CVE-2010-3472: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-021 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-3473: Improper Input Validation

Open redirect vulnerability in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-021 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2009-5002: Undefined Security Weakness

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection...

CVE-2009-4999: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-016 allows remote attackers to inject arbitrary web script or HTML via the Name field...

CVE-2009-5001: Undefined Security Weakness

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.2-P8AE-FP002 grants a document's Creator-Owner full control over an annotation object, even if the default instance security has changed, which might allow remote authenticated users to bypass intended...

CVE-2008-7261: Undefined Security Weakness

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file...

CVE-2010-3471: Improper Authentication

Session fixation vulnerability in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.7-P8AE-FP007 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2009-4998: Undefined Security Weakness

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-019 and 4.0.2.x before 4.0.2.7-P8AE-FP007, in certain FileTracker configurations, does not apply a security policy to the first document added during a session, which might allow remote attackers to bypass...

CVE-2010-3470: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-7242: Undefined Security Weakness

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-001 does not ensure that the AE Administrator role is present for Site Preferences modifications, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors...

CVE-2009-5000: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.3-P8AE-FP003 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to .jsp pages...

Researcher Finds HP Printer Security Flaw

A cybersecurity researcher has discovered an easy way for a hacker to swipe copies of documents scanned by Hewlett-Packard all-in-one printers widely used in workplace settings. Read the full article. The Last Watchdog...

CVE-2010-0715

CVE-2010-0715 is an open redirect vulnerability in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management, covering versions 5.1.0.0–5.1.0.5, 6.0.0.0–6.0.0.4, 6.0.1.0–6.0.1.7, 6.1.0.0–6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8....

CVE-2010-0714

CVE-2010-0714 describes a Cross-site scripting (XSS) vulnerability in login.jsp across IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), IBM Lotus Workplace WCM versions 5.1.x, 6.x, 6.1.x, 6.1.5.0, and IBM Lotus Quickr services for WebSphere Portal. The flaw allows remote attackers to...

CVE-2010-0714: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr...

CVE-2010-0715: Undefined Security Weakness

Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0...

Cyberthieves Find Workplace Networks Are Easy Pickings

In a feature article in USAToday, Byron Acohido writes about porous and difficult to defend workplace networks that provide a haven for professional cybercrimals. Acohido writes: “Overly complex IT systems are producing endless opportunities for cyberthieves, who need only to master simple hackin...

Better Security Through Diversity of Thinking

Inspired by professional pastry chef Shuna Fish Lydon: “You do not know what a good, bad or indifferent baker/pastry chef you are until you work alongside someone who is better/worse than you. This is not at all to say that if you are an outstanding home baker, you are deluding yourself. But as f...

Can social networking be secure at work?

From CIO C.G. Lynch As more workers spend a greater part of their days on social networks like Facebook and Twitter, hackers have turned their energies toward spreading their malware across those services, harming workstations and company networks. That’s the contention of a recent report measuri...

Businesses losing fight against employee apps

From Techworld Maxwell Cooter Enterprises are struggling to control the use of consumer applications within the workplace, despite the panoply of security tools being used within corporates. According to new research paloaltonetworks.com, nearly half of all bandwidth within corporate environments...