CVE-2018-12522

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /style/ provides a directory listing...

CVE-2018-12524

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /lib/ provides a directory listing...

Design/Logic Flaw

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /images/ provides a directory listing...

CVE-2018-12523

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /etc/ provides a directory listing...

CVE-2018-12525

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /images/ provides a directory listing...

CVE-2018-12523

PerfSONAR MaDDash 2.0.2 contains an information disclosure vulnerability: a direct request to /etc/ exposes a directory listing. Affected component is the MaDDash web UI (maddash-webui) handling /etc/. The issue allows enumeration of internal files and directories, which could reveal sensitive in...

CVE-2018-12524

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /lib/ provides a directory listing...

CVE-2018-12522

An issue was discovered in perfSONAR Monitoring and Debugging Dashboard MaDDash 2.0.2. A direct request to /style/ provides a directory listing...

Security Bulletin: Information disclosure CVE-2016-9975 affects IBM Dashboard Application Services Hub (DASH)

Summary IBM Tivoli Widget Library TWL, a sub component of DASH that in turn is bundled in IBM Jazz for Service Management JazzSM is affected by Cross Site Request Forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Security Bulletin: Information disclosure CVE-2016-5935 affects IBM Dashboard Application Services Hub (DASH) v3.1.3

Summary IBM Dashboard Application Services Hub, a part of IBM Jazz for Service Management JazzSM, could allow a remote attacker to obtain sensitive information. There is a lack of certificate verification when connecting to remote datastores from WebSphere Admin Console in federation scenarios...

Security Bulletin: Information Disclosure Vulnerability in Tivoli Business Service Manager (CVE-2016-0286)

Summary Information about an information disclosure security vulnerability affecting Tivoli Business Service Manager TBSM is published in this security bulletin. Manipulation of communication between the TBSM Dashboard server and the TBSM Data Server could result in information disclosure...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Dashboard Framework

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6 used by WebSphere Dashboard Framework. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with...

Security Bulletin: Vulnerabilities in IBM® Java™ Runtime affect WebSphere Dashboard Framework (CVE-2016-5573, CVE-2016-5597)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Version 6 that is used by WebSphere Dashboard Framework. These issues were disclosed as part of the IBM Java SDK updates in October 2016. The vulnerabilities may affect some configurations of products bundled with WebSphere...

Security Bulletin: IBM WebSphere Dashboard Framework is affected by a security vulnerability in Apache POI (CVE-2016-5000)

Summary Apache POI, which is bundled with IBM WebSphere Dashboard Framework, could allow a remote attacker to obtain sensitive information. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache POI, which is used by the spreadsheet integration functionality. CVEID:...

Security Bulletin: IBM WebSphere Dashboard Framework is affected by multiple security vulnerabilities in Apache POI

Summary Apache POI, which is bundled with IBM WebSphere Dashboard Framework, is vulnerable to denial of service attacks and could allow a remote attacker to obtain sensitive information. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache POI, which is used by the...

Security Bulletin: A vulnerability in IBM® Java Runtime affects: WebSphere Dashboard Framework (CVE-2016-3485)

Summary There is a vulnerability in IBM® Runtime Environments Java™ Version 6 that is used by WebSphere Dashboard Framework. This issue was disclosed as part of the IBM Java SDK updates in July 2016. The vulnerability may affect some configurations of products bundled with WebSphere Dashboard...

Security Bulletin: Security Vulnerability in Apache Commons FileUpload affects IBM WebSphere Dashboard Framework (CVE-2016-3092 )

Summary Apache Commons FileUpload, which is bundled with IBM WebSphere Dashboard Framework, allows remote attackers to cause a denial of service CPU consumption via a long boundary string. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache Commons FileUpload, whi...

Security Bulletin: Security vulnerabilities have been identified in the versions of IBM WebSphere Application Server Community Edition bundled with WebSphere Dashboard Framework 7.0.1 (CVE-2015-5345) (CVE-2016-0706) (CVE-2016-0714)

Summary IBM WebSphere Application Server Community Edition is bundled as an optional component of WebSphere Dashboard Framework. Information about security vulnerabilities affecting this component have been published. Vulnerability Details CVEID: CVE-2015-5345 DESCRIPTION: Apache Tomcat could all...

Security Bulletin: Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6, affects: WebSphere Dashboard Framework (CVE-2016-3427, CVE-2016-3426, CVE-2016-0264)

Summary There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Version 6, that is used by WebSphere Dashboard Framework. These issues were disclosed as part of the IBM Java SDK updates in April 2016. The vulnerabilities may affect some configurations of products...

Security Bulletin: Security Vulnerability in Apache Axis affects IBM WebSphere Dashboard Framework (CVE-2014-3596)

Summary There is an insecure certificate validation CVE-2014-3596 in Apache Axis which is bundled with IBM WebSphere Dashboard Framework. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache Axis which can be used to make web service requests. A vulnerability in Ax...