PT-2019-16873 · Ibm · Ibm I2 Intelligent Analyis Platform

Name of the Vulnerable Software and Affected Versions: IBM i2 Intelligent Analyis Platform versions 9.0.0 through 9.1.1 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information o...

Security Bulletin: IBM i2 Intelligent Analyis Platform is affected by a XML External Entity (XXE) vulnerability

Summary IBM i2 Intelligent Analyis Platform has addressed the following vulnerability. XML External Entity vulnerability. This vulnerability allows attackers to exploit the External Entity feature of XML, resulting in the potential for an external party to gain access to sensitive information, or...

Security Bulletin: Missing Secure HTTP Headers

Summary During internal penetration testing we identified that the IBM i2 Enterprise Insight Analysis application could be made more secure with the addition of some HTTP headers. Vulnerability Details CVEID: CVE-2018-1525 DESCRIPTION: IBM i2 Intelligent Analyis Platform could allow a remote...

Security Bulletin: IBM i2 Analyst's Notebook XML Entity Injection Vulnerability

Summary IBM i2 Analyst's Notebook Premium version 9.0.8 has addresses the XML Entity Injection vulnerability detailed in CVE-2018-1527. When using any of the import features on IBM i2 Analyst's Notebook Premium, Cellebrite, XRY, and Notebook Exchange from the Import menu, it is possible to import...

Security Bulletin: IBM i2 Intelligent Analyis Platform is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM® Java SE distribution that are fixed in the October release. IBM i2 Enterprise Insight Analysis 2.1.8 and 2.2.0 are impacted by these Java Vulnerabilities. This security bulletin explains the issue and how to remediate it. In summary download the...

Security Bulletin: IBM i2 Enterprise Insight Analysis. CVE-2018-12539

Summary IBM i2 Enterprise Insight Analysis is delivered with the IBM Java Runtime. A vulnerability was discovered in the IBM Java Runtime that can leave the product vulnerable to attacks allowing arbitrary code to be injected. Vulnerability Details CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ...

Design/Logic Flaw

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

Code injection

IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 141413...

Information disclosure

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM...

CVE-2018-1504

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2018-1505

IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 141413...

CVE-2018-1525

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM...

CVE-2018-1504

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2018-1505

IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 141413...

CVE-2018-1525

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM...

CVE-2018-1504

CVE-2018-1504 affects IBM i2 Enterprise Insight Analysis 2.1.7. A remote attacker could persuade a victim to visit a malicious site to hijack the victim’s click actions (clickjacking), potentially enabling further attacks. The provided documents do not include explicit exploit details or a confir...

CVE-2018-1505

IBM i2 Enterprise Insight Analysis 2.1.7 is affected by an information disclosure vulnerability where web pages can be stored locally and read by another user on the same system. The IBM bulletin indicates remediation by upgrading to the 2.2.0 release (updates include added secure headers; applie...

CVE-2018-1525

IBM i2 Enterprise Insight Analysis 2.1.7 is affected by a vulnerability where HTTP Strict Transport Security was not properly enabled, enabling potential information disclosure via man-in-the-middle attacks. The IBM bulletin indicates the issue lies in missing secure headers and notes an upgrade ...

CVE-2018-1504: Improper Input Validation

IBM i2 Enterprise Insight Analysis 2.1.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2018-1505: Exposure of Sensitive Information to an Unauthorized Actor

IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 141413...