Security Bulletin: HTTP Header Injection Vulnerability Addressed in Asset and Service Management (CVE-2014-3026)

Summary Header injection in HTTP responses can allow for HTTP response splitting, Session fixation via the Set-Cookie header, cross-site scripting XSS, and malicious redirects attacks via the location header in Maximo Asset Mgmt, and SmartCloud Control Desk. Vulnerability Details DESCRIPTION:...

Security Bulletin: IBM Tivoli Network Manager IP Edition V39 Fix Pack 4 HTTPS support for Perl Collector install is affected by the following OpenSSL vulnerabilities: (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195 and CVE-2014-3470)

Summary Security vulnerabilities have been discovered in OpenSSL 9.7d package that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/T...

Security Bulletin: Vulnerabilities in IBM Tivoli Monitoring agent and shared library with potential for privilege escalation (CVE-2013-5467)

Summary Privilege escalation vulnerability in an IBM Tivoli Monitoring ITM agent could be exploited by a local user to gain elevated privilege of another user. This vulnerability also affects a shared library shipped with all ITM components and agents. Vulnerability Details CVEID: CVE-2013-5467...

Security Bulletin: Potential Security Vulnerability With Maximo Asset Management

Summary Smarter Infrastructure Products - Potential cross-site scripting vulnerability when using Maximo Asset Management and SmartCloud Control Desk products. Vulnerability Details CVE IDs: CVE-2013-5402 DESCRIPTION: CVE ID| DESCRIPTION ---|--- CVE-2013-5402 CVSS Base Score: 3.5 CVSS Temporal...

Potential security vulnerability with IBM WebSphere Application Server

Abstract Security Bulletin: Asset and Service Management Products - Potential security exposure with IBM WebSphere application server after installing fix for APAR PM44303 CVE-2012-3325 Content VULNERABILITY DETAILS: CVE ID: CVE-2012-3325 DESCRIPTION: Customers that have installed a Websphere...

Security Bulletin: IBM StoredIQ is affected by a privilege escalation vulnerability

Summary IBM StoredIQ has addressed the following vulnerability that could allow an authenticated attacker to bypass certain security restrictions. Vulnerability Details CVEID: CVE-2018-1583 DESCRIPTION: IBM StoredIQ could allow an authenticated attacker to bypass certain security restrictions. By...

Security Bulletin: IBM StoredIQ for Legal has released Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 for IBM StoredIQ for Legal in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions Affected Product...

Security Bulletin: IBM Content Collector for Email affected by vulnerability due to WebSphere Application Server having insecure permissions when custom start up scripts are used

Summary IBM Content Collector for Email is affected by vulnerability due to WebSphere Application Server having insecure permissions when custom start up scripts are used. WAS might create files using the default permissions instead of the customized permissions, due to which a local attacker cou...

Security Bulletin: IBM Atlas eDiscovery Process Management vulnerable to unsafe third-party links.

Summary Atlas eDiscovery Process Management has addressed the following vulnerability: An authenticated attacker could obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. The third-party links with target="blank" attribute and no rel="noopener noreferrer"...

Security Bulletin: IBM Atlas eDiscovery Process Management vulnerable to SQL injection.

Summary Atlas eDiscovery Process Management has addressed vulnerablility due to SQL injection, where a remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU affect IBM Content Collector for SAP Applications

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID:...

Security Bulletin: Sweet32 Birthday attacks on 64-bit block ciphers in TLS affect Content Manager for z/OS (CVE-2016-2183)

Summary System SSL's SSL V2, SSL V3 and TLS protocols support the use of Triple DES ciphers and are susceptible to the Sweet32 Birthday attack vulnerability. This vulnerability affects exploiters acting as either clients or servers. Content Manager 8 Resource Manager on z/OS uses System SSL and...

Security Bulletin: Open Source Apache Tomcat Commons FileUpload Vulnerabilities affects Atlas Policy Suite (CVE-2016-3092)

Summary Apache Commons Fileupload vulnerability affects Atlas Policy Suite Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could...

Security Bulletin: Vulnerability in nginx affects IBM StoredIQ (CVE-2016-4450)

Summary A denial of service vulnerability was disclosed on May 31, 2016 by nginx. Nginx is used by StoredIQ. StoredIQ has addressed the applicable CVE Vulnerability Details CVE-ID: CVE-2016-4450 Description: nginx is vulnerable to a denial of service, caused by a NULL pointer dereference error in...

Security Bulletin:IBM WebSphere deserialization of untrusted data in IBM eDiscovery Manager

Summary IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a serialized object from untrusted sources. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java cod...

Security Bulletin: Content Manager OnDemand for Multiplatforms is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-0729)

Summary Content Manager OnDemand for Multiplatforms is affected by Open Source Apache Xerces-C XML parser Vulnerabilities. Vulnerability Details CVEID: CVE-2016-0729 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during...

Security Bulletin: Vulnerability in Flexera InstallAnywhere affects IBM eDiscovery Manager (CVE-2016-4560)

Summary Flexera InstallAnywhere has a security vulnerability that could be exploited in IBM eDiscovery Manager. Vulnerability Details CVEID: CVE-2016-4560 DESCRIPTION: Flexera InstallAnywhere could allow a local attacker to gain elevated privileges on the system, caused by an untrusted search pat...

Security Bulletin: Vulnerability in Flexera InstallAnywhere affects IBM eDiscovery Analyzer (CVE-2016-4560)

Summary Flexera InstallAnywhere has a security vulnerability that could be exploited in IBM eDiscovery Analyzer. Vulnerability Details CVEID:CVE-2016-4560 DESCRIPTION:Flexera InstallAnywhere could allow a remote attacker to execute arbitrary code on the system. The application does not directly...

Security Bulletin: Two vulnerabilities exist in IBM Case Foundation and FileNet Business Process Manager (CVE-2012-5784 and CVE-2014-3596)

Summary Apache Axis contains two security vulnerabilities that could allow for spoofing attacks. See the individual descriptions below for the details. Vulnerability Details CVE-ID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct...

Security Bulletin: IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2015-1888)

Summary IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-1888 IBM Content Navigator is vulnerable to cross-site scripting. The vulnerability is caused by improper validation of user...