Security Bulletin: IBM® Intelligent Operations Center is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data (CVE-2019-4419)

Summary IBM® Intelligent Operations Center is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2019-4419 DESCRIPTION:...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2019-4269)

Summary IBM WebSphere Application Server is shipped with IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin, Security Bulletin:...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2019-4279)

Summary IBM WebSphere Application Server is shipped with IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin, Security Bulletin: Remo...

CVE-2019-4067

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012...

CVE-2019-4070

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2019-4069

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

CVE-2019-4069

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

CVE-2019-4068

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013...

CVE-2019-4067

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012...

Cross site scripting

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Design/Logic Flaw

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011...

Design/Logic Flaw

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

Design/Logic Flaw

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012...

CVE-2019-4070

IBM Intelligent Operations Center (IOC) versions 5.1.0–5.2.0 are vulnerable to cross-site scripting due to insufficient input sanitization in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected products/versions in...

CVE-2019-4066

IBM IOC CVE-2019-4066 affects IBM Intelligent Operations Center (IOC) 5.1.0–5.2.0; IOC for Emergency Management 5.1.0–5.1.0.6; and Water Operations for Waternamics 5.1.0–5.2.1.1. An authenticated user can create arbitrary user accounts, causing ID-management issues and potentially enabling code e...

CVE-2019-4069

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

CVE-2019-4068

CVE-2019-4068 affects IBM Intelligent Operations Center (IOC) versions 5.1.0 through 5.2.0 (and IBM IOC for Emergency Management and Water Operations for Waternamics variants per the IBM bulletin). The issue is user enumeration that can enable brute-force access to IOC. Publicly documented impact...

CVE-2019-4067

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012...

CVE-2019-4070

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2019-4069

IBM Intelligent Operations Center (IOC) 5.1.0–5.2.0 is affected by CVE-2019-4069, a file-type validation flaw that allows uploading malicious content. Also affects IOC for Emergency Management 5.1.0–5.1.0.6 and Water Operations for Waternamics 5.1.0–5.2.1.1. Root cause: improper file-type validat...