Security Bulletin: Vulnerability in IBM Analytical Decision Management (CVE-2013-4047, CVE-2013-4048, CVE-2013-4049 & CVE-2013-5369)

Abstract Vulnerabilities have been identified in IBM Analytical Decision Management which make the product vulnerable to attacks using script injection and remote code execution. Content VULNERABILITY DETAILS: CVE ID:CVE-2013-4047 DESCRIPTION: If an attacker was able to trick a user into clicking...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Analytical Decision Management (CVE-2021-4104)

Summary There is a vulnerability in the Apache Log4j open source library which is used by IBM Analytical Decision Management for logging of messages and traces. This issue has been addressed. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to...

CVE-2013-5369

IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service...

Code injection

IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service...

CVE-2013-4047

IBM Analytical Decision Management (versions 6.0–7) contains CVE-2013-4047, a cross-site scripting (XSS) vulnerability exploitable via a crafted link that allows remote attackers to run script or HTML in a user’s browser. The IBM security bulletin documents the related set of vulnerabilities (CVE...

CVE-2013-4049

IBM Analytical Decision Management (IBM ADDM) is affected by CVE-2013-4049 across versions 6.0–7.0. The vulnerability is an unrestricted file upload that lets an attacker upload a JSP file and access it to execute arbitrary code on the server. The root cause is improper handling of uploaded files...

CVE-2013-4048

CVE-2013-4048 affects IBM Analytical Decision Management (IBM ADD) 6.0–7. The IBM advisory describes an XSS vulnerability where an attacker could inject a script into a legitimate page, potentially hijacking sessions or impersonating users. Affected versions: 6.0–7 (6.1/6.2 before IF1 and 7.0 bef...