Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager (CVE-2016-0448, CVE-2016-0466)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2016-0448 DESCRIPTION: A...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager (CVE-2015-2625 , CVE-2015-4748, CVE-2015-4749)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 Service Refresh 16 Fix Pack 5 and earlier and 7 Service Refresh 9 Fix Pack 1 and earlier that is used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses RC4 Bar Mitzvah Attack for...

Security Bulletin: A vulnerability in Apache Axis affects IBM Cognos Metrics Manager (CVE-2012-5784)

Summary An Apache Axis vulnerability was disclosed in Nov 2012. The Apache Axis library is included with IBM Cognos Metrics Manager. IBM Cognos Metrics Manager has addressed the vulnerability. Vulnerability Details CVEID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products,...

Security Bulletin: Vulnerability in SSLv3 affects IBM Cognos Metrics Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Cognos Metrics Manager. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos TM1 (CVE-2014-3566, CVE-2014-6457)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6 Service Refresh 16-FP1 and earlier and 7 Service Refresh 7-FP1 and earlier that is used by IBM Cognos TM1. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affects WebSphere Application Server October 2017 CPU

Summary There are multiple vulnerabiltities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in October 2017. These may affect some configurations of IBM WebSphere Application Server...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server affect IBM Business Process Manager (BPM), WebSphere Process Server (WPS), WebSphere Enterprise Service Bus, and WebSphere Lombardi Edition (WLE) (Java CPU July 2017)

Summary WebSphere Application Server is shipped as a component of IBM Business Process Manager, WebSphere Process Server, WebSphere Enterprise Service Bus, and WebSphere Lombardi Edition. WebSphere Application Server Liberty is shipped as a component of the optional BPM component Process Federati...

Security Bulletin:Multiple Vulnerabilities in IBM® Java SDK affects WebSphere Application Server April 2017 CPU

Summary There are multiple vulnerabiltities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in April 2017. These may affect some configurations of IBM WebSphere Application Server...

Security Bulletin: A security vulnerability in WebSphere Application Server might affect IBM Business Process Manager (CVE-2017-1151)

Summary WebSphere Application Server is shipped as a component of IBM Business Process Manager BPM. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. The affected component is only available in case option...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server affect IBM Business Process Manager (BPM), WebSphere Process Server (WPS) and WebSphere Lombardi Edition (WLE) (Java CPU January 2017)

Summary WebSphere Application Server is shipped as a component of IBM Business Process Manager, WebSphere Process Server, and WebSphere Lombardi Edition. WebSphere Application Server Liberty is shipped as a component of the optional BPM component Process Federation Server. Information about...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affects WebSphere Application Server July 2016 CPU (CVE-2016-3485)

Summary There are multiple vulnerabiltities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the IBM Java SDK updates in July 2016. These may affect some configurations of IBM WebSphere Application Server Full Profile,...

Security Bulletin: Incorrect authorization for update of process instance variables in IBM Business Process Manager (CVE-2016-0349)

Summary Due to incorrect authorization for update of process instance variables, users without required permission can update process instance variables in IBM Business Process Manager. Vulnerability Details CVEID: CVE-2016-0349 DESCRIPTION: IBM Business Process Manager allows authenticated users...

Security Bulletin: The GPFS pattern provided with IBM PureApplication System is affected by a security vulnerability. (CVE-2015-1788)

Summary An OpenSSL vulnerability has been identified in the current levels of IBM Spectrum Scale V4.1.1 and IBM GPFS V4.1. IBM PureApplication System provides a GPFS pattern and addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial...

Security Bulletin: IBM Business Process Manager authorization checks for process and task deletion are insufficient (CVE-2015-7463)

Summary An API to delete process and task data is incorrectly available for non administrative users. Vulnerability Details CVEID: CVE-2015-7463 DESCRIPTION: IBM Business Process Manager could allow an authenticated user to delete process and task data through a command that should only be...

Security Bulletin: Vulnerability with Java Portlet Specification JSR 286 may affect WebSphere Application Server (CVE-2015-1926)

Summary There has been a change to the Java Portlet Specification 2.0 JSR 286 that may affect some configurations of WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-1926 DESCRIPTION: The Java Portlet Specification JSR 286 API jar file code could allow a remote attacker to obta...

Security Bulletin: Multiple vulnerabilities in IBM SDK for Java Technology Edition affect WebSphere Dynamic Process Edition (CVE-2014-6512, CVE-2014-6457, CVE-2014-6558, CVE-2014-3566)

Summary There are multiple vulnerabilities in IBM® SDK for Java™ Technology Edition that is used by WebSphere Dynamic Process Edition. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed as part of t...

Security Bulletin: Possible security exposures within IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus (WESB) - IBM SDK for Java October 2014 CPU

Summary There are multiple security vulnerabilities within the version of IBM WebSphere Application Server that is provided with WebSphere Enterprise Service Bus. Vulnerability Details These security vulnerabilities are all fixed with available interim fixes and are targeted for specific WebSpher...

Security Bulletin: Possible security exposures within IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus (WESB) - IBM Java SDK July 2014 CPU

Summary There are multiple security vulnerabilities within the version of IBM WebSphere Application Server that is provided with WebSphere Enterprise Service Bus. Vulnerability Details These security vulnerabilities are all fixed with available interim fixes and are targeted for specific WebSpher...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Dynamic Process Edition (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by WebSphere Dynamic Process Edition. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability relat...