Security Bulletin: Permission checking vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1326)

Summary IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. Vulnerability Details CVEID: CVE-2017-1326 DESCRIPTION: IBM Sterling File...

Security Bulletin: XML Entity Injection vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1192)

Summary IBM Sterling File Gateway is vulnerable to an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2017-1192 DESCRIPTION: IB...

Security Bulletin: Access Control Security Vulnerability Affects IBM Sterling File Gateway (CVE-2017-1550)

Summary IBM Sterling File Gateway could allow an authenticated user to change other user's passwords. Vulnerability Details CVEID: CVE-2017-1550 DESCRIPTION: IBM Sterling File Gateway could allow an authenticated user to change other user's passwords. CVSS Base Score: 6.5 CVSS Temporal Score: See...

Security Bulletin: Cross-site Scripting Vulnerability Affects IBM Sterling B2B Integrator Standard Edition (CVE-2018-1563, CVE-2018-1513)

Summary IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2018-1563 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod...

Security Bulletin: IBM Sterling B2B Integrator is Vulnerable to a Robot Security Vulnerability (CVE-2017-6168)

Summary IBM Sterling B2B Integrator is vulnerable to a robot security vulnerability. This could allow an attacker to obtain encrypted data in clear text. Vulnerability Details CVEID: CVE-2017-6168 DESCRIPTION: F5 BIG-IP virtual servers configured with a Client SSL profile could allow a remote...

Security Bulletin: IBM Sterling B2B Integrator Is Vulnerable to Phishing Attack (CVE-2016-6020)

Summary IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. Vulnerability Details CVEID: CVE-2016-6020 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing...

Security Bulletin: Multiple access control vulnerabilities affect IBM Sterling B2B Integrator (CVE-2016-9983, CVE-2016-9982)

Summary IBM Sterling B2B Integrator Standard Edition could allow an authenticate user with special privileges to view files and web pages that they should not have access to. Vulnerability Details CVEID: CVE-2016-9983 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow an...

Security Bulletin: SQL injection vulnerability affects IBM Sterling B2B Integrator (CVE-2017-1174)

Summary IBM Sterling B2B Integrator Standard Edition is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1174...

Security Bulletin: IBM Sterling B2B Integrator has Cross Site Scripting vulnerabilities in Queue Watcher (CVE-2017-1496)

Summary IBM Sterling B2B Integrator Queue Watcher could allow a Cross Site Scripting attack Vulnerability Details CVEID: CVE-2017-1496 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod...

Security Bulletin: IBM Sterling B2B Integrator has Cross Site Scripting vulnerabilities in Queue Watcher (CVE-2015-7431)

Summary IBM Sterling B2B Integrator Queue Watcher could allow Cross Site Scripting attack Vulnerability Details CVEID: CVE-2015-7431 DESCRIPTION: IBM Sterling B2B Integrator is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploi...

Security Bulletin: Information disclosure vulnerability affects IBM Sterling B2B Integrator (CVE-2015-7437)

Summary IBM Sterling B2B Integrator Queue Watcher displays sensitive information. Vulnerability Details CVEID: CVE-2015-7437 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a local user to obtain sensitive information via Queue Watcher. CVSS Base Score: 5.5 CVSS Temporal...

Security Bulletin: Multiple vulnerabilities in the IBM Java SDK affects IBM Rational Application Developer for WebSphere Software (CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® SDKs Java™ Technology Edition, Versions 6 and 7 that is used by IBM Rational Application Developer for WebSphere Software. These issues were disclosed as part of the IBM Java SDK updates in October 2015. Vulnerability Details CVEID: CVE-2015-4872...

Security Bulletin: Information Disclosure in WebSphere Application Server Admin Console (CVE-2019-4670)

Summary There is an information disclosure in WebSphere Application Server Admin Console. Vulnerability Details CVEID: CVE-2019-4670 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive information caused by improper data representation. CVSS Base score:...

Security Bulletin: Vulnerabilities in Perl component shipped with IBM Rational ClearQuest (CVE-2015-8608, CVE-2015-8853, CVE-2016-2381)

Summary IBM Rational ClearQuest is affected by vulnerabilities in the Perl interpreter. Vulnerability Details CVEID: CVE-2015-8608 DESCRIPTION: Perl could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read in the VDir::MapPathA and VDir::MapPathW...

Security Bulletin: Vulnerabilities in Expat component shipped with IBM Rational ClearQuest (CVE-2016-0718, CVE-2015-1283, CVE-2016-4472, CVE-2015-2716)

Summary IBM Rational ClearQuest is affected by Expat library buffer overflow and denial of service vulnerabilities. Vulnerability Details CVEID: CVE-2016-0718 DESCRIPTION: Expat is vulnerable to a buffer overflow, caused by improper bounds checking when processing malformed XML data. By using the...

Security Bulletin: XML vulnerabilities in ClearQuest (CVE-2016-0729, CVE-2016-4463)

Summary IBM Rational ClearQuest is vulnerable to XML parsing attacks. These attacks could cause a denial of service or execution of code. Vulnerability Details CVEID: CVE-2016-0729 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds...

Security Bulletin: Apache Commons FileUpload Vulnerability affects IBM Rational ClearQuest (CVE-2016-3092)

Summary IBM Rational ClearQuest is vulnerable to an Apache Commons FileUpload vulnerability. Vulnerability Details CVE-ID: CVE-2016-3092 Description: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file upload requests,...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2016-7055, CVE-2017-3731)

Summary OpenSSL vulnerabilities were disclosed on January 26, 2017 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3731 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational ClearQuest (CVE-2017-1289)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6, 7, and 8, which are used by IBM Rational ClearQuest. These issues were disclosed as part of the IBM Java SDK updates in April 2017. Vulnerability Details CVEID: CVE-2017-1289 DESCRIPTION: IBM SDK, Java...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS vulnerability.

Summary Rational Asset Analyzer RAA has addressed the following vulnerability in WAS. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that...