Security Bulletin: Public disclosed vulnerability from Apache Struts affects IBM Spectrum LSF Explorer

Summary Public disclosed vulnerability CVE-2018-11776 from Apache Struts affects IBM Spectrum LSF Explorer. Vulnerability Details CVEID: CVE-2018-11776 DESCRIPTION: Apache Struts namespace code execution CVSS Base Score: 9.8 CVSS Temporal Score: See for the current score CVSS Environmental Score:...

Security Bulletin: WebSphere Application Server LIBERTY is not honoring SSL transport in limited situations affects IBM Spectrum LSF Application Center

Summary WebSphere Application Server LIBERTY is not honoring SSL transport in limited situations, affects IBM Spectrum LSF Application Center. Vulnerability Details CVEID: CVE-2018-1755 DESCRIPTION: WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information...

Security Bulletin: Remote code execution vulnerability (CVE-2018-1260) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability CVE-2018-1260. Vulnerability Details CVEID: CVE-2018-1260 DESCRIPTION: Pivotal Spring Security OAuth could allow a remote...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 and IBM® Runtime Environment Java™ Version 7 used by IBM Spectrum LSF Analytics. IBM Spectrum LSF Analytics has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the I...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and Data Protection for Hyper-V. These issues were disclosed as part of the IBM Java SDK updates i...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware

Summary OpenSSL vulnerabilities were disclosed on March 27, 2018 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect formerly Tivoli Storage Manager Client and IBM Spectrum Protect for Virtual Environments formerly Tivoli Storage Manager for Virtual Environments: Data Protection for...

Security Bulletin: Password disclosure via instrumentation log file in IBM Spectrum Protect Plus (CVE-2018-1768)

Summary IBM Spectrum Protect Plus may display the user id and password in plain text within the instrumentation log file. Vulnerability Details CVEID: CVE-2018-1768 DESCRIPTION: IBM Spectrum Protect Plus could disclose sensitive information when an authorized user executes a test operation, the...

Security Bulletin: PostgreSQL vulnerability affects IBM Spectrum Protect Plus (CVE-2017-15097)

Summary A vulnerability in PostgreSQL affects IBM Spectrum Protect™ Plus. This vulnerability could result in a local authenticated attacker gaining elevated privileges on the system. Vulnerability Details CVEID: CVE-2017-15097 DESCRIPTION: PostgreSQL could allow a local authenticated attacker to...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2017-3736, CVE-2017-3737, CVE-2017-3738)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on November 2, 2017 and December 7, 2017. OpenSSL, used by the IBM Spectrum Protect Plus, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtai...

Security Bulletin: Multiple vulnerabilities in Oracle Java SE affect IBM Spectrum Protect Plus

Summary There are multiple vulnerabilities in Oracle Java SE which is used by IBM Spectrum Protect™ Plus. These issues were disclosed as part of the Oracle Critical Patch Update CPU in April 2018 and July 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability i...

Security Bulletin: OpenSSH vulnerability affects IBM Spectrum Protect Plus (CVE-2017-15906)

Summary OpenSSH is vulnerable to a denial of service vulnerability which affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote...

Security Bulletin: Vulnerabilities in GSKit affect IBM Spectrum Scale used by DB2® pureScale™ (CVE-2018-1431, CVE-2018-1447, CVE-2017-3732, CVE-2016-0705)

Summary DB2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version V4.2 and V4.1 that is used by DB2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS. Vulnerability Details CVEID: CVE-2018-1431 DESCRIPTION: A vulnerabilit...

CVE-2018-1782

CVE-2018-1782 affects IBM Spectrum Scale (GPFS) 5.0.1.0 and 5.0.1.1. A local, unprivileged user can trigger a kernel panic on a node running GPFS by either mmap-ing a file stored on a GPFS file system or by executing a crafted file stored on GPFS. IBM’s notices confirm the vulnerability is limite...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale that could allow a local, unprivileged user to cause a kernel panic (CVE-2018-1782)

Summary IBM Spectrum Scale could allow a local, unprivileged user to cause a kernel panic on a node running GPFS by accessing a file that is stored on a GPFS file system with mmap, or by executing a crafted file stored on a GPFS file system. Vulnerability Details CVEID: CVE-2018-1782 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2018-2579, CVE-2018-2693, CVE-2018-2783)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center and IBM Spectrum Protect formerly Tivoli Storage Manager Client Management Service. These issues were disclosed as part of the IBM Ja...

IBM Spectrum Symphony and Platform Symphony Command Execution Vulnerabilities

IBM Spectrum Symphony and Platform Symphony are both products of IBM Corporation in the U.S. IBM Spectrum Symphony is a suite of enterprise-class management software for running compute- and data-intensive distributed applications on shared grids.Platform Symphony is a set of SOA-based architectu...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: Security vulnerabilities have been identified in IBM Spectrum Scale v5.0.0 shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure (SDI) v1.1.0 (CVE-2018-1431, CVE-2016-0705, CVE-2017-3732, CVE-2018-1447)

Summary IBM Spectrum Scale v5.0.0 is shipped with IBM Cloud PowerVC Manager for Software Defined Infrastructure SDI v1.1.0. Information about security vulnerabilities affecting IBM Spectrum Scale v5.0.0 have been published in a security bulletin. Vulnerability Details Refer to the security bullet...

Security Bulletin: Stored Cross-Site Scripting (XSS) vulnerability (CVE-2018-1707) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Stored Cross-Site Scripting XSS vulnerability CVE-2018-1707 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1707 DESCRIPTION: IBM Platform Symphony is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri...

Security Bulletin: Vulnerability to allow an authenticated user to obtain sensitive user information (CVE-2018-1708) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Vulnerability to allow an authenticated user to obtain sensitive user information such as passwords through the WebUI CVE-2018-1708 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1708 DESCRIPTION: IBM Spectrum Symphony could allow an authenticat...