Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826).

Abstract Vulnerability in IBM DB2 could allow an authenticated user to cause a stack-based buffer overflow and possibly attain remote code execution. Content VULNERABILITY DETAILS CVE ID: CVE-2012-4826 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability that could allo...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.5

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.0.0.5 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...

Security Bulletin: Cross-Site Scripting vulnerability in IBM InfoSphere Information Server (CVE-2013-0502)

Abstract Security Bulletin: Cross-Site Scripting vulnerability in IBM InfoSphere Information Server CVE-2013-0502 Content SUMMARY: A Cross-Site Scripting vulnerability exists in the Web Console of IBM InfoSphere Information Server that may lead to unauthorized access when a user is tricked into...

Security bulletin: Potential security vulnerabilities in IBM DataQuant with JRE 6

Abstract IBM® DataQuant makes use of Java Runtime Environment JRE Version 6. This security bulletin explains how to address potential security exposures with IBM DataQuant for z/OS and IBM DataQuant for Multiplatforms due to vulnerabilities in Java Software Developer Kits. See ‘Vulnerability...

Security Bulletin: Potential Security Exposure in IBM HTTP Server CVE-2013-0169 PM85211

Abstract Potential Security Exposure with IBM HTTP Server for WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0169 PM85211 DESCRIPTION: The TLS protocol in the GSKIT component of the IBM HTTP Server does not properly consider timing side-channel attacks, which could...

Security Bulletin: Vulnerability in IBM SPSS Data Collection due to issues in Eclipse Help System (CVE-2013-0464, CVE-2013-0467)

Abstract The version of IBM Eclipse Help System that is shipped with IBM SPSS Data Collection versions 6.0, 6.0.1 "Data Collection" and 7.0 has multiple security vulnerabilities. These vulnerabilities allow attackers to perform cross-site scripting and source code disclosure attacks. Content...

Security Bulletin: IBM PureData System for Operational Analytics A1791 and IBM Smart Analytics System 7600, 7700, and 7710 are affected by a privilege escalation vulnerability in the DB2 Audit Facility (CVE-2013-3475)

Abstract The IBM PureData System for Operational Analytics A1791, IBM Smart Analytics System 7600, IBM Smart Analytics System 7700, and IBM Smart Analytics System 7710 are shipped with DB2 9.7 or DB2 10.1. These versions of DB2 contain a security vulnerability in the DB2 Audit Facility which allo...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.0.1

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.5.0.1 Content VULNERABILITY DETAILS: CVE ID:CVE-2012-3304 PM54356 DESCRIPTION: WebSphere Application Server could allow a remote attacker to hijack a valid user’s session, caused by an...

Security Bulletin: Multiple security vulnerabilities addressed in IBM Sterling Secure Proxy (CVE-2013-0518, CVE-2013-0519, CVE-2013-0520)

Abstract IBM Sterling Secure Proxy is vulnerable to spoofing and information disclosure attacks. Content VULNERABILITY DETAILS CVE ID: CVE-2013-0518 DESCRIPTION: Application Pages Do Not Break Out of 3rd Party HTML Frames. IBM Sterling Secure Proxy Configuration Manager pages permit rendering...

Security Bulletin: Potential Security exposure in IBM HTTP Server CVE-2013-1862 PM87808

Abstract Potential Security exposure in IBM HTTP Server for WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-1862 DESCRIPTION: IBM HTTP Server optional modrewrite module does not properly filter terminal escape sequences from logs, which could make it easier for a remot...

Security bulletin: Open redirect and cross-site scripting vulnerabilities in DB2 QMF for Workstation and DB2 QMF for WebSphere help systems (CVE-2012-2159, CVE-2012-2161)

Abstract IBM DB2 QMF for Workstation and IBM DB2 QMF for WebSphere make use of the IBM Eclipse Help System IEHS, which has the security vulnerabilities described in this bulletin. Content VULNERABILITY DETAILS: A brief description of each vulnerability is provided below. IBM does not intend to...

Security Bulletin: Possible Security Exposure in WebSphere Application Server CVE-2013-0597 PM85834

Abstract Potential security exposure in WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0597 PM85834 and PM87131 DESCRIPTION: WebSphere Application Server using OAuth could allow a remote attacker to obtain someone else's credentials. A remote attacker could exploit th...

Security Bulletin: Potential Security Vulnerability fixed in WebSphere Virtual Enterprise (CVE-2013-5425)

Abstract Potential Security vulnerability fixed in WebSphere Virtual Enterprise Content VULNERABILITY DETAILS: CVE ID:CVE-2013-5425PM93828 DESCRIPTION: IBM WebSphere Virtual Enterprise may be vulnerable to cross-site scripting in the Administration Console caused by improper validation of...

Security Bulletin: Remote Escalation of Privilege Vulnerability in DB2 Administration Server (CVE-2012-0711)

Abstract Vulnerability in IBM DB2 Administrator Server could allow an escalation of privilege attack. Content VULNERABILITY DETAILS CVE ID: CVE-2012-0711 DESCRIPTION: The IBM DB2 products listed below contain a security vulnerability in the DB2 Administration Server DAS which would allow an...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.3

Abstract Cross reference list for security vulnerabilities fixed in IBM WebSphere Application Server Fix Pack 8.0.0.3. Content CVE ID:CVE-2012-0720 PM52274 DESCRIPTION: WebSphere Application Server Administration Console is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application Server 6.1.0.43

Abstract Cross reference list for security vulnerabilities fixed in WebSphere Application Server Fix Pack 6.1.0.43 Content VULNERABILITY DETAILS: CVE ID:CVE-2011-1376 PM49712 DESCRIPTION: IBM Websphere Application Server, when running on IBM i operating systems, applies insecure permissions to...

Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling External Authentication Server (CVE-2013-1571, CVE-2013-1500, CVE-2013-0443, CVE-2013-0440, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling External Authentication Server has security vulnerabilities in its Javadoc, and in SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID: CVE-2013-1571 DESCRIPTION: The Javadoc documentation generated for the Sterling...

Security Bulletin: IBM Sterling Connect:Direct for OpenVMS. Unencrypted data transfers can occur even when SSL encryption is specified in the security configuration. (CVE-2013-4035)

Abstract Unencrypted data transfers can occur even when SSL encryption is specified in the security configuration. Content VULNERABILITY DETAILS: CVEID: CVE-2013-4035 DESCRIPTION: When Connect:Direct for OpenVMS is the server in a TCP/IP session, and the client requests an unencrypted session, C:...

Security Bulletin: IBM WebSphere Extended Deployment Compute Grid Vulnerability (CVE-2013-4039)

Abstract Potential security vulnerability fixed in IBM WebSphere Extended Deployment Compute Grid V8.0.0.3 Content VULNERABILITY DETAILS: CVE ID:CVE-2013-4039PM84760 DESCRIPTION: WebSphere Extended Deployment Compute Grid could allow a remote attacker to obtain sensitive information and exploit...

Security Bulletin: IBM FileNet Content Manager and IBM Content Foundation – XML 4J denial of service attack (CVE-2013-4002)

Abstract The XML4J parser that is shipped with the IBM FileNet Content Manager and IBM Content Foundation is vulnerable to a denial of service attack, triggered by malformed XML data. Content The products listed below might be affected by security vulnerabilities reported to the Apache Xerces-J...