Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to spoofing attacks due to WAS Liberty (CVE-2018-25031, CVE-2021-46708)

Summary IBM Sterling Partner Engagement Manager has addressed all vulnerabilities published by WAS liberty below. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, a...

Security Bulletin: WAS Liberty vunerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson™ Speech Services 1.1)

Summary Bypass security restrictions in WAS Liberty affecting IBM Watson Text to Speech and Speech to Text Vulnerability Details CVEID:CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session...

Security Bulletin: Two vulnerabilities in WAS Liberty affect IBM Transformation Extender Advanced and IBM Standards Processing Engine (CVE-2016-0378 and CVE-2016-5986)

Summary Two vulnerabilities have been found in WAS Liberty, which is shipped in IBM Transforation Extender Advanced and IBM Standards Processing Engine. IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by improper handling of exceptions...

Security Bulletin: Security Vulnerability in IBM® Java SDK affect IBM Rational Team Concert Apr 2019 CPU

Summary There is a security vulnerability in IBM® SDK Java Technology Edition, Version 1.7 and 1.8 that is used by Rational Team Concert RTC. This issue was disclosed as part of the IBM Java SDK updates in April 2019. Vulnerability Details CVEID: CVE-2019-2602 DESCRIPTION: An unspecified...

Security Bulletin: Bypass security restrictions in WAS Liberty

Summary There are multiple vulnerabilities in IBM® WebSphere Liberty ,Version 8.5.5.8 used by IBM Tivoli Application Dependency Discovery Manager TADDM Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass securi...

Security Bulletin: Security vulnerability in WAS Liberty used by IBM Transformation Extender Advanced (CVE-2017-1681)

Summary A security vulnerability was found in WebSphere Application Server Liberty Profile used by IBM Transformation Extender Advanced. The vulnerability has been addressed. Vulnerability Details CVEID: CVE-2017-1681 DESCRIPTION: IBM WebSphere Application Server IBM Liberty for Java for Bluemix...

Security Bulletin: Vulnerabilities in WAS Liberty affect IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center

Summary There are vulnerabilities in WAS Liberty used by IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Security Bulletin: Bypass security restrictions in WAS Liberty

Summary IBM MobileFirst Platform Foundation has addressed the following vulnerability. Bypass security restrictions in WAS Liberty . Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions...

Security Bulletin: Multiple vulnerabilities exist in IBM Planning Analytics Local

Summary Vulnerabilities found in several components have been addressed in IBM Planning Analytics 2.0.5. There are vulnerabilities in IBM® Runtime Environment Java™ Version 7. These issues were disclosed as part of the IBM Java SDK updates in October 2017. Multiple vulnerabilities affect componen...

Security Bulletin: Vulnerabilities in WAS Liberty affect IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center

Summary There are vulnerabilities in WAS Liberty used by IBM Spectrum LSF Suite, Spectrum LSF Suite for HPA and Spectrum LSF Application Center. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security...

Security Bulletin: Multiple Vulnerabilities in IBM Cognos Analytics

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.13.0. Multiple Open Source OpenSSL vulnerabilities affect IBM Cognos Analytics. IBM Cognos Analytics consumes IBM GSKit. Multiple vulnerabilities have been addressed in IBM GSKit. IBM Cogn...

Security Bulletin: Multiple Vulnerabilities in IBM Cognos Analytics

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.11.0. IBM Cognos Analytics consumes Apache POI. Multiple vulnerabilities have been addressed in Apache POI. IBM Cognos Analytics consumes IBM GSKit. Multiple vulnerabilities have been...

CVE-2016-0378: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception...

CVE-2016-3042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Application Server WAS Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients...

PT-2016-5339

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty versions prior to 16.0.0.3 Description A cross-site scripting XSS issue exists in the Web UI of IBM WebSphere Application Server WAS Liberty, allowing remote authenticated users to inject arbitrary...

CVE-2016-3040: URL Redirection to Untrusted Site

IBM WebSphere Application Server WAS Liberty, as used in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

PT-2016-1600

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.5 through 8.5.5.8 Description A cross-site scripting XSS issue exists in the OpenID Connect OIDC client web application, allowing remote attackers to inject arbitrary web script...

CVE-2016-0283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4767: Improper Control of Generation of Code

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

PT-2014-6109

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.x through 8.5.5.2 Description The issue arises from improper use of the Liberty Repository for feature installation, allowing remote authenticated users to execute arbitrary cod...