Security Bulletin: Privilege Escalation and Cross Site Scripting vulnerabilities in IBM® InfoSphere® Master Data Management Collaborative Edition (CVE-2014-8896, CVE-2014-8897, CVE-2014-8898, CVE-2014-8899)

Summary Privilege Escalation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition could allow an escalation of privilege attack. Cross Site Scripting vulnerabilities in IBM InfoSphere Master Data Management - Collaborative Edition are caused by improper validation of...

Security Bulletin: Vulnerability in SSLv3 affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710 (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710. Vulnerability Details CVE-ID: CVE-2014-3566...

Security Bulletin: TLS padding vulnerability affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710. Vulnerability Details CVE-ID:...

Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, and 2050 are affected by the following Apache Tomcat vulnerabilities: CVE-2014-0098 and CVE-2013-6438

Summary The IBM InfoSphere Balanced Warehouse C3000 and C4000 for Windows and IBM Smart Analytics System 1050 and 2050 for Windows ship with Apache HTTP Server which contains known security vulnerabilities. Vulnerability Details CVE-ID: CVE-2014-0098 DESCRIPTION: Apache HTTP Server is vulnerable ...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM InfoSphere Balanced Warehouse C3000, C4000, D5100, IBM Smart Analytics System 1050, 2050, 5600 V1, 5600 V2, 5710, 7600, and 7700

Summary IBM WebSphere Application Server is shipped as a component of IBM InfoSphere Balanced Warehouse C3000, C4000, D5100, IBM Smart Analytics System 1050, 2050, 5600 V1, 5600 V2, 5710, 7600, and 7700. Information about a security vulnerability affecting IBM WebSphere Application Server has bee...

Security Bulletin: IBM Streams is affected by a XMLsoft Libxml2 vulnerability

Summary The libxml2 library, used by IBM Streams, is potentially vulnerable to a memory corruption error. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-4658 DESCRIPTION: The libxml2 library, as used in multiple products, could allow a remote attacker to...

Security Bulletin: IBM Streams is potentially affected by a vulnerability caused by parsing text in the Web Console

Summary The IBM Streams Web console is potentially vulnerable to cross-site scripting and other related attacks. IBM Streams has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1431 DESCRIPTION: IBM InfoSphere Streams is vulnerable to cross-site scripting. This vulnerability...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to a privilege escalation

Summary IBM InfoSphere Information Server could allow a local user to gain elevated privileges by placing arbitrary files in installation directories. Vulnerability Details CVEID: CVE-2017-1469 DESCRIPTION: IBM InfoSphere Information Server could allow a local user to gain elevated privileges by...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to a privilege escalation

Summary IBM InfoSphere Information Server could allow a local user to gain elevated privileges by placing arbitrary files in installation directories. Vulnerability Details CVEID: CVE-2017-1468 DESCRIPTION: IBM InfoSphere Information Server could allow a local user to gain elevated privileges by...

Security Bulletin: A vulnerability in XStream affects IBM InfoSphere Information Governance components

Summary A vulnerability in XStream was addressed by IBM InfoSphere Information Governance Catalog, IBM InfoSphere Information Server Business Glossary, and IBM InfoSphere Information Server Business Glossary Client for Eclipse. Vulnerability Details CVEID: CVE-2017-7957 DESCRIPTION: XStream is...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to Cross-Site Scripting (XSS)

Summary IBM InfoSphere Information Server Framework is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in April 2017. Vulnerability Details CVEID: CVE-2017-3511 DESCRIPTION: An...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server

Summary OpenSSL vulnerabilities were disclosed on January 26, 2017 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3731 DESCRIPTION: OpenSSL is vulnerable to a...

Security Bulletin: Denial of service vulnerability in OpenSSL affects IBM InfoSphere Master Data Management (CVE-2017-3733)

Summary IBM Initiate Master Data Service is vulnerable to an OpenSSL denial of service attack and could cause the application to crash. Vulnerability Details CVEID: CVE-2017-3733 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error during a renegotiate handshake when the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Information Server

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in January 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An...

Security Bulletin: A Vulnerability in IBM Java SDK affects IBM Streams (CVE-2016-5597)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 Service Refresh 11 used by IBM Streams. These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An unspecified vulnerability ...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM InfoSphere Identity Insight (CVE-2016-8919)

Summary WebSphere Application Server is shipped as a component of IBM InfoSphere Identity Insight. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Potential Denial of Service in WebSphere Applicatio...

Security Bulletin: Security vulnerabilities have been identified in data server connection and product integration shipped with InfoSphere Optim Query Workload Tuner [for LUW, z/OS] (CVE-2016-5546 CVE-2016-5548 CVE-2016-5549 CVE-2016-5547 CVE-2016-2183)

Summary Data server connection and product integration are shipped as a component of InfoSphere Optim Query Workload Tuner for LUW, z/OS. Information about security vulnerabilities affecting data server connection and product integration have been published in a security bulletin. Vulnerability...

Security Bulletin: Vulnerability in International Components for Unicode (ICU4C) affects IBM InfoSphere DataStage (CVE-2016-7415)

Summary An International Components for Unicode ICU4C vulnerability was addressed by IBM InfoSphere DataStage. Vulnerability Details CVEID: CVE-2016-7415 DESCRIPTION: International Components for Unicode ICU is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the...

Security Bulletin: Vulnerabilities in Apache POI affects IBM InfoSphere Information Server

Summary Apache POI vulnerabilities were addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2012-0213 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compoun...