Security Bulletin: IBM Atlas eDiscovery Process Management vulnerable to SQL injection.

Summary Atlas eDiscovery Process Management has addressed vulnerablility due to SQL injection, where a remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID:...

Security Bulletin: IBM Atlas eDiscovery Process Management affected by vulnerability due to sensitive information stored in URL parameters.

Summary Atlas eDiscovery Process Management has addressed vulnerability due to sensitive information stored in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. Vulnerability Details CVEID:...

Security Bulletin: eDiscovery Manager is affected by an Open Source Apache POI Vulnerability

Summary eDiscovery Manager addressed the following vulnerability. Apache POI is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when is processing XML data.By using a specially crafted OOXML file, a remote attacker might exploit this vulnerability to use all...

Security Bulletin: WebSphere deserialization of untrusted data (SOAP Connector) in IBM eDiscovery Manager

Summary IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources. Vulnerability Details CVEID: CVE-2016-8919 DESCRIPTION: IBM WebSphere Application Server may be vulnerable...

Security Bulletin: Open Source zlib Vulnerabilities in IBM eDiscovery Manager

Summary zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service. Vulnerability Details CVEID: CVE-2016-9840...

Security Bulletin:OpenSource ICU4C Vulnernabilties in IBM eDiscovery Analyzer

Summary International Components for Unicode ICU is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Locale class in common/locid.cpp. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or caus...

Security Bulletin: OpenSource ICU4C Vulnernabilities in IBM eDiscovery Manager

Summary International Components for Unicode ICU is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Locale class in common/locid.cpp. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or caus...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and IBM® Runtime Environment Java™ Version 7 used by Content Classification.These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details CVEID: CVE-2016-5582...

Security Bulletin: OpenSource Apache Taglibs Vulnerability affects Atlas Policy Suite (CVE-2015-0254)

Summary Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to...

Security Bulletin:Open Source Apache Zookeeper Vulnerabilities in IBM eDiscovery Analyzer

Summary Apache ZooKeeper is vulnerable to a buffer overflow, caused by improper bounds checking by the C client shells "clist" and "climt". By sending an overly long command, a attacker could overflow a buffer and execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2016-5017...

Security Bulletin:Open Source Apache Poi Vulnerability in IBM eDiscovery Manager

Summary Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when XLSX2CSV example uses Java's XML components to parse OpenXML files. An attacker could exploit this vulnerability using an XML document containing an external...

Security Bulletin:Potential bypass security in WebSphere Applicaiton Server in IBM eDiscovery Manager

Summary IBM WebSphere Application Server could allow a remote attacker to bypass security restrictions caused by a buffer overflow. This could allow the attacker to view unauthorized data. Vulnerability Details CVEID: CVE-2016-0385 DESCRIPTION: IBM WebSphere Application Server could allow a remot...

Security Bulletin:Secure Console cookie, cookie has been set without the secure flag in IBM eDiscovery Manager

Summary IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information caused by the improper setting of a CSRFtoken cookie. Vulnerability Details CVEID: CVE-2016-0377 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive...

Security Bulletin:Open Source Apache Tomcat,Commons FileUpload Vulnerabilities affects WebSphere App Server in IBM eDiscovery Manager

Summary Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could exploit this vulnerability to cause the server to become unresponsive. Vulnerability Details CVEID: CVE-2016-3092...

Security Bulletin:IBM WebSphere deserialization of untrusted data in IBM eDiscovery Manager

Summary IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a serialized object from untrusted sources. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java cod...

Security Bulletin: Open Source Apache PDFBox Vulnerability in IBM eDiscovery Analyzer

Summary Apache PDFBox could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of...

Security Bulletin:Information Disclosure in tWAS and Liberty in IBM eDiscovery Manager

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the improper handling of responses under certain conditions. An attacker could exploit this vulnerability to gain server identification...

Security Bulletin: OpenSource Apache Poi Vulnerabilities in IBM eDiscovery Manager

Summary OpenSource Apache Poi Vulnerabilities Vulnerability Details CVEID: CVE-2012-0213 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compound File Binary Format CFBF documents. By...

Security Bulletin: Open Source Apache Tomcat , Commons FileUpload Vulnerabilities in IBM eDiscovery Manager

Summary Open Source Apache Tomcat , Commons FileUpload Vulnerabilities Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ 7 Vulnerability Details CVEID: CVE-2016-3610 DESCRIPTION: An unspecified vulnerability related to the Libraries component has high confidentiality impact, high integrity impact, and high...