Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow - CVE-2022-35279

Summary IBM Business Automation Workflow is vulnerable to an information disclosure attack. Vulnerability Details CVEID:CVE-2022-35279 DESCRIPTION: IBM Business Automation Workflow could disclose sensitive version information to authenticated users which could be used in further attacks against t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Tivoli Business Service Manager. IBM Tivoli Business Service Manager has addressed the applicable CVEs. These issues were disclosed in the Oracle January 2022 Critical Patch Update, minus...

Security Bulletin: WebSphere Partner Gateway Express is affected by vulnerabilities that exist in the IBM Java SDK (CVE-2013-1571)

Abstract WebSphere Partner Gateway Express uses IBM Java SDK and is affected by one of the vulnerabilities that exists in the IBM Java SDK version. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains security vulnerability. Th...

Security Bulletin: IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor is potentially affected by vulnerabilities in IBM Java SDK/JRE

Abstract Multiple security vulnerabilities exist in the IBM Java SDK/JREs that are shipped with IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor product. Content VULNERABILITY DETAILS: DESCRIPTION: The IBM FileNet System Monitor/IBM Enterprise Content Management System...

Security Bulletin: IBM Support Assistant Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java™ API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Source disclosure in IBM Content Collector’s Help System (CVE-2013-0467)

Abstract This bulletin addresses potential source disclosures in IBM Content Collector’s Help System. Content SUMMARY IBM Eclipse Help System, as used in IBM Content Collector, could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted URL to view...

Security Bulletin: IBM FileNet Business Process Manager – XML 4J denial of service attack (CVE-2013-4002)

Abstract The XML4J parser that is shipped with the IBM FileNet Business Process Manager is vulnerable to a denial of service attack, which is triggered by malformed XML data. Content The products that are listed below can be affected by security vulnerabilities reported to the Apache Xerces-J...

Security Bulletin: Potential Oracle Outside In Technology Vulnerabilities Exposed in DB2 9.7.0.4 Accessories Suite (CVE-2011-2264, CVE-2011-0794, and CVE-2011-0808)

Abstract Oracle Outside In Technology contains exploitable vulnerabilities in the CorelDRAW CVE-2011-2264 file parser, the File ID SDK CVE-2011-0794, and file filters CVE-2011-0808. Each of these vulnerabilities may allow a remote, unauthenticated user to execute arbitrary code on a vulnerable...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability that could allow a remote authenticated user to view ticket worklog entries that they should not have access to (CVE-2015-5016)

Summary IBM Maximo Asset Management contains a vulnerability that could allow a remote authenticated user to view ticket worklog entries that they should not have access to. This vulnerability could allow a local attacker to obtain sensitive information. The vulnerability affects Maximo Asset...

Security Bulletin: IBM Maximo Asset Management could allow an attacker to cause a runtime error using a specially crafted HTTP request, that could disclose sensitive information (CVE-2016-5987)

Summary IBM Maximo Asset Management could allow an attacker to cause a runtime error using a specially crafted HTTP request, that could disclose sensitive information. Vulnerability Details CVEID: CVE-2016-5987 DESCRIPTION: IBM Maximo Asset Management could allow an attacker to cause a runtime...

Security Bulletin: CVE-2021-41041 may affect IBM® Semeru Runtime

Summary CVE-2021-41041 was addressed in Eclipse OpenJ9 version 0.32 Vulnerability Details CVEID:CVE-2021-41041 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by failing to throw the exception captured during bytecode verification when verificatio...

AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824)

IBM SECURITY ADVISORY First Issued: Mon Sep 12 15:07:01 CDT 2022 |Updated: Mon Dec 12 12:49:47 CST 2022 |Update: Added iFixes for AIX 7.2 TL5 SP5 and VIOS 3.1.4.10. The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/libxml2advisory3.asc...

Security Bulletin: Potential denial of service may affect IBM HTTP Server on Windows (CVE-2015-1829)

Summary There is a potential denial of service that may affect IBM HTTP Server on Windows CVE-2015-1829. To exploit the attack requires local access to the server system. Vulnerability Details CVEID: CVE-2015-1829 DESCRIPTION: Apache Portable Runtime is vulnerable to a denial of service, caused b...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary Java SE issues disclosed in the Oracle July 2022 Critical Patch Update Vulnerability Details CVEID:CVE-2022-21541 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity...

Security Bulletin: Vulnerabilities in Intel Chipset affect IBM Cloud Pak System (CVE-2021-0060, CVE-2021-0147, CVE-2021-33080)

Summary Vulnerabilities in Intel Chipset affect IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-0060 DESCRIPTION: Intel SPS could allow a physical attacker to gain elevated privileges on the system, caused by insufficient...

Security Bulletin: Vulnerability CVE-2019-3880 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVE. This security bulletin has been updated, on June 21, 2019, as an additional IBM i PTF is available for IBM i 7.4. Vulnerability Details CVEID: CVE-2019-3880 DESCRIPTION: Samba could allow a remote authenticated attacker ...

Security Bulletin: IBM i Clustering is affected by CVE-2019-4381

Summary IBM i Clustering is vulnerable to this security vulnerability. IBM i has addressed this vulnerability. This security bulletin has been updated, on June 21, 2019, as an additional IBM i PTF is available for IBM i 7.4. Vulnerability Details CVEID: CVE-2019-4381 DESCRIPTION: IBM i Clustering...

IBM PowerVM VIOS could allow a remote attacker to tamper with system configuration or cause a denial of service

IBM SECURITY ADVISORY First Issued: Thu Jul 28 13:39:29 CDT 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/viosadvisory.asc https://aix.software.ibm.com/aix/efixes/security/viosadvisory.asc...

Security Bulletin: Session cookie used by IBM Security Verify Information Queue is not properly secured (CVE-2022-35284)

Summary IBM Security Verify Information Queue ISIQ v10.0.2 does not set the SameSite attribute in the ISIQ session cookie. As a result, any CSRF protections offered by the attribute are disabled. ISIQ v10.0.3 is now correctly setting the SameSite attribute. CVE-2022-35284 Vulnerability Details...

Security Bulletin: IBM Spectrum Protect 8.1.14.000 Server is vulnerable to bypass of security restrictions (CVE-2022-22394)

Summary IBM Spectrum Protect 8.1.14.000 Server could allow a remote attacker to bypass security restrictions due to improper enforcement of access controls. Vulnerability Details CVEID:CVE-2022-22394 DESCRIPTION: The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass...