Security Bulletin: IBM Security Key Lifecycle Manager is affected by XML External Entity Injection (XXE) attack (CVE-2017-1666)

Summary IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2017-1666 DESCRIPTION:...

Security Bulletin: IBM Security Access Manager version 9.0.3.0 appliances are affected by an XML External Entity injection vulnerability (CVE-2017-1477)

Summary IBM Security Access Manager has addressed the following XML External Entity Injection vulnerability, which affects the IBM Security Access Manager version 9.0.3.0 appliance. Vulnerability Details CVEID: CVE-2017-1477 DESCRIPTION: IBM Security Access Manager Appliance is vulnerable to a XM...

Security Bulletin: IBM QRadar Network Security is affected by potential issues of XML External Entity Injection (CVE-2017-1458)

Summary IBM QRadar Network Security has addressed potential issues of XML External Entity Injection. Vulnerability Details CVEID: CVE-2017-1458 DESCRIPTION: IBM QRadar Network Security is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web software

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and IBM® Runtime Environment Java™ Version 6 used by IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web version 7 software. These issues were disclosed as part of the IBM Java...

Security Bulletin: IBM Security Guardium is affected by XML External Entity vulnerability (CVE-2017-1254)

Summary IBM Security Guardium is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM Security Guardium has fixed this vulnerability Vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Security SiteProtector System. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID: CVE-2017-3539 DESCRIPTION: An unspecified vulnerability relat...

Security Bulletin: IBM Tivoli Federated Identity Manager is affected by an XML External Entity vulnerability (CVE-2016-2908)

Summary IBM Tivoli Federated Identity Manager could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data by the XML parser. Vulnerability Details CVEID: CVE-2016-2908 DESCRIPTION: IBM Security Access Manager could allow a...

Security Bulletin: Pivotal Spring Framework as used in IBM QRadar SIEM is vulnerable to various CVE's

Summary OpenSource Pivotal Spring Framework as used in IBM QRadar is susceptible to several vulnerabilities. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection X...

Security Bulletin: OpenSource Spring Source/Pivotal Spring Framework Vulnerabilities affect IBM Security Guardium (CVE-2013-7315, CVE-2013-4152, CVE-2014-0054)

Summary Pivotal Spring Framework could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when...

Security Bulletin: IBM Security Access Manager appliances are affected by an XML External Entity vulnerability (CVE-2016-2908)

Summary IBM Security Access Manager could allow a remote attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. Vulnerability Details CVEID: CVE-2016-2908 DESCRIPTION: IBM Security Access Manager could allow a remote attacke...

Security Bulletin: Apache POI as used in IBM QRadar SIEM is vulnerable to various CVEs.

Summary Vulnerabilities affecting Apache Poi as used in IBM QRadar SIEM Vulnerability Details CVE-ID: CVE-2012-0213 Description: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compound File Binary...

Security Bulletin: IBM Security Access Manager appliances are affected by an XML External Entity Injection vulnerability (CVE-2016-3027)

Summary IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2016-3027 DESCRIPTION: IBM Security Access Manager for Web is vulnerable to a denial of service, caused...

Security Bulletin: IBM QRadar SIEM is vulnerable to untrusted XML External Entity uploads. (CVE-2016-2868)

Summary XML External Entity injection in the UI of QRadar allows someone with privileges to upload unvalidated XML. Vulnerability Details CVE-ID: CVE-2016-2868 Description: IBM QRadar could allow a remote attacker with administrator privileges to obtain sensitive information, caused by an error...

Security Bulletin: Vulnerabilities in Open Source libxml2 affect IBM Security Identity Governance Appliance (CVE-2015-1819 )

Summary Vulnerabilities in Open Source libxml2 that is used by IBM Security Identity Governance Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreader when processing XML data. A...

Security Bulletin: A libxml vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-1819)

Summary IBM Security Access Manager for Mobile is affected by a denial of service vulnerability in libxml2. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreader when processing XM...

Security Bulletin: A vulnerability in Libxml affects IBM Security Network Protection (CVE-2015-1819)

Summary The Libxml library is a development toolbox providing the implementation of various XML standards. A security vulnerability has been discovered in Libxml used with IBM Security Network Protection. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of...

Security Bulletin: Multiple Apache Tomcat vulnerabilities in QRadar (CVE-2014-0075, CVE-2014-0095, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119)

Summary Multiple security vulnerabilities have been discovered in the Apache Tomcat component bundled with IBM QRadar versions 7.1.x and 7.2.x. Vulnerability Details CVE-ID: CVE-2014-0075 Description: Apache Tomcat is vulnerable to a denial of service, caused by the improper handling of a malform...

Security Bulletin: IBM B2B Advanced Communications is Affected by an XML External Entity Injection (XXE) Attack when Processing XML Data

Summary IBM B2B Advanced Communications has addressed a vulnerability originally found in IBM Financial Transaction Manager of an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory...

Security Bulletin: Financial Transaction Manager for ACH Services and Corporate Payment Services has a potential XML External Entity vulnerability (CVE-2017-1758)

Summary Financial Transaction Manager FTM for ACH Services and FTM for Corporate Payment Services CPS has addressed a potential XML External Entity vulnerability. For some web services, if the request is intercepted and modified, the XML payload could take advantage of XML External Entity Injecti...

Security Bulletin: Vulnerability in Apache POI affects IBM Emptoris Services Procurement (CVE-2017-5644)

Summary Open Source Apache Poi vulnerability affects IBM Emptoris Services Procurement Vulnerability Details CVE-ID: CVE-2017-5644 Description: Apache POI is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when processing XML data. By using a specially-craft...