Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections. These issues were disclosed as part of the IBM Java SDK...

Security Bulletin: A security vulnerability has been addressed in IBM Cognos Analytics (CVE-2019-4178)

Summary This bulletin addresses a security vulnerability that has been fixed in IBM Cognos Analytics 11.0.13 FP1 as well as 11.0.9-11.0.12 Interim Fixes. IBM Cognos Analytics could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL reques...

There is a vulnerability in OpenSSL used by AIX.

IBM SECURITY ADVISORY First Issued: Tue Apr 16 10:48:55 CDT 2019 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory30.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory30.asc...

Security Bulletin: A vulnerability in IBM WebSphere Application Server and WebSphere Liberty affects IBM Operations Analytics Predictive Insights (CVE-2018-1902)

Summary There is a vulnerability in IBM WebSphere Application Server and WebSphere Liberty that are used by IBM Operations Analytics Predictive Insights 1.3.6 and earlier versions. IBM Operations Analytics Predictive Insights has addressed the applicable CVE. This issue was also addressed by IBM...

Security Bulletin: Potential bypass security vulnerability in Expression Language library used by WebSphere Application Server shipped with Jazz for Service Management (CVE-2014-7810)

Summary Security Bulletin: Potential bypass security vulnerability in Expression Language library used by WebSphere Application Server shipped with Jazz for Service Management CVE-2014-7810 Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypa...

Security Bulletin: Cross-site scripting vulnerability in Installation Verification Tool of WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-1643)

Summary There is a potential cross-site scripting vulnerability with the Installation Verification Tool of IBM WebSphere Application Server shipped with Jazz for Service Management. Vulnerability Details CVEID: CVE-2018-1643 DESCRIPTION: The Installation Verification Tool of IBM WebSphere...

Security Bulletin: Potential Privilege Escalation Vulnerability in WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-1901)

Summary There is Potential Privilege Escalation Vulnerability in WebSphere Application Server shipped with Jazz for Service Management Vulnerability Details CVEID: CVE-2018-1901 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to temporarily gain elevated privileges on...

Security Bulletin: Potential denial of service in WebSphere Application Server (CVE-2018-10237)

Summary There is a potential denial of service with the Google Guava library that is used in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-10237 DESCRIPTION: Google Guava is vulnerable to a denial of service, caused by improper eager allocation checks in the AtomicDoubleArra...

Security Bulletin: Weaker than expected security in WebSphere Application Server with SP800-131 transition mode (CVE-2018-1996)

Summary There is a potential for weaker than expected security in WebSphere Application Server with SP800-131 transition mode and SSLTLSv2. Vulnerability Details CVEID: CVE-2018-1996 DESCRIPTION: IBM WebSphere Application Server could provide weaker than expected security, caused by the improper...

Security Bulletin: Potential Spoofing vulnerability in WebSphere Application Server (CVE-2018-1902)

Summary There is a potential spoofing vulnerability in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks against the...

Security Bulletin: Potential information disclosure in WebSphere Application Server (CVE-2018-1957)

Summary There is a potential information disclosure in WebSphere Application Server CVE-2018-1957 Vulnerability Details CVEID: CVE-2018-1957 DESCRIPTION: IBM WebSphere Application Server could allow sensitive information to be available caused by mishandling of data by the application based on an...

Security Bulletin: Potential Remote code execution vulnerability in WebSphere Application Server (CVE-2018-1904)

Summary There is a potential remote code execution vulnerability in WebSphere Application Server CVE-2018-1904 Vulnerability Details CVEID: CVE-2018-1904 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code through an administrative client clas...

Security Bulletin: Potential Privilege escalation vulnerability in WebSphere Application Server (CVE-2018-1840)

Summary There is a potential privilege elevation vulnerability in WebSphere Application Server after migration from WebSphere Application Server Version 8 when a security domain is configured to use a federated repository other than global federated repository. Vulnerability Details CVEID:...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server October 2018 CPU

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in October 2018. These may affect some configurations of IBM WebSphere Application Server...

Security Bulletin: Potential cross-site scripting vulnerability in the WebSphere Application Server Admin Console (CVE-2018-1777)

Summary There is a potential cross-site scripting vulnerability in the WebSphere Application Server Admin Console. Vulnerability Details CVEID: CVE-2018-1777 DESCRIPTION: IBM WebSphere Application Server Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: Potential bypass security vulnerability in Expression Language library used by WebSphere Application Server (CVE-2014-7810)

Summary There is a potential bypass security vulnerability in the expression language library used by WebSphere Application Server CVE-2014-7810 Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the use o...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server (CVE-2018-1793)

Summary There is a potential cross-site scripting vulnerability in SAML ear in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: Cross-site scripting vulnerability in CacheMonitor for WebSphere Application Server (CVE-2018-1767)

Summary There is a potential cross-site scripting vulnerability in the Cache Monitor web application in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1767 DESCRIPTION: IBM WebSphere Application Server CacheMonitor is vulnerable to cross-site scripting. This vulnerability...

Security Bulletin: Potential traversal vulnerability in IBM WebSphere Application Server Admin Console (CVE-2018-1770)

Summary There is a potential directory traversal vulnerability in the Admin Console for WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1770 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to traverse directories on the system. An attacker could sen...

Security Bulletin: Potential spoofing attack in WebSphere Application Server (CVE-2018-1695)

Summary There is a potential spoofing attack in WebSphere Application Server using Form Login when using Java SE 6. This does not occur when using other versions of the Java SE. Vulnerability Details CVEID: CVE-2018-1695 DESCRIPTION: IBM WebSphere Application Server installations using Form Login...