Security Bulletin: Multiple Vulnerabilities in IBM Cognos Analytics

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.13.0. Multiple Open Source OpenSSL vulnerabilities affect IBM Cognos Analytics. IBM Cognos Analytics consumes IBM GSKit. Multiple vulnerabilities have been addressed in IBM GSKit. IBM Cogn...

PT-2016-1600

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.5 through 8.5.5.8 Description A cross-site scripting XSS issue exists in the OpenID Connect OIDC client web application, allowing remote attackers to inject arbitrary web script...

CVE-2016-0283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4767: Improper Control of Generation of Code

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2014-0896: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-4006: Undefined Security Weakness

IBM WebSphere Application Server WAS Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations...

PT-2013-4785

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions prior to 8.5.5.1 Description The issue allows local users to obtain sensitive information via standard filesystem operations due to weak permissions for unspecified files...

CVE-2013-0540: Improper Authentication

IBM WebSphere Application Server WAS Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session...

PT-2013-2416

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.0.0 through 8.5.0.1 Description The issue is related to the improper validation of authentication cookies when SSL is not enabled. This allows remote authenticated users to bypa...