Security Bulletin: IBM Security Access Manager Appliance is affected by a vulnerability in NSS (CVE-2017-7805)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-7805 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in TLS 1.2 generating handshake hashes...

Security Bulletin: IBM Security Access Manager Appliance is affected by a potential information exposure vulnerability (CVE-2017-1480)

Summary IBM Security Access Manager Appliance has addressed the following information exposure vulnerability. Vulnerability Details CVEID: CVE-2017-1480 DESCRIPTION: IBM Security Access Manager Appliance stores potentially sensitive information in log files that could be read by a remote user. CV...

Security Bulletin: IBM Security Access Manager Appliance is affected by an open redirect vulnerability (CVE-2017-1534)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1534 DESCRIPTION: IBM Security Access Manager Appliance could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim t...

Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability known as the SWEET32 Birthday attack (CVE-2016-2183)

Summary The IBM Security Access Manager appliances are affected by the SWEET32 Birthday attack vulnerability, which could allow an attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in the libgcrypt library (CVE-2016-6313)

Summary A vulnerability has been identified in the libgcrypt library. IBM Security Access Manager appliances use the libgcrypt library and are affected by this vulnerability. Vulnerability Details CVEID: CVE-2016-6313 DESCRIPTION: GnuPG could provide weaker than expected security, caused by an...

Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in Busybox (CVE-2014-9645)

Summary A vulnerability has been identified in Busybox. IBM Security Access Manager appliances use Busybox and are affected by this vulnerabilty. Vulnerability Details CVEID: CVE-2014-9645 DESCRIPTION: Busybox could allow a local attacker to bypass security restrictions, caused by an error when...

Security Bulletin: IBM Security Access Manager appliances may be affected by a kernel vulnerability known as the Dirty COW bug (CVE-2016-5195)

Summary Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a race condition when handling the copy-on-write COW breakage of private read-only memory mappings by the memory subsystem. This vulnerability is known as the Dirty COW bug. Under certain...

Security Bulletin: IBM Security Access Manager appliances are affected by an information disclosure vulnerability (CVE-2016-3045)

Summary IBM Security Access Manager appliances store sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. Vulnerability Details CVEID: CVE-2016-3045 DESCRIPTION: IBM...

Security Bulletin: IBM Security Access Manager appliances are affected by a response splitting vulnerability in WebSphere Application Server (CVE-2016-0359)

Summary IBM Security Access Manager version 8 & 9 appliances are affected by a HTTP response splitting vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A...

Security Bulletin: IBM Security Access Manager appliances are affected by an XML External Entity Injection vulnerability (CVE-2016-3027)

Summary IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2016-3027 DESCRIPTION: IBM Security Access Manager for Web is vulnerable to a denial of service, caused...

Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in OpenSSL (CVE-2016-0797, CVE-2016-0705)

Summary Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web. Vulnerability Details CVEID: CVE-2016-0797 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in the BNhex2bn/BNdec2bn function. An attacker could exploit this vulnerability...

Security Bulletin: A vulnerability in SQLite affects IBM Security Access Manager for Web (CVE-2015-3416)

Summary There is a denial of service vulnerability in SQLite, which affects IBM Security Access Manager for Web. Vulnerability Details CVEID: CVE-2015-3416 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by the failure to properly handle precision and width values during...

Security Bulletin: A vulnerability in nss-softokn affects IBM Security Access Manager for Web (CVE-2015-2730)

Summary Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. IBM Security Access Manager for Web is affected by a vulnerability in the nss-softokn package. Vulnerability Details CVEID: CVE-2015-2730...

Security Bulletin: IBM Tealeaf Customer Experience (CX) is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

CVE-2017-14377: Improper Authentication

EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 have a security vulnerability that could potentially lead to authentication bypass...

Workspace Control - Connect and Disconnect button in Receiver for Web are not visible

Consider the following scenario. You have enabled Workspace Control for Receiver for Webin your Xen Desktop environment. Additionally, you have enabled the setting to display Reconnect/Disconnect button for Receiver for Web asshown in the screenshot below: However, when user logs on toReceiver fo...

CVE-2017-6869: Improper Authentication

A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted networ...

StoreFront 3.7 and Above - XenDesktop access policy rules cannot be applied on Endpoint

After implementing the steps mentioned in https://www.citrix.com/blogs/2015/07/01/rewriting-the-session-clientname-from-storefront/ , XenDesktop access policy rules cannot be applied on client name as the client host name comes up as WRXXXXX when using Receiver for web . The client name can only ...

Siemens Viewport for Web Office Portal

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Viewport for Web Office Portal Vulnerability: Improper Authentication AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following ViewPort for Web Office Portal products: ViewPort...

CVE-2016-3051: Undefined Security Weakness

IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-Force ID: 114714...