Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary WebSphere Application Server Admin Console is vulnerable to cross-site scripting. This has been addressed. Vulnerability Details CVEID: CVE-2020-4578 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary IBM WebSphere Application Server traditional is vulnerable to an XML External Entity XXE Injection vulnerability Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injectio...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by InfoSphere Master Data Management

Summary WebSphere Application Server is vulnerable to a directory traversal vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20354 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery SSRF. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 197502. Vulnerability Details CVEID:...

Security Bulletin: IBM InfoSphere Master Data Management Server is vulnerable to Insecure HTTP Method - TRACE discovered in MDM User Interface (CVE-2016-9718)

Summary IBM InfoSphere Master Data Management is vulnerable to a cross-site scripting Attack and could allow users to embed arbitrary JavaScript code in MDM User Interfaces and lead to disclosure of credentials. Insecure HTTP Method - TRACE discovered in MDM User Interface affects Inspector and W...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management 11.6

Summary IBM WebSphere Application Server ND 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured. Vulnerability Details CVEID: CVE-2020-4575 DESCRIPTION: IBM WebSphere Application Server ND 8.5 and 9.0...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management 11.6

Summary Upgrade of WebSphere Application Server within containerzed MDM application. IBM WebSphere Application Server 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted U...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary WebSphere Application Server traditional is vulnerable to an XML External Entity XXE Injection vulnerability Vulnerability Details CVEID: CVE-2021-20453 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection XXE attack when...

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to a X-Frame-Options Header ClickJacking attack (CVE-2016-9719 )

Summary IBM InfoSphere Master Data Management is vulnerable to a X-Frame-Options Header ClickJacking attack a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Vulnerability Details CVEID: CVE-2016-9719...

Security Bulletin: IBM InfoSphere Master Data Management Standard and Advanced Editions are affected by vulnerabilities in OpenSSL (CVE-2019-1559)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2019-1559 Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length...

Security Bulletin: IBM InfoSphere Master Data Management Server is vulnerable to cross-site scripting Attack (CVE-2016-9715)

Summary IBM InfoSphere Master Data Management is vulnerable to a cross-site scripting Attack and could allow users to embed arbitrary JavaScript code in the Web UI and lead to disclosure of credentials. Vulnerability Details CVEID: CVE-2016-9715 DESCRIPTION: IBM InfoSphere Master Data Management...

Security Bulletin: InfoSphere Master Data Management 11.6 affected due to vulnerability in OpenSSL

Summary InfoSphere Master Data Management 11.6 affected due to vulnerability in OpenSSL 1.0.2s and prior. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC group...

Security Bulletin: IBM InfoSphere Master Data Management Server vulnerability in OpenSSL

Summary The vulnerability in CVE-2020-1971 have been addressed in the latest interim Fix iFix available on Fix Central for all 3 affected versions. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the...

Security Bulletin: IBM InfoSphere Master Data Management Server is affected by WebSphere Application Server traditional vulnerability

Summary IBM WebSphere Application Server 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230. Vulnerability Details CVEID: CVE-2020-4449 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0...

Security Bulletin: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.

Summary We are impacted as we ship WAS in docker image. As per security bulletin: https://www.ibm.com/support/pages/security-bulletin-information-disclosure-vulnerability-websphere-application-server-cve-2019-4441. For V9.0.0.0 through 9.0.5.1: · Upgrade to minimal fix pack levels as required by...

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to OpenSSLvulnerability (CVE-2017-3735)

Summary IBM InfoSphere Master Data Management is vulnerable to OpenSSL vulnerability that could allow an attacker to obtain sensitive information by triggering an out-of-bounds read and resulting in the incorrect text display of the certificate. Vulnerability Details CVEID: CVE-2017-3735...

Security Bulletin: IBM InfoSphere Master Data Management Server is vulnerable to cross-site scripting (XSS) Attack (CVE-2017-1199)

Summary IBM InfoSphere Master Data Management is vulnerable to a cross-site scripting XSS Attack and could allow users to embed arbitrary JavaScript code in the Web UI and lead to disclosure of credentials. Vulnerability Details CVEID: CVE-2017-1199 DESCRIPTION: IBM InfoSphere Master Data...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management

Summary Security Bulletin: WebSphere Application Server is vulnerable to an information disclosure vulnerability CVE-2020-4576. WebSphere Application Server is vulnerable to an information disclosure vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2020-4576 DESCRIPTION: I...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM InfoSphere Master Data Management

Summary There is a vulnerability in the Dojo library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By...

Security Bulletin: IBM InfoSphere Reference Data Management affected by Cross Site Scripting vulnerabilities(CVE-2015-7492)

Summary IBM InfoSphere Reference Data Management is vulnerable to Cross Site Scripting attack caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-7492 DESCRIPTION: IBM InfoSphere Master Data Management is vulnerable to cross-site scripting, caused by improp...