Security Bulletin: Potential Security exposures with WebSphere Application Server (CVE-2014-4770 and CVE-2014-4816)

Summary There is a potential cross-site scripting XSS and a potential cross-site request forgery CSRF security vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2014-4770 Description: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused ...

IBM WebSphere Cast Iron Security Bulletin: Security vulnerability in IBM JRE 6 and IBM JRE 7

Abstract Security vulnerability exist in the IBM Java Runtime Environment component of WebSphere Cast Iron in IBM JRE 6.0 SR15 FP1 and earlier and IBM JRE 7.0 SR6 FP1 and earlier Content VULNERABILITY DETAILS There is a security vulnerability in the IBM Java Runtime Environment used in WebSphere...

Security Bulletin: Information disclosure in IBM Business Process Manager (BPM) V8.5 document attachments search (CVE-2014-4759)

Summary IBM BPM document attachment queries can return document properties that contain sensitive information. Vulnerability Details CVE ID: CVE-2014-4759 DESCRIPTION: An Ajax service that is shipped with the Content Management toolkit allows users to search for IBM BPM document attachments from...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server July 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details The following three advisories are included in the IBM® SDK...

Security Bulletin: Unauthorized disclosure of system information in IBM Business Process Manager (BPM) 8.5.x (CVE-2014-3076)

Summary System information is provided on an unprotected diagnostic page. Vulnerability Details CVEID: CVE-2014-3076 DESCRIPTION: IBM Business Process Manager 8.5 contains an unprotected JavaServer™ Pages JSP file that returns system information to unauthenticated users. An attacker might use thi...

Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere eXtreme Scale

Summary Three security vulnerabilities were identified in the IBM® SDK, Java™ Technology Edition provided with WebSphere eXtreme Scale. Vulnerability Details CVEID: CVE-2014-0878 DESCRIPTION: A vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom cryptographic...

Security Bulletin: Multiple security vulnerabilities exist in the IBM SDK, Java Technology Edition provided with WebSphere DataPower XC10 Appliance

Summary Three security vulnerabilities were identified in the IBM® SDK, Java™ Technology Edition provided with WebSphere DataPower XC10 Appliance. Vulnerability Details CVEID: CVE-2014-0878 DESCRIPTION: A vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom...

Security Bulletin: IBM WebSphere Lombardi Edition and IBM Business Process Manager (BPM) cross-site scripting vulnerability in error situations (CVE-2014-0957)

Summary When you invoke a service using a URL, user input can be returned in unhandled service failure situations. Vulnerability Details CVE ID: CVE-2014-0957 DESCRIPTION: IBM WebSphere Lombardi Edition and IBM Business Process Manager are vulnerable to cross-site scripting that is caused by the...

IBM WebSphere Cast Iron Security Bulletin: Multiple security vulnerabilities in IBM JRE 6 and IBM JRE 7

Abstract Multiple security vulnerabilities exist in the IBM Java Runtime Environment component of WebSphere Cast Iron in IBM JRE 6.0 SR15 and earlier and IBM JRE 7.0 SR5 and earlier Content VULNERABILITY DETAILS There are multiple security vulnerabilities in the IBM Java Runtime Environment used ...

Security Bulletin: Potential Security exposure with WebSphere Application Server (CVE-2014-3070)

Summary There is a potential bypass security vulnerability in WebSphere Application Server Version 8.0 and higher with Virtual Member Manager VMM. Vulnerability Details CVEID: CVE-2014-3070 Description: WebSphere Application Server could allow a remote attacker to bypass security restrictions...

Security Bulletin: ClassLoader manipulation with Apache Struts (CVE-2014-0114) affects WebSphere Lombardi Edition and IBM Business Process Manager (BPM)

Summary There is a class loader manipulation vulnerability in Apache Struts CVE-2014-0114 that affects WebSphere Lombardi Edition and IBM Business Process Manager. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts 1.X might allow a remote attacker to execute arbitrary code on...

Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2014-0114)

Summary There is a classloader manipulation vulnerability in the Apache Struts 1 that is used by IBM WebSphere Application Server shipped with IBM WebSphere Service Registry and Repository v6.2, v6.3, v7.0 and v7.5. Vulnerability Details This vulnerability is fixed within WebSphere Application...

Security Bulletin: Missing authorization concept for IBM Business Process Manager (BPM) User Attributes CVE-2014-0908

Summary The User Attribute feature in IBM Business Process Manager does not have an authorization concept. Vulnerability Details As a consequence, each user can read and update their own attribute values and the attribute values for another user by using REST APIs. However, there are...

Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: Multiple security vulnerabilities in IBM JRE

Summary This Security Bulletin addresses the security vulnerabilities that have shipped with the IBM Java Runtime Environment JRE included in IBM Operational Decision Manager and IBM ILOG JRules. IBM ODM and ILOG JRules now include the most recent version of the IBM JRE which fixes the security...

Security Bulletin: Potential Security vulnerability in IBM HTTP Server CVE-2013-6747

Summary Potential security exposure in IBM HTTP Server for WebSphere Application Server. Vulnerability Details CVE ID: CVE-2013-6747 DESCRIPTION: IBM HTTP Server may be vulnerable to a denial of service, caused by an error in the GSKit component. By initiating an SSL/TLS connection using a...

Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for WebSphere Application Server January 2014 CPU

Summary Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM WebSphere Application Server Vulnerability Details The IBM WebSphere Application Server is shipped with an IBM SDK for Java that is based on the Oracle JDK. Oracle has released January 2014 critical...

Security Bulletin: Potential Security Vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8 Vulnerability Details CVE ID:CVE-2013-0460PM72275 DESCRIPTION: WebSphere Application Server could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in...

AIX 7.2 TL 0 : variant4 (IJ05821) (Spectre)

https://vulners.com/cve/CVE-2018-3639 https://vulners.com/cve/CVE-2018-3639 C Tenable Network Security, Inc. The text in the description was extracted from AIX Security Advisory variant4advisory.asc. include'compat.inc'; if description scriptid109953; scriptversion"1.12";...

Vulnerability in OpenSSL affects AIX (CVE-2018-0739)

IBM SECURITY ADVISORY First Issued: Mon Apr 30 11:00:38 CDT 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory26.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory26.asc...

CVE-2015-4954

IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to conduct spoofing attacks via unspecified vectors. IBM X-Force ID: 105200...