Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cognos Metrics Manager (CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0293)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Cognos Metrics Manager. IBM Cognos Metrics Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0286 DESCRIPTION: OpenSSL is vulnerable to a denial of servic...

Security Bulletin: TLS padding vulnerability affects IBM Cognos Metrics Manager (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Cognos Metrics Manager Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2016-0785)

Summary An Apache Struts vulnerability was addressed by IBM Social Media Analytics 1.3.0 IF18. Vulnerability Details CVEID: CVE-2016-0785 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a double OGNL evaluation of attribute values. By...

Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2016-4003)

Summary An Apache Struts vulnerability was addressed by IBM Social Media Analytics 1.3.0 IF18. An upgrade to Apache Struts version 2.3.28.1 was performed. Vulnerability Details CVE-ID:CVE-2016-4003 Description: Apache Struts is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Open Source Apache Tomcat , Commons FileUpload Vulnerabilities affecting IBM Algo Audit and Compliance (CVE-2016-3092)

Summary Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive. Vulnerability Details CVEID: CVE-2016-3092...

Security Bulletin: OpenSSL vulnerabilities in IBM Algo Audit and Compliance (CVE-2015-3194, CVE-2015-3195, CVE-2015-3196)

Summary OpenSSL is vulnerable to denial of service attacks and OpenSSL could allow a remote attacker to obtain sensitive information. OpenSSL is used by IBM Algo Audit and Compliance. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a...

Security Bulletin: An unspecified vulnerability related to the Security component in IBM Java Runtime affects IBM Cognos Planning (CVE-2015-4872)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 6 SR16 FP7 that is used by IBM Cognos Planning. This issue was disclosed as part of the IBM Java SDK updates for October 2015 Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos TM1 (CVE-2014-4244, CVE-2014-4263)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Cognos TM1. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability related to the Securit...

Security Bulletin: IBM Cognos TM1 Admin Server vulnerabilities (CVE-2012-0202)

Summary The tm1admsd.exe server contains a security vulnerability shipped by IBM Cognos TM1 Admin Server versions 9.4.1 and 9.5.X prior to 9.5.2 FP2. The vulnerability allow a remote attacker that has access to the server and port that the server is listening on to cause a Denial of Service DoS...

Security Bulletin: Remote Code Execution vulnerability in IBM Robotic Process Automation with Automation Anywhere (CVE-2018-1547)

Summary IBM Robotic Process Automation with Automation Anywhere is vulnerable to a remote code execution vulnerability Vulnerability Details CVEID: CVE-2018-1547 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a remote attacker to execute arbitrary code on the...

Security Bulletin: Denial of Service in Apache CXF used by WebSphere Application Server (CVE-2017-12624)

Summary There is a potential denial of service in Apache CXF that is used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could...

Security Bulletin: Apache Commons FileUpload Vulnerabilities in IBM WebSphere MQ Managed File Transfer component (CVE-2016-1000031)

Summary The DiskFileItem class in Apache Commons Fileupload before 1.3.3, as used in IBM WebSphere MQ Managed File Transfer, specifically the Web Gateway component, allows remote attackers to execute arbitrary code under current context of the current process causing an undefined behavior...

Security Bulletin: Security vulnerability in Apache Commons FileUpload used by WebSphere Application Server (CVE-2016-1000031)

Summary There is a potential vulnerability in the Apache Commons FileUpload used by WebSphere Application Server traditional and WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in several products, could allow a...

Security Bulletin: Information disclosure in WebSphere Application Server (CVE-2017-1681)

Summary There is a potential information disclosure vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-1681 DESCRIPTION: IBM WebSphere Application Server IBM Liberty for Java for Bluemix 3.15 could allow a local attacker to obtain sensitive information, caused by...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2013-6440)

Summary There is an information disclosure due to an XML external entity XXE vulnerability when using the OpenSAML features in WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2013-6440 DESCRIPTION: OpenSAML could allow a remote authenticated attacker to obtain sensitive...

Security Bulletin: Security Vulnerabilities in IBM HTTP Server (CVE-2017-9798, CVE-2017-12618)

Summary There is an information disclosure vulnerability and a denial of service vulnerability that affect the IBM HTTP Server used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-9798 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities affect Java Server Faces (JSF) used by WebSphere Application Server (CVE-2017-1583, CVE-2011-4343)

Summary There are two potential infomation disclosure vulnerabilities that affects the Java Server Faces JSF component used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-1583 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive...

Security Bulletin: Cross-Site Scripting vulnerability affects IBM Business Process Manager web Process Designer (CVE-2017-1494)

Summary IBM Business Process Manager web Process Designer is vulnerable to Cross-Site Scripting. Vulnerability Details CVEID: CVE-2017-1494 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

Security Bulletin: XML External Entity (XXE) injection vulnerability affects IBM Business Process Manager (CVE-2017-1527)

Summary IBM Business Process Manager BPM can process XML messages, including messages from untrusted sources. Because of insufficient restriction of an XML parser, XML External Entity injection allows an authenticated remote attacker to send specially crafted XML messages and thus cause a denial ...

Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect IBM Business Process Manager (BPM) Configuration Editor

Summary Security vulnerabilities have been reported for IBM SDK for Node.js. IBM Business Process Manager includes a stand-alone tool for editing configuration properties files that is based IBM SDK for Node.js. Vulnerability Details CVEID: CVE-2017-1000381 DESCRIPTION: c-ares could allow a remot...