Security Bulletin: TS3400 is affected by the following OpenSSL vulnerabilities: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and server...

Security Bulletin: Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)

Summary OpenStack Nova could allow a remote authenticated attacker to bypass security restrictions. By rebuilding an instance, an attacker could exploit this vulnerability to achieve Filter Scheduler bypass. Vulnerability Details CVE-ID: CVE-2017-16239 Description: OpenStack Nova could allow a...

Security Bulletin: File path traversal vulnerabilities affect IBM Workload Deployer shipped with IBM SmartCloud Orchestrator (CVE-2014-6158)

Summary File path traversal vulnerabilities affect IBM Workload Deployer, which is shipped with IBM SmartCloud Orchestrator CVE-2014-6158. Vulnerability Details Consult the Security Bulletin: File path traversal vulnerabilities affect IBM Workload Deployer CVE-2014-6158 document for vulnerability...

Security Bulletin: SmartCloud Provisioning - Django vulnerabilities reported in April 2014 X-Force Report

Summary SmartCloud Provisioning - Django vulnerabilities reported in April 2014 X-Force Report CVE-2014-0473, CVE-2014-0474,CVE-2014-0472 Vulnerability Details CVE-ID: CVE-2014-0473 DESCRIPTION: Django is vulnerable to cross-site request forgery, caused by an error when handling caching of...

Security Bulletin: Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance

Summary Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187. Vulnerability Details Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2018-1415)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEID:...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to include arbitrary files (CVE-2017-1499 )

Summary IBM Maximo Asset Management could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable Web server.. Vulnerability Details CVEID: CVE-2017-1499 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker t...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to conduct phishing attacks, using an open redirect attack (CVE-2017-1558)

Summary IBM Maximo Asset Management could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicio...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server affect IBM Spectrum Protect for Workstations (formerly Tivoli Storage Manger FastBack for Workstations) Central Administration Console (CVE-2017-1380, CVE-2017-1381)

Summary Vulnerabilities in IBM WebSphere Application Server affect IBM Spectrum Protect for Workstations formerly Tivoli Storage Manager FastBack for Workstations Central Administration Console can allow users to embed arbitrary JavaScript code in the Web UI or allow a local attacker to obtain...

Security Bulletin: Vulnerability in Apache Batik affects IBM Maximo Asset Management (CVE-2017-5662)

Summary Apache Batik used by IBM Maximo Asset Management could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. By using a specially-crafted SVG file, a remote attacker could exploit this vulnerability to...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks (CVE-2017-1357)

Summary IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. Vulnerability Details CVEID: CVE-2017-1357 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to...

Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection(CVE-2017-1175)

Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1175 DESCRIPTION: IBM Maximo...

Security Bulletin: IBM TRIRIGA Application Platform Information Disclosure (CVE-2017-1374)

Summary IBM TRIRIGA Application Platform is vulnerable to an information disclosure attack. Vulnerability Details CVEID: CVE-2017-1374 DESCRIPTION: Sensitive data can be exposed in the IBM TRIRIGA Application platform that can lead to an attacker gaining unauthorized access to the system. CVSS Ba...

Security Bulletin: IBM Maximo Asset Management could allow a remote attacker to include arbitrary files (CVE-2016-9976)

Summary IBM Maximo Asset Management could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request, which could allow the attacker to execute arbitrary code on the vulnerable server. Vulnerability Details CVEID: CVE-2016-9976 DESCRIPTION: IB...

Security Bulletin: IBM TRIRIGA Document Manager Privilege Escalation (CVE-2017-1180)

Summary IBM TRIRIGA Document Manager is vulnerable to a privilege escalation attack. Vulnerability Details CVEID: CVE-2017-1180 DESCRIPTION: The IBM TRIRIGA Document Manager contains a vulnerability that could allow an authenticated user to execute actions they did not have access to. CVSS Base...

Security Bulletin: IBM TRIRIGA Application Platform Cross-Site Scripting (XSS) (CVE-2016-9737)

Summary The IBM TRIRIGA Application is vulnerable to a Cross-Site Scripting attack. Vulnerability Details CVEID: CVE-2016-9737 DESCRIPTION: IBM TRIRIGA is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...

Security Bulletin: IBM TRIRIGA Application Platform Reflected Cross-Site Scripting (XSS) (CVE-2016-5980)

Summary The IBM TRIRIGA Application is vulnerable to Reflected Cross-Site Scripting attacks. Vulnerability Details CVEID: CVE-2016-5980 DESCRIPTION: IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...

Security Bulletin: Vulnerabilities in Apache Struts affects FastBack for Workstations Central Administration Console (CVE-2016-1181 and CVE-2016-1182)

Summary Apache Struts vulnerabilities affect FastBack for Workstations Central Administration Console. Vulnerability Details CVEID: CVE-2016-1181 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against unintended...

Security Bulletin: HTTP response splitting attack in FastBack for Workstations Central Administration Console (CVE-2016-0359)

Summary There is a vulnerability in FastBack for Workstations Central Administration Console in the underlying IBM WebSphere Application Server that could allow HTTP response splitting attacks. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable ...

Security Bulletin: IBM TRIRIGA Application Platform is vulnerable to a Cross-site scripting attack on login. (CVE-2016-0387)

Summary IBM TRIRIGA is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once t...