Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ

Summary Multiple vulnerabilities in bundled software packages affect IBM StoredIQ. IBM StoredIQ has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2009-0217 DESCRIPTION: The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products...

Security Bulletin: A Security Vulnerability has been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2015-7450)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about a security vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixe...

Important: apache-commons-beanutils

Issue Overview: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the...

Security Bulletin: Vulnerabilities in Apache Commons Compress

Summary There are vulnerabilities in Appache Commons Compress used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an...

CVE-2019-10086

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader. Mitigation There is no currently known mitigation for this flaw...

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader...

Security Bulletin: Vulnerabilities in WebSphere Application Server Liberty affect IBM Jazz technology

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty that affect Quality Manager RQM Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- RQM| 6.0.6.1 RQM| 6.0.6...

Security Bulletin: Vulnerabilities in WebSphere Application Server Liberty affect IBM Jazz technology

Summary There are vulnerabilities in IBM WebSphere Application Server Liberty that affect Rhapsody DM. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- Rhapsody DM| 6.0.6 Rhapsody DM|...

Security Bulletin: Vulnerability affecting IBM Network Performance Insight (CVE-2019-12402)

Summary IBM Network Performance Insight has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This...

Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with Predictive Customer Intelligence (CVE-2016-0385, CVE-2016-0377, CVE-2016-2960, CVE-2016-3092)

Summary WebSphere Application Server is shipped with Predictive Customer Intelligence. Information about security vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Security Vulnerabilities have been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2012-5783, CVE-2018-1614, CVE-2014-0114, CVE-2015-0899)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about security vulnerabilities affecting Websphere Application Server has been published in security bulletins. Vulnerability Details Please consult the security bulletins: Security Bulletin:...

Security Bulletin: A denial of service vulnerability affects IBM Sterling B2B Integrator (CVE-2014-0050)

Summary IBM Sterling B2B Integrator is vulnerable to denial of service attack Vulnerability Details CVEID: CVE-2014-0050 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header for multipart requests. By...

Security Bulletin: WebSphere Application Server is vulnerable to Apache Commons Beanutils in IBM Cloud (CVE-2019-10086)

Summary There is a vulnerability in Apache Commons Beanutils that is used by WebSphere Application Server in IBM Cloud. Vulnerability Details CVEID: CVE-2019-10086 DESCRIPTION: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a...

jackson-databind: Serialization gadgets in classes of the commons-configuration package

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code...

jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the commons-dbcp gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

ysoserial

This is a proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. The tool, ysoserial, is a collection of utilities and property-oriented programming "gadget chains" discovered in common Java libraries that can, under the right conditions, exploit Java...

Security Bulletin: Information disclosure vulnerability affects IBM Sterling B2B Integrator  (CVE-2016-0341)

Summary IBM 10x vulnerability in IBM Sterling B2B Integrator could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-0341 DESCRIPTION: IBM 10x could allow a malicious user to obtain highly sensitive information due to missing configurations of HTTPS...

Security Bulletin: Vulnerability in Apache Commons affects IBM Sterling B2B Integrator (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Sterling B2B Integrator. Vulnerability Details CVE ID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Security Vulnerability in Apache Commons FileUpload Affects IBM Sterling B2B Integrator (CVE-2016-1000031)

Summary Security vulnerability in Apache Commons FileUpload affects IBM Sterling B2B Integrator. Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote attacker to execute arbitrary code on th...

Security Bulletin: Vulnerability in Apache Commons BeanUtils Affects IBM Sterling B2B Integrator (CVE-2014-0114)

Summary Apache Commons BeanUtils with Struts 1 does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter. Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Apache Struts could allow a remote attacke...