Security Bulletin: IBM Cognos Analytics はクロスサイトスクリプティング(XSS)の脆弱性の影響を受けます

Summary IBM Cognos Analytics 11.0, 11.0.1, 11.0.2, 11.0.3にはユーザーの入力に対する不適切な検証によるクロスサイトスクリプティングXSSの脆弱性があります。 Vulnerability Details CVEID: CVE-2016-0346 説明：IBM Cognos...

Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.7.0. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8. These issues were disclosed as part of the IBM Java SDK updates in July 2016, October 2016, January 201...

Security Bulletin: IBM Cognos Analytics is affected by a Cross-Site Scripting (XSS) vulnerability

Summary IBM Cognos Analytics has addressed a Cross-Site Scripting XSS vulnerability caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2016-0346 DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.6.0. IBM Cognos Analytics has addressed a vulnerability where sensitive information can be revealed in its logs files. Multiple OpenSSL vulnerabilities affect IBM Cognos Analytics. These...

Security Bulletin: Cross Site Scripting (XSS) vulnerability affects Cognos Analytics

Summary Cognos Analytics is vulnerable to a XSS attack when executing a report. Vulnerability Details CVEID: CVE-2016-3032 DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities

Summary This bulletin addresses two security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.5.0. The fixes are for cross-site scripting vulnerabilities. Vulnerability Details CVEID: CVE-2016-3015 DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting. This...

Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.5.0. IBM Cognos Analytics has addressed several Libxml2 vulnerabilities. There are multiple vulnerabilities in IBM® WebSphere Application Server Liberty. Liberty is used by IBM Cognos...

Security Bulletin: Privilege Escalation vulnerability affects Cognos Analytics (CVE-2016-8960)

Summary Cognos Analytics is vulnerable to a privilege escalation attack that could grant a user the Capabilities of another. Vulnerability Details CVEID: CVE-2016-8960 DESCRIPTION: IBM Cognos Business Intelligence could allow a user with lower privilege Capabilities to adopt the Capabilities of a...

Security Bulletin: IBM Cognos Analytics : IBM Cognos Analytics is affected by CVE-2016-0398

Summary This bulletin addresses a recently discovered content spoofing vulnerability. Vulnerability Details CVEID: CVE-2016-0398 DESCRIPTION: IBM Cognos Analytics is vulnerable to content spoofing when an attacker familiar with CA can convince a user to click on a malicious link. CVSS Base Score:...

Security Bulletin: A vulnerability in the GSKit component of Cognos Analytics (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of Cognos Analytics Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit this vulnerability to obtain...

Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2017-5638)

Summary An Apache Struts vulnerability was addressed by IBM Social Media Analytics. Vulnerability Details CVEID: CVE-2017-5638 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by an error when performing a file upload based on Jakarta...

Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2016-4003)

Summary An Apache Struts vulnerability was addressed by IBM Social Media Analytics 1.3.0 IF18. An upgrade to Apache Struts version 2.3.28.1 was performed. Vulnerability Details CVE-ID:CVE-2016-4003 Description: Apache Struts is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2016-0785)

Summary An Apache Struts vulnerability was addressed by IBM Social Media Analytics 1.3.0 IF18. Vulnerability Details CVEID: CVE-2016-0785 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a double OGNL evaluation of attribute values. By...

Security Bulletin: Vulnerability in Open Source Dojo ToolKit affects IBM Social Media Analytics (CVE- 2015-5654)

Summary A Dojo ToolKit vulnerability affecting versions of Dojo prior to 1.2 was addressed by IBM Social Media Analytics. An upgrade to Dojo 1.8 was performed. Vulnerability Details CVEID: CVE-2015-5654 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation...

Security Bulletin: Vulnerability in Apache Commons affects IBM Social Media Analytics (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Social Media Analytics. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, cause...

Security Bulletin: A security vulnerability has been identified in IBM Cognos Business Intelligence shipped with IBM Capacity Management Analytyics (CVE-2016-0201)

Summary IBM Cognos Business Intelligence is shipped as a component of IBM Capacity Management Analytyics. Information about a security vulnerability affecting IBM Cognos Business Intelligence has been published in a security bulletin. Vulnerability Details Consult the following security bulletins...

Security Bulletin: IBM Capacity Management Analytics affected by vulnerability password easy to decrypt in shell files (CVE-2015-7432)

Summary It is very easy to decrypt user and admin password from the setenv.sh and parameter.txt file Vulnerability Details CVEID: CVE-2015-7432 DESCRIPTION: IBM Capacity Management Analytics could allow a local user with special privileges to decrypt other CMA user's usernames and passwords. CVSS...

Security Bulletin: IBM Capacity Management Analytics could allow a localuser on the CMA install machine to obtain other CMA user's encrypted usernames and passwords (CVE-2105-7434)

Summary The encrypted password in setenv.sh is always the same which becomes easy to decrypt Vulnerability Details CVEID: CVE-2015-7434 DESCRIPTION: IBM Capacity Management Analytics could allow a local user on the CMA install machine to obtain other CMA user's encrypted usernames and passwords...

Security Bulletin: IBM Capacity Management Analytics is affected by a plaintext password vulnerability (CVE-2015-7433)

Summary IBM Capacity Management Analytics could allow a local user on the CMA install machine to obtain other CMA user's usernames and passwords in plaintext during the CMA install. Vulnerability Details CVEID: CVE-2015-7433 DESCRIPTION: IBM Capacity Management Analytics could allow a local user ...

QSC18 Virtual Edition – Building Security In: The Qualys Cloud Platform and Architecture

Digital transformation, driven primarily by the DevOps movement, represents a new opportunity “to redo IT from scratch, but more importantly, to redo security from scratch,” Sumedh Thakar, Qualys' Chief Product Officer, said during QSC18 Virtual Edition. Specifically, organizations can organicall...