Security Bulletin: Vulnerability in IBM Analytical Decision Management (CVE-2013-4047, CVE-2013-4048, CVE-2013-4049 & CVE-2013-5369)

Abstract Vulnerabilities have been identified in IBM Analytical Decision Management which make the product vulnerable to attacks using script injection and remote code execution. Content VULNERABILITY DETAILS: CVE ID:CVE-2013-4047 DESCRIPTION: If an attacker was able to trick a user into clicking...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Analytical Decision Management (CVE-2021-4104)

Summary There is a vulnerability in the Apache Log4j open source library which is used by IBM Analytical Decision Management for logging of messages and traces. This issue has been addressed. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to...

CVE-2013-5369

IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service...

Code injection

IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service...

CVE-2013-4047

IBM Analytical Decision Management (versions 6.0–7) contains CVE-2013-4047, a cross-site scripting (XSS) vulnerability exploitable via a crafted link that allows remote attackers to run script or HTML in a user’s browser. The IBM security bulletin documents the related set of vulnerabilities (CVE...

CVE-2013-4049

IBM Analytical Decision Management (IBM ADDM) is affected by CVE-2013-4049 across versions 6.0–7.0. The vulnerability is an unrestricted file upload that lets an attacker upload a JSP file and access it to execute arbitrary code on the server. The root cause is improper handling of uploaded files...

CVE-2013-4048

CVE-2013-4048 affects IBM Analytical Decision Management (IBM ADD) 6.0–7. The IBM advisory describes an XSS vulnerability where an attacker could inject a script into a legitimate page, potentially hijacking sessions or impersonating users. Affected versions: 6.0–7 (6.1/6.2 before IF1 and 7.0 bef...

PT-2013-5497

Name of the Vulnerable Software and Affected Versions IBM SPSS Analytical Decision Management versions 6.1 through 6.1 before IF1 IBM SPSS Analytical Decision Management versions 6.2 through 6.2 before IF1 IBM SPSS Analytical Decision Management versions 7.0 through 7.0 before FP1 IF6 Description...

PT-2013-4816

Name of the Vulnerable Software and Affected Versions IBM SPSS Analytical Decision Management versions 6.1 through 6.1 before IF1 IBM SPSS Analytical Decision Management versions 6.2 through 6.2 before IF1 IBM SPSS Analytical Decision Management versions 7.0 through 7.0 before FP1 IF6 Description...

PT-2013-4815

Name of the Vulnerable Software and Affected Versions IBM SPSS Analytical Decision Management versions 6.1 through 6.1 before IF1 IBM SPSS Analytical Decision Management versions 6.2 through 6.2 before IF1 IBM SPSS Analytical Decision Management versions 7.0 through 7.0 before FP1 IF6 Description...

PT-2013-4814

Name of the Vulnerable Software and Affected Versions IBM SPSS Analytical Decision Management versions 6.1 through 6.1 before IF1 IBM SPSS Analytical Decision Management versions 6.2 through 6.2 before IF1 IBM SPSS Analytical Decision Management versions 7.0 through 7.0 before FP1 IF6 Description...

CVE-2013-4047: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote attackers to inject arbitrary web script or HTML via a crafted link...

CVE-2013-4049: Undefined Security Weakness

Unrestricted file upload vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to execute arbitrary code by uploading and accessing a JSP file...

CVE-2013-5369: Improper Control of Generation of Code

IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service...

CVE-2013-4048: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving addition of script to a page...