Security Bulletin: IBM Content Navigator is affected by a vulnerability in Apache Apache Commons BeanUtils (CVE-2014-0114)

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attack...

Security Bulletin: IBM Content Navigator is affected by a vulnerability in Dojo Toolkit (CVE-2018-15494)

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DataGrid component. A remote attacker could exploit thi...

Security Bulletin: IBM Content Navigator is affected by a vulnerability in Apache HttpComponents HttpClient

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2014-3577 DESCRIPTION: Apache HttpComponents could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the...

The defect-week session of the fourth term: XML external entity injection-vulnerability warning-the black bar safety net

Code audit is the use of static analysis to discover the source code of the security flaws of the method can aid in the development or testing personnel in a software on-line prior to a more comprehensive understanding of its security concerns, preventive measures, and therefore has always been t...

Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M

Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses. According to a lawsuit filed...

Security Bulletin: FileNet Content Management Interoperability Services (CMIS), which ships with IBM Content navigator, is affected by the ability to parse untrusted XML input containing a reference to an external entity

Summary FileNet Content Management Interoperability Services CMIS, which ships with IBM Content Navigator, is affected by the following vulnerability: Ability to process untrusted XML input containing a reference to an external entity that is parsed by a weekly configured XML parser. Vulnerabilit...

Security Bulletin: IBM Content Navigator is affected by a cross site scripting vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1496 DESCRIPTION: IBM Content Navigator is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended...

Security Bulletin: IBM Content Navigator is affected by a common separated value (CSV) vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1366 DESCRIPTION: IBM Content Navigator is vulnerable to Comma Separated Value CSV Injection. An attacker could exploit this vulnerability to exploit other vulnerabilities in spreadsheet...

Security Bulletin: IBM Content Navigator is affected by an XML External Entity Injection (XXE) vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1364 DESCRIPTION: IBM Content Navigator is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

Security Bulletin: FileNet Content Management Interoperability Services (CMIS), which is shipped with IBM Content navigator, is affected by the ability to execute remote attacker’s arbitrary code on a target machine vulnerability

Summary FileNet Content Management Interoperability Services CMIS, which is shipped with IBM Content Navigator, has addressed the following vulnerability. Ability to execute remote attacker’s arbitrary code on a target machine by leveraging the untrusted data in DiskFileItem class of FileUpload...

Security Bulletin: FileNet Collaboration Services is affected by the ability to execute remote attacker’s arbitrary code on a target machine vulnerability

Summary FileNet Collaboration Services has addressed the following vulnerability. Ability to execute remote attacker’s arbitrary code on a target machine by leveraging the untrusted data in DiskFileItem class of FileUpload library Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: IBM...

Security Bulletin: IBM Content Navigator is affected by a cross site scripting vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1522 DESCRIPTION: IBM Content Navigator & CMIS is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM Content Navigator is affected by a cross site scripting vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1502 DESCRIPTION: IBM Content Navigator is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended...

Security Bulletin: FileNet CMIS (FNCMIS) and Content Manager 8 CMIS (CM CMIS) does not verify the incoming Web Services request's message size

Summary Automatically sending number of very large size Web Services SOAP messages can cause DOS attacks. Vulnerability Details CVEID: Not Applicable DESCRIPTION: After an Apache OpenCMIS Client often custom code is successfully authenticated with the repository FN CMIS & CM CMIS and automaticall...

Security Bulletin: IBM Content Navigator Cross Site Scripting Vulnerability

Summary IBM Content Navigator is vulnerable to cross-site scripting Vulnerability Details CVEID: CVE-2017-1331 DESCRIPTION: IBM Content Navigator is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended...

Security Bulletin: IBM Content Navigator Cross Site Scripting Vulnerability

Summary This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEID: CVE-2017-1282 DESCRIPTION: IBM Content Navigator & CMIS is...

Security Bulletin: IBM Content Navigator Cross Site Scripting Vulnerability

Summary This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality, potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEID: CVE-2017-1146 DESCRIPTION: IBM Content Navigator and CMIS are...

Security Bulletin: Security Vulnerability affecting FileNet Content Manager and IBM Content Foundation (CVE-2013-5462)

Summary A "Clickjacking" security vulnerability affects the IBM Content Navigator toolkit which is used by the Administration Console for Content Engine ACCE tool. This tool is packaged with both the FileNet Content Manager and IBM Content Foundation products. The Administration Console for Conte...

Security Bulletin: Content Manager Services for Lotus Quickr (CVE-2016-3092)

Summary IBM Lotus Quickr Connectors bundled in IBM Content Navigator's Collaboration Services is affected by an Apache Commons File Upload vulnerability. IBM Lotus Quickr has resolved this vulnerability Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION:Apache Tomcat is vulnerable to a denial...

Security Bulletin: Vulnerability in Apache Commons affects IBM Content Navigator (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Content Navigator. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by...