Security Bulletin: Vulnerability in Apache Taglibs affects IBM Cúram Social Program Management (CVE-2015-0254)

Summary IBM Cúram Social Program Management uses the Apache Taglibs Library. Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2015-0254...

Security Bulletin: Fix available for Vulnerability in XML External Entity Injection (XXE) affecting IBM Cúram Social Program Management (CVE-2016-6111)

Summary IBM Cúram Social Program Management is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could use the vulnerability to expose highly sensitive information, or to use all available memory resources...

Security Bulletin: Vulnerability in Castor library affects IBM Cúram(CVE-2014-3004)

Summary IBM Cúram is shipped with a third party library called Castor, which is vulnerable to an XML External Entity Injection XXE error. Vulnerability Details CVEID: CVE-2014-3004 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External...

Security Bulletin: IBM Content Navigator is affected by an XML External Entity Injection (XXE) vulnerability

Summary IBM Content Navigator has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1364 DESCRIPTION: IBM Content Navigator is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose...

Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU affect IBM Content Collector for SAP Applications

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID:...

Security Bulletin: OpenSource Apache Taglibs Vulnerability affects Atlas Policy Suite (CVE-2015-0254)

Summary Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to...

Security Bulletin: A Vulnerability in OpenSource Apache Taglibs Vulnerability affect Content Integrator (CVE-2015-0254)

Summary A Vulnerability in OpenSource Apache Taglibs Vulnerability affect Content Integrator. Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system, caused by an XML External Entity Injection XXE error when processing XML data. By sending specially-crafted...

Security Bulletin:Open Source Apache Poi Vulnerability in IBM eDiscovery Manager

Summary Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when XLSX2CSV example uses Java's XML components to parse OpenXML files. An attacker could exploit this vulnerability using an XML document containing an external...

Security Bulletin: OpenSource Apache Poi Vulnerabilities in IBM eDiscovery Manager

Summary OpenSource Apache Poi Vulnerabilities Vulnerability Details CVEID: CVE-2012-0213 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compound File Binary Format CFBF documents. By...

Security Bulletin: XXE and XmlBomb vulnerability in FileNet Workplace (CVE-2016-3055)

Summary FileNet Workplace is susceptible to the XXE and XmlBomb vulnerability. Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-3055 DESCRIPTION: IBM FileNet Workplace is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML dat...

Security Bulletin: IBM Rational Software Architect Design Manager does not handle incoming requests containing XML in a safe manner (CVE-2018-1456, CVE-2018-1587)

Summary Usage of XML external entities in RSA DM linktype definitions comprises a security risk including disclosure of local files. An error message displayed when parsing incorrect XML can disclose unnecessary technical details that can be potentially used to construct new attacks. Vulnerabilit...

Security Bulletin: An undisclosed vulnerability affects IBM Rational products based on IBM Jazz technology

Summary Potential XML External Entity Processing vulnerability affects the following IBM Rational Products: Rational Rhapsody Design Manager Rhapsody DM, Rational Software Architect Design Manager RSA DM Vulnerability Details CVEID: CVE-2018-1456 DESCRIPTION: IBM Rhapsody DM is vulnerable to a XM...

Security Bulletin: Vulnerability in Rational Rhapsody Design Manager with potential for Denial of Service attack

Summary IBM Rhapsody Design Manager is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2016-8974 DESCRIPTION: IBM Rhapsody DM is vulnerable to a denial of service, caused by an XML External Entity...

Security Bulletin: Rational Systems Tester is affected by Libxml2 vulnerabilities (CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

Summary A set of Libxml2 vulnerabilities were disclosed by the Libxml2 Project. Libxml2 is used by Rational Systems Tester. Rational Systems Tester has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-4447 DESCRIPTION: libxml2 is vulnerable to a denial of service, caused by a...

Security Bulletin: Multiple security vulnerabilities affect the Lifecycle Query Engine (LQE) that is shipped with Jazz Reporting Service (CVE-2016-0316, CVE-2016-0317, CVE-2016-0318, CVE-2016-0319)

Summary There are multiple security vulnerabilities in the Lifecycle Query Engine LQE shipped with Jazz Reporting Service. Vulnerability Details CVEID: CVE-2016-0316 DESCRIPTION: IBM Jazz Reporting Service is vulnerable to cross-site scripting, caused by improper validation of user-supplied input...

Security Bulletin: Multiple Security Vulnerabilities in Apache Tomcat affect IBM RLKS Administration and Reporting Tool

Summary Apache Tomcat is shipped as a component of RLKS Administration and Reporting Tool RLKS ART . Information about multiple security vulnerabilities affecting Apache Tomcat, version 7.0.52, have been published in this security bulletin. Vulnerability Details CVE ID: CVE-2014-7810 Description:...

Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004)

Summary The Castor Project Castor library is vulnerable affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE ID: CVE-2014-3004 Description: Castor Library could allow a remote attacker to obtain...

Security Bulletin: Rational Directory Server and Rational Directory Administrator can be affected by vulnerabilities (CVE-2014-4263, CVE-2014-0075, CVE-2014-0096, CVE-2014-0099 and CVE-2014-0119)

Summary This security bulletin is a notice of security vulnerabilities in IBM Runtime Environment, Java Technology Edition and Apache Tomcat server which impacts IBM Rational Directory Server 5.2.x, 5.1.1.x and Rational Directory Administrator 6.x. Vulnerability Details | Subscribe to My...

Security Bulletin: Rational Insight - Open Source Tomcat reported in May 2014 X-Force Report

Summary Multiple security vulnerabilities exist in the Tomcat that is shipped with the Rational Insight. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--...

Security Bulletin: Rational Lifecycle Adapter for HP ALM Apache Tomcat fix (CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590, CVE-2014-0075, CVE-2014-0095, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119)

Summary A vulnerability has been identified in Rational Lifecycle Adapter for HP ALM V1.0 and V1.1. If you are using Apache Tomcat 7.x to run your HP ALM adapter, download and install the Apache Tomcat fix available on Fix Central. Vulnerability Details | Subscribe to My Notifications to be...