Security Bulletin: Multiple vulnerability issues affect IBM Spectrum Symphony 7.3.1

Summary This interim fix provides instructions on upgrading third parity libraries in IBM Spectrum Symphony 7.3.1 in order to address security vulnerabilities CVE-2015-6420, CVE-2019-1311, CVE-2015-4852, CVE-2017-15708, CVE-2015-7501, CVE-2017-18214, CVE-2016-1000027, CVE-2019-8331, CVE-2016-7103...

Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2020-1968, CVE-2020-1971)

Summary There are vulnerabilities in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could exploit this vulnerabilit...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server October 2020 CPU that is bundled with IBM WebSphere Application Server Patterns

Summary There are multiple vulnerabilities in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the IBM Java SDK updates in October 2020. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability i...

Security Bulletin: IBM MQ Appliance is affected by a denial of service vulnerability (CVE-2020-4869)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID: CVE-2020-4869 DESCRIPTION: IBM MQ Appliance is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker could send a specially crafted SNMP query to cause the appliance t...

Security Bulletin: Information disclosure and Denial of Service vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2020-4794

Summary The optional component Process Federation Server that is shipped with IBM Business Process Manager and IBM Business Automation Workflow is vulnerable to a information disclosure and denial of service attack. Vulnerability Details CVEID: CVE-2020-4794 DESCRIPTION: IBM Process Federation...

CVE-2020-4849

CVE-2020-4849 affects IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7. The issue is a reverse tabnabbing flaw that could allow a remote attacker to bypass security restrictions and direct a victim to a phishing site. IBM references remediation: upgrade to 7.1.0.20 (FP20). Connect...

Security Bulletin: Older version of common Open Source: batik-dom-1.9.1.jar found in the MaximoForgeViewerPlugIn which is shipped with IBM Maximo for Civil Infrastructure

Summary There is an older version of common Open Source: batik-dom-1.9.1.jar found in the Maximo data loader which is shipped with IBM Maximo for Civil Infrastructure. In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream a...

Security Bulletin: Information disclosure vulnerability may affect IBM Business Automation Workflow - CVE-2020-4900

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to an information disclosure attack. Vulnerability Details CVEID: CVE-2020-4900 DESCRIPTION: IBM Business Automation Workflow stores potentially sensitive information in log files that could be read by a loca...

Security Bulletin: Eclipse Jetty (Publicly disclosed vulnerability) affects Content Classifaction

Summary Eclipse Jetty could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in the creation of the temporary subdirectory. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated...

Security Bulletin: IBM Content Classification is affected by a Eclipse Jetty (Publicly disclosed vulnerability)

Summary In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output. Vulnerability Details CVEID:...

AIX 7.2 TL 5 : power9 (IJ28226)

https://vulners.com/cve/CVE-2020-4788 https://vulners.com/cve/CVE-2020-4788 IBM Power9 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. C Tenable Network Security, Inc. The text in the description was extracted from...

Security Bulletin: Security vulnerability affects the Report Builder that is shipped with Jazz Reporting Service (CVE-2020-4718)

Summary There is a security vulnerability in the Report Builder shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2020-4718 DESCRIPTION: IBM Jazz Reporting Service is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code ...

Security Bulletin: Cross-site scripting vulnerability affects IBM Business Automation Workflow - CVE-2020-4672

Summary IBM Business Automation Workflow are vulnerable to a cross-site scripting attack. Vulnerability Details CVEID: CVE-2020-4672 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U...

Security Bulletin: IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on the system (CVE-2020-4650)

Summary IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on the system. Vulnerability Details CVEID: CVE-2020-4650 DESCRIPTION: IBM Maximo Spatial Asset Management allows web pages to be stored locally which can be read by another user on...

Security Bulletin: IBM Maximo Spatial Asset Management is vulnerable to cross-site request forgery (CVE-2020-4651)

Summary IBM Maximo Spatial Asset Management is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Vulnerability Details CVEID: CVE-2020-4651 DESCRIPTION: IBM Maximo Spatial Asset...

Security Bulletin: Vulnerability in WebSphere Application Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2020-4782)

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. A vulnerability has been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details Refer to the...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2020 - Includes Oracle Jul 2020 CPU vulnerability

Summary Vulnerability exposure CVE-2020-14577 from Oracle Jul 2020 QuarterlyCPU in IBM® SDK Java™ may affect Java SDK used in IBM Operations Analytics Predictive Insights 1.3.3, 1.3.3.5, 1.3.6. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. Vulnerability Details...

Security Bulletin: Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Summary Apache Struts is vulnerable to a denial of service, caused by an access permission override when performing a file upload. By sending a specially crafted request, an attacker could exploit this vulnerability to cause subsequent upload actions to fail. Vulnerability Details CVEID:...

Security Bulletin: Embedded WebSphere Application Server is vulnerable to an information disclosure vulnerability affects Content Collector for Email

Summary IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. Vulnerability Details CVEID: CVE-2020-462...

Security Bulletin: Embedded WebSphere Application Server is vulnerable to a remote command execution vulnerability affects Content Collector for Email

Summary IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to...