Security Bulletin: Insufficient authorization check in IBM Business Process Manager (BPM) Search REST API (CVE-2014-6139)

Summary Using the Search REST API, non-administrative users can search for task and process instances that they are not allowed to see by specifying a parameter that should be available only to administrative users. Vulnerability Details CVE ID: CVE-2014-6139 CVSS Base Score: 3.5 CVSS Temporal...

Security Bulletin: Insufficient authorization check for project actions in IBM Business Process Manager (CVE-2014-4844)

Summary By using IBM Business Process Manager BPM you can import and export process applications and toolkits. Although this functionality is available only to authorized users, the actual server side code accepts requests from lower privileged users. Vulnerability Details CVE ID: CVE-2014-4844...

Security Bulletin: XML External Entity Processing in Castor might affect WebSphere Lombardi Edition (CVE-2014-3004)

Summary An XML External Entity Processing vulnerability has been reported for the Castor open source library that is used in WebSphere Lombardi Edition WLE. Vulnerability Details CVE-ID: CVE-2014-3004 Description: Castor Library could allow a remote attacker to obtain sensitive information, cause...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere DataPower XC10 Appliance versions 2.1 and 2.5 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in the WebSphere DataPower XC10 Appliance versions 2.1 and 2.5. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: The product could allow a...

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by OpenSSL vulnerabilities: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID:CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and...

Security Bulletin: IBM WebSphere MQ is affected by a vulnerability in the IBM JRE (CVE-2013-5780)

Summary A security vulnerability exists in the IBM Java Runtime Environment component of WebSphere MQ, a patch for this is available in IBM JRE 6.0 SR15 FP1. Vulnerability Details CVEID: CVE-2013-5780 DESCRIPTION: An unspecified vulnerability in IBM Java related to the Libraries component could...

Security Bulletin: Denial of Service vulnerability in Apache Commons FileUpload affects IBM Business Process Manager (BPM)

Summary A security vulnerability exists in the open source library Apache Commons FileUpload that is shipped with, and used by, the IBM Business Process Manager products. Vulnerability Details By sending a specially crafted request, an attacker might exploit this vulnerability to cause the...

Security Bulletin: Denial of Service vulnerability in Apache Commons FileUpload affects IBM WebSphere Lombardi Edition

Summary A security vulnerability exists in the open source library Apache Commons FileUpload that is shipped with and used by IBM WebSphere Lombardi Edition. Vulnerability Details By sending a specially crafted request, an attacker might exploit this vulnerability to cause the application to ente...

Security Bulletin: IBM Operational Decision Manager and WebSphere ILOG JRules: Multiple security vulnerabilities in IBM JRE

Summary This Security Bulletin addresses the security vulnerabilities that have shipped with the IBM Java Runtime Environment JRE included in IBM Operational Decision Manager and IBM ILOG JRules. IBM ODM and ILOG JRules now include the most recent version of the IBM JRE which fixes the security...

Security Bulletin: Multiple vulnerabilities in current IBM SDK for Java for WebSphere Application Server January 2014 CPU

Summary Multiple security vulnerabilities exist in the IBM SDK for Java that is shipped with IBM WebSphere Application Server Vulnerability Details The IBM WebSphere Application Server is shipped with an IBM SDK for Java that is based on the Oracle JDK. Oracle has released January 2014 critical...

Security Bulletin: Potential Security Vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8

Summary Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.8 Vulnerability Details CVE ID:CVE-2013-0460PM72275 DESCRIPTION: WebSphere Application Server could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in...

IBM WebSphere MQ 7.0.0.x / 8.0.0.x Password Handling Remote Access Vulnerability

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is 7.0.0.x or 8.0.0.x without patch APAR PM52049 C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108485; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/08";...

IBM WebSphere MQ 7.0.1.x ROBOT Vulnerability

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is 7.0.1.x without patch APAR IJ03658 C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108486; scriptversion"1.6";...

AIX 6.1 TL 9 : aixbase (IJ02726)

https://vulners.com/cve/CVE-2018-1383 https://vulners.com/cve/CVE-2018-1383 A software logic bug creates a vulnerability in an AIX 6.1, 7.1, and 7.2 daemon which could allow a user with root privileges on one system, to obtain root access on another machine. C Tenable Network Security, Inc. The...

AIX 7.2 TL 1 : aixbase (IJ02828)

https://vulners.com/cve/CVE-2018-1383 https://vulners.com/cve/CVE-2018-1383 A software logic bug creates a vulnerability in an AIX 6.1, 7.1, and 7.2 daemon which could allow a user with root privileges on one system, to obtain root access on another machine. C Tenable Network Security, Inc. The...

AIX 6.1 TL 9 : bind (IV78091)

ISC BIND is vulnerable to a denial of service, caused by the exit of a validating resolver due to an assertion failure in buffer.c. By parsing a malformed DNSSEC key, a remote attacker could exploit this vulnerability to cause a denial of service. %NASLMINLEVEL 70300 C Tenable Network Security,...

IBM DB2 10.5.x < 10.5.500.109 Information Disclosure (credentialed check)

The version of IBM DB2 installed on the remote host is affected by an information disclosure vulnerability due to an unspecified flaw in the monitoring and audit features. A remote, authenticated attacker can exploit this flaw, via a crafted series of commands, to view passwords in SQL statements...

AIX 6.1 TL 9 : lvm (IV68099) (deprecated)

The running of lquerylv command with variable DBGCMDLQUERYLV set may allow a local user to gain root privileges. This plugin is deprecated and has been replaced by plugin 81108. %NASLMINLEVEL 999999 C Tenable Network Security, Inc. @DEPRECATED@ The text in the description was extracted from AIX...

AIX 7.1 TL 2 : malloc (IV62807)

It has been identified that the runtime linker allows privilege escalation via arbitrary file writes with elevated privileges programs. When MALLOCOPTIONS and MALLOCBUCKETS environment variables are set with bucket statistics options and by executing certain setuid programs, a non-privileged user...

AIX libxml2 vulnerability,VIOS libxml2 vulnerability

IBM SECURITY ADVISORY First Issued: Fri Aug 15 10:26:30 CDT 2014 Updated: Fri Aug 22 08:17:41 CDT 2014 Update: fixed APAR availability dates |Update: Mon Aug 25 15:18:37 CDT 2014 |Update Corrected a couple Service Pack levels The most recent version of this document is available here:...