Fix available for FIPS version | Update: Corrected CVSS base score and vector...

RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:0626)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2013:0624)

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Critical: Red Hat Security Advisory: java-1.6.0-ibm security update

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...