Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.29

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 7.0.0.29 Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0541 PM74909 DESCRIPTION: WebSphere Application Server is vulnerable to a denial of service, caused by a buffer overflow on Windows...

Security Bulletin: Security Vulnerabilites fixed in IBM WebSphere Application Server 8.5.0.2

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.5.0.2 Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0458 PM71139 DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of...

Security Bulletin: TRIRIGA Application Platform Open Redirect Vulnerabilities. (CVE-2014-8894)

Abstract IBM TRIRIGA Application Platform could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. By sending a specially crafted URL, an attacker could exploit this vulnerability using the out parameter to redirect a victim to arbitrary Web sites...

Security Bulletin: Application not signed properly in IBM Sterling External Authentication Server (CVE-2013-0521)

Abstract IBM Sterling External Authentication Server is vulnerable to running untrusted code. Content VULNERABILITY DETAILS CVE ID: CVE-2013-0521 DESCRIPTION: Java Webstart App is not signed correctly The IBM Sterling External Authentication Server Webstart GUI is signed with a self-signed...

Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826).

Abstract Vulnerability in IBM DB2 could allow an authenticated user to cause a stack-based buffer overflow and possibly attain remote code execution. Content VULNERABILITY DETAILS CVE ID: CVE-2012-4826 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allo...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.5

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.0.0.5 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...

Security Bulletin: Cross-Site Scripting vulnerability in IBM InfoSphere Information Server (CVE-2013-0502)

Abstract Security Bulletin: Cross-Site Scripting vulnerability in IBM InfoSphere Information Server CVE-2013-0502 Content SUMMARY: A Cross-Site Scripting vulnerability exists in the Web Console of IBM InfoSphere Information Server that may lead to unauthorized access when a user is tricked into...

Security Bulletin: Potential Security Exposure in IBM HTTP Server CVE-2013-0169 PM85211

Abstract Potential Security Exposure with IBM HTTP Server for WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0169 PM85211 DESCRIPTION: The TLS protocol in the GSKIT component of the IBM HTTP Server does not properly consider timing side-channel attacks, which could...

Security bulletin: Potential security vulnerabilities in IBM DataQuant with JRE 6

Abstract IBM® DataQuant makes use of Java Runtime Environment JRE Version 6. This security bulletin explains how to address potential security exposures with IBM DataQuant for z/OS and IBM DataQuant for Multiplatforms due to vulnerabilities in Java Software Developer Kits. See ‘Vulnerability...

Security Bulletin: IBM PureData System for Operational Analytics A1791 and IBM Smart Analytics System 7600, 7700, and 7710 are affected by a privilege escalation vulnerability in the DB2 Audit Facility (CVE-2013-3475)

Abstract The IBM PureData System for Operational Analytics A1791, IBM Smart Analytics System 7600, IBM Smart Analytics System 7700, and IBM Smart Analytics System 7710 are shipped with DB2 9.7 or DB2 10.1. These versions of DB2 contain a security vulnerability in the DB2 Audit Facility which allo...

Security Bulletin: Multiple security vulnerabilities addressed in IBM Sterling Secure Proxy (CVE-2013-0518, CVE-2013-0519, CVE-2013-0520)

Abstract IBM Sterling Secure Proxy is vulnerable to spoofing and information disclosure attacks. Content VULNERABILITY DETAILS CVE ID: CVE-2013-0518 DESCRIPTION: Application Pages Do Not Break Out of 3rd Party HTML Frames. IBM Sterling Secure Proxy Configuration Manager pages permit rendering...

Security Bulletin: Vulnerability in IBM SPSS Data Collection due to issues in Eclipse Help System (CVE-2013-0464, CVE-2013-0467)

Abstract The version of IBM Eclipse Help System that is shipped with IBM SPSS Data Collection versions 6.0, 6.0.1 "Data Collection" and 7.0 has multiple security vulnerabilities. These vulnerabilities allow attackers to perform cross-site scripting and source code disclosure attacks. Content...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.0.1

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.5.0.1 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...

Security Bulletin: Potential Security exposure in IBM HTTP Server CVE-2013-1862 PM87808

Abstract Potential Security exposure in IBM HTTP Server for WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-1862 DESCRIPTION: IBM HTTP Server optional modrewrite module does not properly filter terminal escape sequences from logs, which could make it easier for a remot...

Security Bulletin: Possible Security Exposure in WebSphere Application Server CVE-2013-0597 PM85834

Abstract Potential security exposure in WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0597 PM85834 and PM87131 DESCRIPTION: WebSphere Application Server using OAuth could allow a remote attacker to obtain someone else's credentials. A remote attacker could exploit th...

Security bulletin: Open redirect and cross-site scripting vulnerabilities in DB2 QMF for Workstation and DB2 QMF for WebSphere help systems (CVE-2012-2159, CVE-2012-2161)

Abstract IBM DB2 QMF for Workstation and IBM DB2 QMF for WebSphere make use of the IBM Eclipse Help System IEHS, which has the security vulnerabilities described in this bulletin. Content VULNERABILITY DETAILS: A brief description of each vulnerability is provided below. IBM does not intend to...

Security Bulletin: Potential Security Vulnerability fixed in WebSphere Virtual Enterprise (CVE-2013-5425)

Abstract Potential Security vulnerability fixed in WebSphere Virtual Enterprise Content VULNERABILITY DETAILS: CVE ID:CVE-2013-5425PM93828 DESCRIPTION: IBM WebSphere Virtual Enterprise may be vulnerable to cross-site scripting in the Administration Console caused by improper validation of...

Security Bulletin: Remote Escalation of Privilege Vulnerability in DB2 Administration Server (CVE-2012-0711)

Abstract Vulnerability in IBM DB2 Administrator Server could allow an escalation of privilege attack. Content VULNERABILITY DETAILS CVE ID: CVE-2012-0711 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability in the DB2 Administration Server DAS which would allow an...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.3

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.0.0.3. Content CVE ID:CVE-2012-0720 PM52274 DESCRIPTION: WebSphere Application Server Administration Console is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 6.1.0.43

Abstract Cross reference list for security vulnerabilities fixed in WebSphere Application Server Fix Pack 6.1.0.43 Content VULNERABILITY DETAILS: CVE ID:CVE-2011-1376 PM49712 DESCRIPTION: IBM Websphere Application Server, when running on IBM i operating systems, applies insecure permissions to...