Security Bulletin: Vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Apr 2017 - Includes Oracle Apr 2017 CPU affect IBM Content Collector for SAP Applications

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID:...

Security Bulletin: Sweet32 Birthday attacks on 64-bit block ciphers in TLS affect Content Manager for z/OS (CVE-2016-2183)

Summary System SSL's SSL V2, SSL V3 and TLS protocols support the use of Triple DES ciphers and are susceptible to the Sweet32 Birthday attack vulnerability. This vulnerability affects exploiters acting as either clients or servers. Content Manager 8 Resource Manager on z/OS uses System SSL and...

Security Bulletin: Open Source Apache Tomcat Commons FileUpload Vulnerabilities affects Atlas Policy Suite (CVE-2016-3092)

Summary Apache Commons Fileupload vulnerability affects Atlas Policy Suite Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests, an attacker could...

Security Bulletin: Vulnerability in nginx affects IBM StoredIQ (CVE-2016-4450)

Summary A denial of service vulnerability was disclosed on May 31, 2016 by nginx. Nginx is used by StoredIQ. StoredIQ has addressed the applicable CVE Vulnerability Details CVE-ID: CVE-2016-4450 Description: nginx is vulnerable to a denial of service, caused by a NULL pointer dereference error in...

Security Bulletin:IBM WebSphere deserialization of untrusted data in IBM eDiscovery Manager

Summary IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a serialized object from untrusted sources. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java cod...

Security Bulletin: Content Manager OnDemand for Multiplatforms is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-0729)

Summary Content Manager OnDemand for Multiplatforms is affected by Open Source Apache Xerces-C XML parser Vulnerabilities. Vulnerability Details CVEID: CVE-2016-0729 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during...

Security Bulletin: Vulnerability in Flexera InstallAnywhere affects IBM eDiscovery Manager (CVE-2016-4560)

Summary Flexera InstallAnywhere has a security vulnerability that could be exploited in IBM eDiscovery Manager. Vulnerability Details CVEID: CVE-2016-4560 DESCRIPTION: Flexera InstallAnywhere could allow a local attacker to gain elevated privileges on the system, caused by an untrusted search pat...

Security Bulletin: Vulnerability in Flexera InstallAnywhere affects IBM eDiscovery Analyzer (CVE-2016-4560)

Summary Flexera InstallAnywhere has a security vulnerability that could be exploited in IBM eDiscovery Analyzer. Vulnerability Details CVEID:CVE-2016-4560 DESCRIPTION:Flexera InstallAnywhere could allow a remote attacker to execute arbitrary code on the system. The application does not directly...

Security Bulletin: Two vulnerabilities exist in IBM Case Foundation and FileNet Business Process Manager (CVE-2012-5784 and CVE-2014-3596)

Summary Apache Axis contains two security vulnerabilities that could allow for spoofing attacks. See the individual descriptions below for the details. Vulnerability Details CVE-ID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct...

Security Bulletin: IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input (CVE-2015-1888)

Summary IBM Content Navigator is potentially vulnerable to cross-site scripting, caused by improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2015-1888 IBM Content Navigator is vulnerable to cross-site scripting. The vulnerability is caused by improper validation of user...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM CommonStore and IBM Content Collector (CVE-2014-4244, CVE-2014-4263)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 5 and 6 that are used by IBM CommonStore for Lotus Domino and IBM Content Collector. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in SSLv3 affects IBM CommonStore and IBM Content Collector (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM CommonStore for Lotus Domino and IBM Content Collector. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remo...

Security Bulletin: One vulnerability in IBM FileNet Content Manager and IBM Content Foundation (CVE-2014-4763)

Summary A security vulnerability exists in IBM FileNet Content Manager and IBM Content Foundation. Vulnerability Details CVEID: CVE-2014-4763 IBM Content Navigator is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this...

Security Bulletin: Classloader Manipulation Vulnerability in IBM WebSphere Application Server shipped with IBM Content Collector (CVE-2014-0114)

Summary There is a classloader manipulation vulnerability in the Apache Struts 1 used by the Administrative Console in IBM WebSphere Application Server that is shipped with IBM Content Collector. Vulnerability Details CVEID: CVE-2014-0114 Description: Apache Struts could allow a remote attacker t...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Web Interface for Content Management (WEBi)

Summary Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Content Navigator

Summary Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVE-2014-0114 in IBM Content Navigator Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVSS Base Score: 7.5 CVSS Temporal Scor...

Security Bulletin: IBM Datacap Taskmaster Capture ActiveX Vulnerability (CVE-2014-0879)

Summary Taskmaster Web uses ActiveX controls to perform scanning and to display images in the browser on the client computer. One of the controls was found vulnerable to crafted hacking. Vulnerability Details CVEID: CVE-2014-0879 DESCRIPTION: Security vulnerability with Datacap ActiveX installed ...

Security Bulletin: Improper authorization by non-admin user in IBM Content Navigator (CVE-2014-0858)

Summary Using 3rd party tools, a non-admin user can modify the URL action so that instead of a getAction, the user can perform a deleteAction against the configuration database. Vulnerability Details CVEID: CVE-2014-0858 DESCRIPTION: Improper authorization by non-admin user CVSS Base Score: 3.5...

Security Bulletin: IBM Content Navigator Potential Clickjacking Vulnerability (CVE-2013-5462)

Summary If the IBM Content Navigator application URL is opened within a frame in a web page, it's possible for the frame to record user input, potentially capturing sensitive information like login credentials. Vulnerability Details CVEID: CVE-2013-5462 DESCRIPTION: The IBM Content Navigator...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server affects Rational Reporting for Development Intelligence (CVE-2017-1681)

Summary The Rational Reporting for Development Intelligence RRDI is shipped with a version of the IBM WebSphere Application Server which contains a security vulnerability that could have a potential security impact. Vulnerability Details CVEID: CVE-2017-1681 DESCRIPTION: IBM WebSphere Application...