Security Bulletin: Potential security exposure when using InfoSphere BigInsights due to vulnerability in Jetty

Abstract IBM InfoSphere BigInsights makes use of Jetty. A vulnerability in Jetty allows remote attackers to cause a denial of service. Content VULNERABILITY DETAILS: CVE-2011-4461 DESCRIPTION: A vulnerability in Jetty allows remote attackers to cause a denial of service CPU consumption by sending...

Security Bulletin: Multiple vulnerabilities in InfoSphere Optim Performance Manager due to vulnerabilities in IBM Java Runtime Environment (CVE-2013-0440, CVE-2013-0443)

Abstract IBM InfoSphere Optim Performance Manager uses the IBM Java Runtime Environment JRE and might be affected by vulnerabilities in the IBM JRE. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0440 DESCRIPTION: An unspecified vulnerability in Oracle Java within the JSSE component could allow ...

Security Bulletin: IBM InfoSphere Data Replication Dashboard Username Enumeration (CVE-2013-0584)

Abstract A remote, unauthenticated user can enumerate a list of InfoSphere Data Replication Dashboard user accounts including which accounts do not require a password. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0584 CVSS: CVSS Base Score: 5 CVSS Temporal Score: See for the current score CVSS...

Security Bulletin: Potential security exposure when using IBM InfoSphere Streams due to vulnerabilities in IBM Java SE Version 6 SDK.

Abstract IBM InfoSphere Streams makes use of IBM Java SE Version Version 6 SDK. Potential security exposures exist in IBM InfoSphere Streams due to vulnerabilities in IBM Java SE Version 6 SDK. Content VULNERABILITYDETAILS: CVE-2012-1718, CVE-2012-3143, CVE-2012-3159, CVE-2012-5081 DESCRIPTION:...

Security Bulletin: IBM InfoSphere Master Data Management – Java CPU Feb 2013 (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169)

Abstract Multiple security vulnerabilities exist in the IBM Java SDK shipped with IBM WebSphere Application Server that affects IBM InfoSphere Master Data Management versions 8.5, 9.0.1, 9.0.2, 10.0.0, 10.1.0,and 11.0.0 Content VULNERABILITY DETAILS: CVE-2013-0440 - Unspecified vulnerability in...

Security Bulletin: IBM InfoSphere Balanced Warehouse C3000 and C4000, IBM Smart Analytics System 1050, 2050, and 5710 systems are affected by privilege escalation vulnerability in IBM DB2 for Linux, Unix, and Windows Audit Facility (CVE-2013-3475)

Abstract IBM InfoSphere Balanced Warehouse C3000 and C4000 and IBM Smart Analytics System 1050, 2050, and 5710 systems are shipped with DB2 Version 9.7. There is a security vulnerability in the DB2 Audit Facility which allows an attacker to gain DB2 instance owner level privileges. This...

Security Bulletin: Lack of path restriction may allow access to sensitive data stored on Information Server Engine (CVE-2012-4818)

Abstract Security Bulletin: Lack of path restriction may allow access to sensitive data stored on Information Server Engine CVE-2012-4818 Content VULNERABILITY DETAILS: CVE ID: CVE-2012-4818 DESCRIPTION: Whenever an Information Server client application such as InfoSphere DataStage and QualitySta...

Security Bulletin: Source disclosure in IBM InfoSphere Identity Insight’s Help System (CVE-2013-0467)

Abstract Identity Insight’s Help System could allow a remote attacker to obtain source of the Help System. Content SUMMARY: Identity Insight’s Help System could allow a remote attacker to obtain source of the Help System. VULNERABILITY DETAILS: CVE ID: CVE-2013-0467 CVSS: CVSS Base Score: 4 CVSS...

Security Bulletin: IBM Smart Analytics System 1050, 2050, and 5600 and IBM InfoSphere Balanced Warehouse C3000, C4000, and D5100 are affected by vulnerabilities in OpenSSL (CVE-2013-0166, CVE-2013-0169)

Abstract The IBM Smart Analytics System 1050 for Linux, IBM Smart Analytics System 2050 for Linux, IBM InfoSphere Balanced Warehouse C Class for Linux, IBM InfoSphere Balanced Warehouse D5100, and IBM Smart Analytics System 5600 systems are shipped with SUSE Linux Enterprise Server Edition...

Security Bulletin: IBM InfoSphere Information Server Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the...

Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in help system for InfoSphere MDM Server, InfoSphere Master Information Hub and InfoSphere MDM Custom Domain Hub (CVE-2012-2159, CVE-2012-2161)

Abstract Some scripts in the help system used by InfoSphere Master Data Management Server, InfoSphere Master Information Hub, and InfoSphere Master Data Management Custom Domain Hub are vulnerable to open redirect or cross-site scripting attacks. These vulnerabilities exist only for those custome...

Security Bulletin: Denial of service in IBM InfoSphere Data Replication Dashboard (CVE-2011-4461)

Abstract InfoSphere Data Replication Dashboard includes Jetty which has a known security vulnerability that can lead to a denial of service. Content VULNERABILITY DETAILS: CVE ID: CVE-2011-4461 DESCRIPTION: An attacker, using specially crafted HTTP requests, can cause up to 100% CPU usage,...

Security Bulletin: Multiple IBM Java SDK security vulnerabilities exist in IBM InfoSphere Information Server (CVE-2013-4002 and CVE-2013-2407)

Abstract Security Bulletin: Multiple IBM Java SDK security vulnerabilities exist in IBM InfoSphere Information Server CVE-2013-4002 and CVE-2013-2407 Content SUMMARY: IBM Information Server is impacted by security vulnerabilities in the IBM Java Runtime Environment JRE that affect availability an...

Security Bulletin: InfoSphere Replication Dashboard is affected by a vulnerability in the IBM JRE (CVE-2013-5780)

Abstract An unspecified vulnerability in IBM Java related to the Libraries component could allow a remote attacker to obtain sensitive information. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-5780 CVSS: CVSS Base Score: 4.3 CVSS Temporal Score: See...

Security Bulletin: Cross-Site Scripting vulnerability exists in IBM InfoSphere Master Data Management - Collaborative Edition (CVE-2013-4036)

Abstract IBM InfoSphere Master Data Management is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious scripts into a web page which would be executed in a victim's web browser within the...

Security Bulletin: Session Fixation Vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition (CVE-2013-5426)

Abstract An unspecified vulnerability in IBM InfoSphere Master Data Management – Collaborative Edition might allow an attacker to gain unauthorized access to a user's session. An attacker with access to a user's open browser before the user authenticates with the IBM InfoSphere Master Data...

Security Bulletin: InfoSphere Data Replication Dashboard is affected by a vulnerability in the IBM JRE (CVE-2013-0169)

Abstract The IBM JRE that is embedded in the InfoSphere Data Replication Dashboard has a security vulnerability that affects SSL connections to the dashboard web server. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-0169 DESCRIPTION: The TLS protocol does not properly consider timing side-chann...

Security Bulletin: IBM InfoSphere Information Server Data Quality Console and Information Analyzer are vulnerable to cross-site request forgery attacks (CVE-2013-4056)

Abstract Security Bulletin: IBM InfoSphere Information Server Data Quality Console and Information Analyzer are vulnerable to cross-site request forgery attacks CVE-2013-4056 Content SUMMARY: A cross-site request forgery vulnerability exists in IBM InfoSphere Information Server Data Quality Conso...

Security Bulletin: InfoSphere Streams is affected by multiple vulnerabilities in the IBM Java JDK (CVE-2013-1500, CVE-2013-2412, CVE-2013-1571)

Abstract The IBM JDK shipped with InfoSphere Streams has security vulnerabilities which can potentially impact InfoSphere Streams. Content VULNERABILITY DETAILS: CVEID: CVE-2013-1500 An unspecified vulnerability in the Java Runtime Environment JRE component allows local users to affect...

Security Bulletin: Multiple vulnerabilities in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite (CVE-2013-2953, CVE-2013-2954, CVE-2013-2955, CVE-2013-2956, CVE-2013-2957, CVE-2013-2959)

Abstract Multiple vulnerabilities have been identified in the Optim E-Business Console making the product vulnerable to phishing attacks, the interception of credentials and the bypass of login entirely. Content VULNERABILITY DETAILS: CVE ID: CVE-2013-2953 DESCRIPTION: Use of MD5 as SSL Certifica...