Security Bulletin: IBM Security SiteProtector System is affected by GSKit vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in GSKit. Vulnerability Details CVEID: CVE-2018-1428 DESCRIPTION: IBM GSKit uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CVSS Base Scor...

Security Bulletin: Under specific circumstances IBM® Db2® installation creates users with a weak password hashing algorithm (CVE-2017-1571).

Summary When installed in Silent mode Db2 creates users with a weak password hashing algorithm, which results in only the first 8 characters of the supplied password being used, and remaining characters being ignored. This does not happen if existing users are used during installation; it only...

Security Bulletin: Multiple security vulnerabilities have been identified in GSKit shipped with IBM Rational ClearCase

Summary Vulnerabilities have been addressed in the GSKit component of IBM Rational ClearCase. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel attack against a system based on the Intel...

Security Bulletin: The Elastic Storage Server and the GPFS Storage Server are affected by a vulnerability in IBM Spectrum Scale

Summary The Elastic Storage Server and the GPFS Storage Server are affected by a multiple GSKit vulnerability in IBM Spectrum Scale. Vulnerability Details CVEID: CVE-2018-1431 DESCRIPTION: A vulnerability in GSKit affects IBM Spectrum Scale that could allow a local attacker to obtain control of t...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for Hyper-V

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments: Data Protection for Hyper-V. IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V has addressed the applicable CVEs...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments: Data Protection for VMware. IBM Spectrum Protect for Virtual Environments: Data Protection for VMware has addressed the applicable CVEs...

Security Bulletin: A vulnerability in GSKit and GSKit-Crypto Security affect Content Manager OnDemand for Multi platforms ( CVE-2018-1447 )

Summary There is a vulnerability in GSKit and GSKit-Crypto Security that is used by Content Manager OnDemand for Multi platforms. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of...

Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Weak password policy vulnerability (CVE-2018-1372)

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1372 DESCRIPTION: IBM Security Guardium Big Data Intelligence SonarG does not require that users should have strong passwords by default, which makes it easi...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by weak password policy (CVE-2016-6093)

Summary IBM Security Key Lifecycle Manager addresses this issue where the product does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-6093 DESCRIPTION: IBM Tivoli Key Lifecycle...

Security Bulletin: Fixes for Multiple Security Vulnerabilities in IBM Security Identity Manager Virtual Appliance available

Summary There are multiple security vulnerabilities in various components used by IBM Security Identity Manager Virtual Appliance Vulnerability Details CVEID: CVE-2016-0330 DESCRIPTION: IBM Security Identity Manager Virtual Appliance uses a weak password algorithm which allows users to create...

Combine CMS has multiple vulnerabilities

Combine CMS is a CMS system. Combine CMS suffers from a weak password and SQL injection vulnerability. An attacker can exploit this vulnerability to gain administrator privileges...

IBM Flashsystem / Storwize CSRF / Arbitrary File Read / Information Disclosure Vulnerabilities

Vulnerabilities were identified in the IBM Flashsystem 840, IBM Flashsystem 900 and IBM Storwize V7000. They include cross site request forgery, arbitrary file read, unauthenticated access, and various other vulnerabilities. Vulnerabilities in IBMs Flashsystems and Storwize Products...

Default credentials

A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...

CVE-2018-9112

The CVE-2018-9112 issue affects the Foxconn FEMTO AP-FC4064-T (AP_GT_B38_5.8.3lb15-W47 LTE Build 15). A weak default admin password (admin) grants low-privilege admin access. The web management interface relies on cookies for security-critical operations, enabling privilege escalation by modifyin...

CVE-2018-9112

A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...

Design/Logic Flaw

IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704...

CVE-2014-0841

IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704...

CVE-2014-0841

The CVE affects IBM Rational Focal Point versions 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0, which use a weak password-hashing algorithm. Root cause: weak hash/cryptographic approach facilitates brute-force attacks. Impact: context-dependent attackers could obtain plaintext passwords. No remediation ...

CVE-2018-10362

An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-provided login password, it is possible to login with a simpler password if the password has the form of a power in scientific notation like...