Security Bulletin: IBM Bootable Media Creator (BoMC) is affected by vulnerabilities in libexpat

Summary IBM Bootable Media Creator BoMC has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-20843 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by an error in the XML parser. By persuading a victim to open a specially-crafted file, a remote...

Security Bulletin: Vulnerability in IBM Java SDK and IBM Java Runtime affects TPF Toolkit

Summary A vulnerability in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ that is used by TPF Toolkit has been addressed. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an...

Security Bulletin: Security Bypass Vulnerability in PostgreSQL Affects IBM Connect:Direct Web Services ( CVE-2021-3393)

Summary Security bypass vulnerability in PostgreSQL versions used by IBM Connect:Direct Web Services. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-3393 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensiti...

Security Bulletin: Security Bypass Vulnerability in PostgreSQL Affects IBM Connect:Direct Web Services (CVE-2021-20229)

Summary Security bypass vulnerability in PostgreSQL versions used by IBM Connect:Direct Web Services. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-20229 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain...

Security Bulletin: Security Bypass Vulnerability in PostgreSQL Affects IBM Connect:Direct Web Services (CVE-2020-10733)

Summary Security bypass vulnerability in PostgreSQL versions used by IBM Connect:Direct Web Services. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-10733 DESCRIPTION: PostgreSQL could allow a local authenticated attacker to execute...

Security Bulletin: Hibernate ORM Vulnerabilities Affect IBM Control Center (CVE-2019-14900, CVE-2020-25638)

Summary Hibernate ORM is vulnerable to SQL injection. Vulnerability Details CVEID: CVE-2019-14900 DESCRIPTION: Hibernate ORM is vulnerable to SQL injection. The implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the...

Security Bulletin: Security Bypass Vulnerability in Spring Framework Affects IBM Control Center (CVE-2020-5421)

Summary Spring Framework vunerability could allow a remote attacker to bypass security restrictions, caused by improper input validation. Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by...

Security Bulletin: A vulnerability in the IBM® SDK, Java™ Technology Edition affects IBM Tivoli Network Manager CVE-2020-14782.

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle October 2020 Critical Patch Update, but deferred until the release associated with the IBM February 2021 Critical Patch...

Security Bulletin: Security Bypass Vulnerability in PostgreSQL Affect IBM Connect:Direct Web Service

Summary Security bypass vulnerability in PostgreSQL versions used by IBM Connect:Direct Web Service. IBM Connect:Direct Web Services has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-1720 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to bypass security...

Security Bulletin: IBM Kenexa LMS On Premise -CVE-2020-14781 (deferred from Oracle Oct 2020 CPU for Java 8)

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could...

Security Bulletin: IBM Kenexa LMS On Premise - CVE-2020-14782 (deferred from Oracle Oct 2020 CPU for Java 8)

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component...

Security Bulletin: A vulnerabilities in IBM Java affects IBM Rational Asset Analyzer.

Summary A vulnerability identified in IBM® SDK Java™ Technology Edition Version 1.8 that is used by IBM Rational Asset Analyzer. These issues were disclosed as part of the IBM Java SDK updates in January 2021. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability i...

Security Bulletin: IBM Planning Analytics Workspace is affected by a security vulnerability

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by a vulnerability. This has been addressed in IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 63. Vulnerability Details CVEID: CVE-2020-4562 DESCRIPTION: IBM Planning Analytics could...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise (CVE-2020-1968)

Summary Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprsie. The DataDirect ODBC Drivers used by IBM App Connect Enterprise and IBM Integration Bus have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a...

Security Bulletin: Vulnerabilities in Java affects IBM Cloud Application Business Insights

Summary Vulnerabilities in Java affects IBM Cloud Application Business Insights Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using...

Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms

Summary TXSeries for Multiplatforms has addressed the following vulnerability reported by IBM® Runtime Environment Java™ Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacke...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect TXSeries for Multiplatforms

Summary TXSeries for Multiplatforms has addressed the following vulnerabilities reported by IBM® Runtime Environment Java™ Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information...

Security Bulletin: Vulnerabilities in GPFS affect InfoSphere BigInsights (CVE-2015-0197, CVE-2015-0198, CVE-2015-0199)

Summary GPFS is an IBM component that can be used as distributed file system in Big Insights. The GPFS that is shipped with InfoSphere BigInsights contains multiple security vulnerabilities. These vulnerabilities could allow a local attacker to execute programs with root privileges, and cause...

Security Bulletin: Infosphere BigInsights is affected by a vulnerability in DB2 (CVE-2015-1947).

Summary Infosphere BigInsights is affected by a local escalation of privilege vulnerability in DB2 CVE-2015-1947. The vulnerability exists in the Big SQL server component included in BigInsights. Vulnerability Details CVEID: CVE-2015-1947 DESCRIPTION: IBM DB2 is vulnerable to a privilege escalati...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect APM CoreFramework (March 2021)

Summary There are multiple vulnerabilities in APM CoreFramework. APM CoreFramework has addressed the applicable CVEs. Please use 8.1.4.0-IBM-APM-CORE-FRAMEWORK-IF0021 Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization...