Security Bulletin: GNU Tar sparse_dump_region function denial of service affects IBM Spectrum LSF Application Center

Summary GNU Tar sparsedumpregion function denial of service affects IBM Spectrum LSF Application Center Vulnerability Details CVEID: CVE-2018-20482 DESCRIPTION: GNU Tar sparsedumpregion function denial of service CVSS Base Score: 3.3 CVSS Temporal Score: See for the current score CVSS Environment...

Security Bulletin: Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF

Summary Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF Vulnerability Details CVE-2017-16007 BDSA-2017-0101 Nimbus JOSE+JWT implemented the ECDH-ES encryption option of the 'JSON Web Encryption' standard in a way that is vulnerable to cryptanalysis. This would enable ...

Security Bulletin: IBM Spectrum Scale Transparent Cloud Tiering is affected by multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Transparent Cloud Tiering. Transparent Cloud Tiering has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-3139 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to...

Security Bulletin: Public disclosed vulnerabilities from Apache HttpComponents affects IBM Spectrum LSF

Summary Public disclosed vulnerabilities from Apache HttpComponents affects IBM Spectrum LSF: CVE-2012-6153, CVE-2014-3577 Vulnerability Details Brief Description: Apache HttpComponents CN spoofing CVE-ID: CVE-2012-6153 Description: Apache HttpComponents could allow a remote attacker to conduct...

Security Bulletin: Public disclosed vulnerability from Apache HttpComponents affects IBM Spectrum LSF

Summary Public disclosed vulnerability from Apache HttpComponents affects IBM Spectrum LSF: CVE-2011-1498 Vulnerability Details Apache HttpComponents Client CVE-2011-1498 Affected version: HttpClient 4.x before 4.1.1 Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an...

Security Bulletin: Public disclosed vulnerabilities from Jackson-databind affects IBM Spectrum LSF

Summary Public disclosed vulnerabilities from Jackson-databind affects IBM Spectrum LSF: CVE-2017-7525, CVE-2017-15095, CVE-2017-17485, CVE-2018-5968, CVE-2018-7489 Vulnerability Details CVE-2017-7525 Jackson-databind Also implemented in JBoss BPM Suite is vulnerable to remote code execution when...

Security Bulletin: Denial of Service vulnerability in Guava (CVE-2018-10237) affects IBM Spectrum LSF Application Center

Summary Denial of Service vulnerability in Guava CVE-2018-10237 affects IBM Spectrum LSF Application Center Vulnerability Details CVEID: CVE-2018-10237 DESCRIPTION: Google Guava AtomicDoubleArray and CompoundOrdering class denial of service CVSS Base Score: 7.5 CVSS Temporal Score: See...

CVE-2018-1775

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757...

CVE-2018-1775

CVE-2018-1775 affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products. The vulnerability allows an authenticated user to download arbitrary files from the operating system via the Service Assistant GUI. Affected software includes versions 7.5 through ...

Security Bulletin: Multiple Samba vulnerabilities affect IBM Spectrum Protect Plus (CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919)

Summary There are multiple security vulnerabilities in Samba that affect IBM Spectrum Protect Plus. These vulnerabilities may result in potential information disclosure, denial of service, or execution of arbitrary code on the system. Vulnerability Details CVEID: CVE-2018-1139 DESCRIPTION: Samba...

Security Bulletin: Multiple vulnerabilities in Oracle Java SE affect IBM Spectrum Protect Plus (CVE-2018-3136, CVE-2018-3139, CVE-2018-3149, CVE-2018-3169, CVE-2018-3180, CVE-2018-3183, CVE-2018-3214, CVE-2018-13785)

Summary There are multiple vulnerabilities in Oracle Java SE which is used by IBM Spectrum Protect™ Plus. These issues were disclosed as part of the Oracle Critical Patch Update CPU in October 2018. Vulnerability Details CVEID: CVE-2018-3136 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2018-3139, CVE-2018-3180)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center and IBM Spectrum Protect formerly Tivoli Storage Manager Client Management Service. These issues were disclosed as part of the IBM Ja...

Security Bulletin: Cross-Site Scripting vulnerabilities in IBM Spectrum Protect Operations Center (CVE-2018-1854, CVE-2018-1855)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting which can result in disclosure of credentials within a trusted session. Vulnerability Details CVEID: CVE-2018-1854 DESCRIPTION: IBM Tivoli Storage Manager Operations Center is...

Security Bulletin: Password disclosure via trace log in IBM Spectrum Protect Operations Center (CVE-2018-1769)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center my display the password in plain text in the trace file when tracing is turned on. Vulnerability Details CVEID: CVE-2018-1769 DESCRIPTION: IBM Tivoli Storage Manager Operations Center could disclose sensitive informati...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Conductor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ versions 8 used by IBM Spectrum Conductor with Spark 2.2.0, 2.2.1 and IBM Spectrum Conductor 2.3.0. IBM Spectrum Conductor has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the...

Security Bulletin: Public disclosed vulnerability from Spring Framework affects IBM Spectrum LSF Explorer

Summary Public disclosed vulnerability from Spring Framework affects IBM Spectrum LSF Explorer Vulnerability Details CVE-ID:CVE-2018-15756 Description: Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By...

Security Bulletin: Public disclosed vulnerability from Spring Framework affects IBM Spectrum LSF Application Center

Summary Public disclosed vulnerability from Spring Framework affects IBM Spectrum LSF Application Center Vulnerability Details CVE-ID:CVE-2018-15756 Description: Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the...

Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale (CVE-2018-1901)

Summary There is a vulnerability in IBM WebSphere Application Server, used by IBM Spectrum Scale. This issue allow a remote attacker to temporarily gain elevated privileges on the system. Vulnerability Details IBM WebSphere Application Server is used to provide graphical user interface for managi...

Security Bulletin: IBM Spectrum Protect (formerly Tivoli Storage Manager) Unix Clients are vulnerable to unauthorized access to files by non-privileged users (CVE-2017-1301)

Summary IBM Spectrum Protect formerlyTivoli Storage Manager Unix Clients may use a symbolic link to provide non-privileged users access to files that require root privileges. Vulnerability Details CVEID: CVE-2017-1301 DESCRIPTION: IBM Spectrum Protect could allow a local attacker to launch a...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect (formerly Tivoli Storage Manager) Client

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect formerly Tivoli Storage Manager Client. The IBM Spectrum Protect Client has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to...