Security Bulletin: COGNOS DIRECT INTEGRATION ACCESS REMAINS OPEN AFTER CLOSING MAXIMO SESSION (CVE-2014-6102)

Summary IBM Maximo Asset Management could allow a user to access Cognos BI even after the Maximo session is closed. Vulnerability Details CVE-ID: CVE-2014-6102 DESCRIPTION: IBM Maximo Asset Management could allow a local user to bypass security on another user's Maximo session due to it improperl...

Security Bulletin: TRIRIGA Application Platform Cross Site Scripting Vulnerabilities. (CVE-2014-8893)

Summary IBM TRIRIGA Application Platform is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the...

Security Bulletin: Vulnerability in SSLv3 affects Tivoli Storage Manager Administration Center (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Tivoli Storage Manager Administration Center. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to...

Security Bulletin: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914)

Summary Cross-site scripting security vulnerability on Query Description Field in Maximo Asset Mgmt, Tivoli Asset Mgmt for IT, and SmartCloud Control Desk. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions...

Security Bulletin: HTTP Header Injection Vulnerability Addressed in Asset and Service Management (CVE-2014-3026)

Summary Header injection in HTTP responses can allow for HTTP response splitting, Session fixation via the Set-Cookie header, cross-site scripting XSS, and malicious redirects attacks via the location header in Maximo Asset Mgmt, and SmartCloud Control Desk. Vulnerability Details DESCRIPTION:...

Security Bulletin: IBM Tivoli Network Manager IP Edition V39 Fix Pack 4 HTTPS support for Perl Collector install is affected by the following OpenSSL vulnerabilities: (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195 and CVE-2014-3470)

Summary Security vulnerabilities have been discovered in OpenSSL 9.7d package that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/T...

Security Bulletin: Vulnerabilities in IBM Tivoli Monitoring agent and shared library with potential for privilege escalation (CVE-2013-5467)

Summary Privilege escalation vulnerability in an IBM Tivoli Monitoring ITM agent could be exploited by a local user to gain elevated privilege of another user. This vulnerability also affects a shared library shipped with all ITM components and agents. Vulnerability Details CVEID: CVE-2013-5467...

Security Bulletin: Potential Security Vulnerability With Maximo Asset Management

Summary Smarter Infrastructure Products - Potential cross-site scripting vulnerability when using Maximo Asset Management and SmartCloud Control Desk products. Vulnerability Details CVE IDs: CVE-2013-5402 DESCRIPTION: CVE ID| DESCRIPTION ---|--- CVE-2013-5402 CVSS Base Score: 3.5 CVSS Temporal...

Potential security vulnerability with IBM WebSphere Application Server

Abstract Security Bulletin: Asset and Service Management Products - Potential security exposure with IBM WebSphere application server after installing fix for APAR PM44303 CVE-2012-3325 Content VULNERABILITY DETAILS: CVE ID: CVE-2012-3325 DESCRIPTION: Customers that have installed a Websphere...

Security Bulletin: IBM StoredIQ is affected by a privilege escalation vulnerability

Summary IBM StoredIQ has addressed the following vulnerability that could allow an authenticated attacker to bypass certain security restrictions. Vulnerability Details CVEID: CVE-2018-1583 DESCRIPTION: IBM StoredIQ could allow an authenticated attacker to bypass certain security restrictions. By...

Security Bulletin: IBM StoredIQ for Legal has released Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 for IBM StoredIQ for Legal in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions Affected Product...

Security Bulletin: IBM Content Collector for Email affected by vulnerability due to WebSphere Application Server having insecure permissions when custom start up scripts are used

Summary IBM Content Collector for Email is affected by vulnerability due to WebSphere Application Server having insecure permissions when custom start up scripts are used. WAS might create files using the default permissions instead of the customized permissions, due to which a local attacker cou...

Security Bulletin: IBM Atlas eDiscovery Process Management vulnerable to unsafe third-party links.

Summary Atlas eDiscovery Process Management has addressed the following vulnerability: An authenticated attacker could obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. The third-party links with target="blank" attribute and no rel="noopener noreferrer"...

Security Bulletin: IBM Atlas eDiscovery Process Management vulnerable to SQL injection.

Summary Atlas eDiscovery Process Management has addressed vulnerablility due to SQL injection, where a remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU affect IBM Content Collector for SAP Applications

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID:...

Security Bulletin: Sweet32 Birthday attacks on 64-bit block ciphers in TLS affect Content Manager for z/OS (CVE-2016-2183)

Summary System SSL's SSL V2, SSL V3 and TLS protocols support the use of Triple DES ciphers and are susceptible to the Sweet32 Birthday attack vulnerability. This vulnerability affects exploiters acting as either clients or servers. Content Manager 8 Resource Manager on z/OS uses System SSL and...

Security Bulletin: Open Source Apache Tomcat Commons FileUpload Vulnerabilities affects Atlas Policy Suite (CVE-2016-3092)

Summary Apache Commons Fileupload vulnerability affects Atlas Policy Suite Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could...

Security Bulletin: Vulnerability in nginx affects IBM StoredIQ (CVE-2016-4450)

Summary A denial of service vulnerability was disclosed on May 31, 2016 by nginx. Nginx is used by StoredIQ. StoredIQ has addressed the applicable CVE Vulnerability Details CVE-ID: CVE-2016-4450 Description: nginx is vulnerable to a denial of service, caused by a NULL pointer dereference error in...

Security Bulletin:IBM WebSphere deserialization of untrusted data in IBM eDiscovery Manager

Summary IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a serialized object from untrusted sources. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java cod...

Security Bulletin: Content Manager OnDemand for Multiplatforms is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-0729)

Summary Content Manager OnDemand for Multiplatforms is affected by Open Source Apache Xerces-C XML parser Vulnerabilities. Vulnerability Details CVEID: CVE-2016-0729 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during...