Security Bulletin: IBM QRadar SIEM contains hard-coded credentials (CVE-2016-2880)

Summary An IBM QRadar SIEM user with shell access could obtain the encryption key used to encrypt certain passwords. Vulnerability Details CVEID: CVE-2016-2880 DESCRIPTION: IBM QRadar stores the encryption key used to encrypt the service account password which can be obtained by a local user. CVS...

Security Bulletin: Apache POI as used in IBM QRadar SIEM is vulnerable to various CVEs.

Summary Vulnerabilities affecting Apache Poi as used in IBM QRadar SIEM Vulnerability Details CVE-ID: CVE-2012-0213 Description: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compound File Binary...

Security Bulletin: IBM QRadar SIEM is vulnerable to various CGI vulnerabilities. (CVE-2016-5385, CVE-2016-5387, CVE-2016-5388)

Summary Vulnerabilities affecting web servers that run code in a CGI or CGI-like context Vulnerability Details CVEID: CVE-2016-5387 DESCRIPTION: Apache HTTP Server could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the failure to protect applications from the...

Security Bulletin: IBM QRadar SIEM is vulnerable to OS command injection. (CVE-2016-2875)

Summary It is possible to inject a payload with OS Commands in QRadar which are run as root on the host OS. Vulnerability Details CVE-ID: CVE-2016-2875 Description: IBM QRadar could allow an authenticated user to inject operating system commands that would be executed with root privileges. CVSS...

Security Bulletin: IBM QRadar SIEM is vulnerable to Cross Site Request Forgery. (CVE-2016-2878)

Summary Instances of Cross-Site Request Forgery have been found in IBM QRadar SIEM. Vulnerability Details CVE-ID: CVE-2016-2878 Description: IBM QRadar is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a...

Security Bulletin: OpenSSL as used in IBM QRadar SIEM is vulnerable to multiple CVE's.

Summary OpenSSL vulnerabilities disclosed on May 3 2016, https://www.openssl.org/news/secadv/20160503.txt plus CVE-2016-2842. Vulnerability Details CVE-ID: CVE-2016-2105 Description: OpenSSL is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the EVPEncodeUpdate...

Security Bulletin: IBM Java as used in IBM QRadar SIEM is vulnerable to information disclosure. (CVE-2016-3426)

Summary All applicable CVEs from Oracle's January 2016 CPU, plus CVE-2016-0636 and three additional IBM-specific vulnerabilities CVE-2016-0363, CVE-2016-0376, and CVE-2016-0264. Vulnerability Details CVEID: CVE-2016-3426 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE...

Security Bulletin: IBM QRadar SIEM and Incident Forensics relies on an untrusted input. (CVE-2016-2881)

Summary The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. Vulnerability Details CVE-ID: CVE-2016-2881 Description: IBM QRadar and Incident Forensics...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect authorization. (CVE-2016-2874)

Summary The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Vulnerability Details CVE-ID: CVE-2016-2874 Description: IBM QRadar under some configurations allow product authorization rules to be bypassed...

Security Bulletin: IBM QRadar SIEM is vulnerable to cross-site scripting. (CVE-2016-2869)

Summary Cross-Site Scripting was found in various fields in the QRadar UI. Vulnerability Details CVE-ID: CVE-2016-2869 Description: IBM QRadar is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a...

Security Bulletin: IBM QRadar SIEM is vulnerable to clear text passwords. (CVE-2016-2871)

Summary Some passwords in IBM QRadar SIEM were found in configuration files in clear text. Vulnerability Details CVE-ID: CVE-2016-2871 Description: IBM QRadar stores passwords in clear text in configuration files, that could allow a local user to obtain critical sensitive information and gain...

Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-2877)

Summary The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Vulnerability Details CVE-ID: CVE-2016-2877 Description: IBM QRadar could allow a local user to write files to certain web accessible...

Security Bulletin: IBM QRadar SIEM contains unnecessary privilege usage. (CVE-2016-2876)

Summary Multiple processes run by IBM QRadar SIEM use higher than necessary privileges, which can be abused due to other shell command injection vulnerabilities. Vulnerability Details CVE-ID: CVE-2016-2876 Description: IBM QRadar could allow an authenticated user to inject operating system comman...

Security Bulletin: IBM QRadar SIEM is vulnerable to SQL Injection. (CVE-2016-2873)

Summary IBM QRadar SIEM was found to be vulnerable to SQL injection. Vulnerability Details CVE-ID: CVE-2016-2873 Description: IBM QRadar is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete...

Security Bulletin: Samba as used in IBM QRadar SIEM is vulnerable to multiple CVE's. (CVE-2016-2110, CVE-2016-2112, CVE-2016-2115)

Summary Samba is susceptible to multiple vulnerabilities as used in IBM QRadar SIEM. Vulnerability Details CVE-ID: CVE-2016-2110 Description: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to protect the feature negotiation of NTLMSSP from a downgrade. ...

Security Bulletin: IBM QRadar SIEM and Incident Forensics are vulnerable to a path traversal attack. (CVE-2016-2872)

Summary Vulnerabilities found in both QRadar SIEM and Incident Forensics allow for path traversal via improperly handled parameters. Vulnerability Details CVE-ID: CVE-2016-2872 Description: IBM QRadar could allow a remote attacker to traverse directories on the system. An attacker could send a...

Security Bulletin: IBM QRadar SIEM is vulnerable to untrusted XML External Entity uploads. (CVE-2016-2868)

Summary XML External Entity injection in the UI of QRadar allows someone with privileges to upload unvalidated XML. Vulnerability Details CVE-ID: CVE-2016-2868 Description: IBM QRadar could allow a remote attacker with administrator privileges to obtain sensitive information, caused by an error...

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to improper authentication. (CVE-2016-2968)

Summary Improper Authentication in QRadar Incident Forensics Vulnerability Details CVE-ID: CVE-2016-2968 Description: IBM QRadar does not perform or incorrectly performs an authorization check allowing users access to data they don't normally have permissions to see. CVSS Base Score: 6.5 CVSS...

Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is susceptible to multiple vulnerabilities. (CVE-2015-5345, CVE-2016-0706, CVE-2016-0714, CVE-2015-5174)

Summary Open Source Apache Tomcat is susceptible to multiple vulnerabilities. Vulnerability Details CVE-ID: CVE-2015-5345 Description: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an error when accessing a protected directory. By redirecting to the URL, a...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM QRadar SIEM and QRadar Incident Forensics.

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM QRadar SIEM and Incident Forensics. IBM QRadar SIEM and Incident Forensics has addressed the applicable CVEs including the “DROWN: Decrypting RSA with Obsolete and Weakened encryption"...