Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Composite Application Manager for Transactions (CVE-2014-3513, CVE-2014-3567)

Summary There are multiple vulnerabilities in OpenSSL that is used by IBM Tivoli Composite Application Manager for Transactions. These issues were disclosed on October 15, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-3513 DESCRIPTION: OpenSSL is vulnerable to a denial of...

Security Bulletin: No validation on SSL certificates in IBM Tivoli Composite Application Manager for Transactions (CVE-2014-3051)

Summary IBM Tivoli Composite Application Manager for Transactions does not validate SSL certificates during normal operation. An attacker could perform man in middle attack techniques and obtain authentication credentials. Vulnerability Details CVE-ID: CVE-2014-3051 DESCRIPTION: IBM Tivoli...

Design/Logic Flaw

The Internet Service Monitor ISM agent in IBM Tivoli Composite Application Manager ITCAM for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof...

CVE-2014-3051

IBM ITCAM for Transactions Internet Service Monitor (ISM) agent fails to validate SSL/X.509 certificates, enabling potential MITM attacks to capture credentials. Affected versions: ITCAM for Transactions 7.1/7.2 (up to 7.2.0.3 IF28), 7.3 (up to 7.3.0.1 IF30), and 7.4 (up to 7.4.0.0 IF18). Remedia...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Visualization Engine VE in IBM Tivoli Composite Application Manager for WebSphere ITCAM 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-3521

The CVE-2009-3521 entry refers to multiple cross-site scripting (XSS) vulnerabilities in the Visualization Engine (VE) of IBM Tivoli Composite Application Manager for WebSphere (ITCAM) 6.1.0. The affected component is the VE within ITCAM for WebSphere; exact vulnerable subcomponents or versions b...