Security Bulletin: IBM Platform Symphony (CVE-2014-0094, CVE-2014-0112, CVE-2014-0113, CVE-2014-0116)

Summary Several security vulnerabilities have been reported against Apache Struts 2 through May 2014. IBM Platform Symphony’s GUI uses Struts 2 as a framework for Java web applications. A version of the package that is vulnerable to these issues is included in several past versions of IBM Platfor...

Security Bulletin: IBM Platform Symphony (CVE-2013-5400)

Summary This bulletin relates to a potential elevation of privilege vulnerability when IBM Platform Symphony Developer Edition is installed in a networked environment. Vulnerability Details CVE ID: CVE-2013-5400 DESCRIPTION: IBM Platform Symphony Developer Edition installation includes a servlet...

Security Bulletin: IBM Platform Symphony (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)

Summary This bulletin relates to several security vulnerabilities that have been reported against Apache Struts 2 through October 2013. IBM Platform Symphony includes a version of Struts 2 that is vulnerable to these issues. Vulnerability Details Several security vulnerabilities have been reporte...

Security Bulletin: Open Source Cacti vulnerability affects IBM Platform RTM (CVE-2016-3172, CVE-2016-3659)

Summary Cacti is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tree.php script using the parentid parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. A remote attacker could send...

CVE-2017-1460

IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue router spoofs its origin. Routing tables are affected by a missing LSA, which may lead to loss of connectivity. IBM X-Force ID: 128379...

CVE-2017-1205: Undefined Security Weakness

IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root access. IBM X-Force ID: 123741...

PT-2017-12326

Name of the Vulnerable Software and Affected Versions IBM Platform LSF version 10.1 Description The issue allows a local user to escalate their privileges and obtain root access. Recommendations For IBM Platform LSF version 10.1, at the moment, there is no information about a newer version that...

CVE-2013-5400

An unspecified servlet in IBM Platform Symphony Developer Edition DE 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors...

CVE-2013-5400: Undefined Security Weakness

An unspecified servlet in IBM Platform Symphony Developer Edition DE 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors...

PT-2014-2921

Name of the Vulnerable Software and Affected Versions IBM Platform Symphony Developer Edition versions 5.2 through 6.1.1 Description The issue concerns hardcoded credentials in an unspecified servlet, allowing remote attackers to bypass authentication and gain access to the local environment...

CVE-2013-6305

IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key across different customers' installations, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging knowledge of this key...

PT-2014-3079

Name of the Vulnerable Software and Affected Versions IBM Platform Symphony versions 5.2 before build 229037 IBM Platform Symphony versions 6.1.0.1 before build 229073 Description The issue allows context-dependent attackers to obtain sensitive information by leveraging knowledge of the credentia...

CVE-2013-6305: Undefined Security Weakness

IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key across different customers' installations, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging knowledge of this key...

IBM Platform Symphony SOAP Requests Processing Buffer Overflow (CVE-2013-5387)

A buffer overflow vulnerability has been reported in IBM Platform Symphony...

Buffer overflow

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

CVE-2013-5387: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service process crash or hang via a malformed SOAP request with a large amount of request data...

PT-2013-5508

Name of the Vulnerable Software and Affected Versions IBM Platform Symphony versions 5.2, 6.1, and 6.1.1 Description The issue allows remote attackers to cause a denial of service, potentially leading to a process crash or hang, by sending a malformed SOAP request with a large amount of request...