Security Bulletin: IBM Tealeaf Customer Experience servers allow unauthenticated access (CVE-2015-4987)

Summary IBM Tealeaf Customer Experience servers allow access to operational data and less privileged operations without authentication. Vulnerability Details CVEID: CVE-2015-4987 DESCRIPTION: The IBM Tealeaf Customer Experience search and replay servers could allow an unauthenticated attacker to...

Design/Logic Flaw

IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active sessions, cause denial of service, or bypass security. IBM X-Force ID: 113999...

CVE-2016-2983

IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active sessions, cause denial of service, or bypass security. IBM X-Force ID: 113999...

CVE-2016-2983

IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active sessions, cause denial of service, or bypass security. IBM X-Force ID: 113999...

The vulnerability of the sane-backends package, related to insufficient protection of operational data, allows a perpetrator to breach data confidentiality.

The vulnerability of the sane-backends package is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise data confidentiality using the specially crafted SANENETCONTROLOPTION package...

The vulnerability of the IBM WebSphere Commerce, Commerce on Cloud, and WebSphere Commerce Developer software lies in data processing errors. This allows attackers to disclose sensitive information, perform actions on behalf of administrators, or cause service interruptions.

The vulnerability of the IBM WebSphere Commerce, Commerce on Cloud, and WebSphere Commerce Developer software platforms lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, perform actions on behalf of...

The vulnerability of LiteSpeed web application server’s software lies in the lack of protection for operational data, allowing attackers to obtain confidential information.

The vulnerability of LiteSpeed web application server software lies in the lack of protection for service data. This allows attackers to access content from random memory segments such as random parts of HTTP requests sent to the server earlier. Exploiting this vulnerability can enable remote...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from the lack of protection for operational data. This allows attackers to obtain product passwords in an unencrypted form.

The vulnerability of the StruxureWare Data Center Expert monitoring system relates to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to obtain product passwords in an unencrypted form by reading the contents of the RAM...

The vulnerability of the Arbor Peakflow SP traffic control analysis system lies in the lack of protection for operational data, allowing intruders to read arbitrary files.

The vulnerability of the Arbor Peakflow SP traffic control analysis system is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

The vulnerability of the microprogramming software used in Rockwell Automation’s Micrologix 1100 and Micrologix 1400 control systems lies in the lack of protection for operational data. This allows attackers to obtain user credentials in an unencrypted form by monitoring traffic between the browser and the server.

The vulnerability of the microprogramming software used in Rockwell Automation’s Micrologix 1100 and Micrologix 1400 controllers lies in the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to obtain user credentials in unencrypted...

The vulnerability of the Cisco Prime Infrastructure lifecycle management software and the Cisco Evolved Programmable Network Manager network service management software allows a hacker to gain access to confidential data.

The vulnerability of the Cisco Prime Infrastructure network lifecycle management software interface and the Cisco Evolved Programmable Network Manager network service management software is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious...

The vulnerability of Microsoft Word text editors, which allows attackers to obtain confidential information

The vulnerability of Microsoft Word relates to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information through a specially crafted document...

The vulnerability of the Flash Player software platform, which allows attackers to compromise the confidentiality of information

The vulnerability of the Flash Player software platform’s random number generators is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of information...

The vulnerability of the Oracle Database database management system allows a hacker to gain read access to data.

The vulnerability of the security component of the Oracle Database, a relational database management system, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating locally, to gain access to read the data...

The vulnerability of the MySQL database management system allows a hacker to cause a service failure.

The vulnerability of the Server component: The Optimizer component of the MySQL database management system is vulnerable due to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to cause the system to become unresponsive or, in rare cases, to...

The vulnerability of the Android operating system, which allows a hacker to access the backup data.

The vulnerability of the software interface of the Android operating system’s framework is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to data backups through a specially created application...

The vulnerability of the WebSphere MQ message processing service, which allows a hacker to obtain confidential information

The vulnerability of the input console for running the runmqsc command of the WebSphere MQ messaging service is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker acting locally to obtain confidential information...

The vulnerability of WebSphere Application Server application servers allows attackers to obtain confidential information.

The vulnerability of the Admin Center component of WebSphere Application Server is related to the lack of protection for operational data. Exploiting this vulnerability may allow a malicious actor to obtain confidential information from a remote location...

The vulnerability of the antivirus software Internet Security allows a hacker to read arbitrary files.

The vulnerability of the antivirus software Internet Security is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files...

The vulnerability of the HP System Management Homepage software allows a perpetrator to obtain confidential information.

The vulnerability of the HP System Management Homepage software relates to the lack of protection for operational data. Exploiting this vulnerability can allow an intruder acting locally to obtain confidential information...