Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Security Access Manager for Web and IBM Tivoli Access Manager for e-business (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Security Access Manager for Web and IBM Tivoli Access Manager for e-business. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obta...

Security Bulletin: Vulnerability in Apache POI affects IBM Emptoris Services Procurement (CVE-2017-5644)

Summary Open Source Apache Poi vulnerability affects IBM Emptoris Services Procurement Vulnerability Details CVE-ID: CVE-2017-5644 Description: Apache POI is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when processing XML data. By using a specially-craft...

Security Bulletin: IBM Emptoris Services Procurement is affected by Information leakage vulnerability (CVE-2017-1547)

Summary The IBM Emptoris Services Procurement product is vulnerable to getting valid usernames through Forgot password process Vulnerability Details CVEID: CVE-2017-1547 DESCRIPTION: IBM Emptoris Services Procurement could allow an unauthorized user enumerate usernames through the use of the forg...

Security Bulletin: Multiple vulnerabilities addressed in the IBM Emptoris Supplier Lifecycle Management product (CVE-2016-8949, CVE-2017-1448, CVE-2016-6121)

Summary The security bulletin includes multiple vulnerabilities found and addressed in IBM Emptoris Supplier Lifecycle Management across various versions of the product. Vulnerability Details CVEID: CVE-2016-8949 DESCRIPTION: IBM Emptoris Supplier Lifecycle Management could allow a remote attacke...

Security Bulletin: Multiple Security Issues in IBM Tealeaf Customer Experience

Summary IBM Tealeaf Customer Experience contains hard-coded credentials. A remote attacker could exploit this vulnerability to gain access to the system. IBM Tealeaf Customer Experience could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted...

Security Bulletin: Apache PDFBox affects IBM Emptoris Contract Management (CVE-2016-2175)

Summary Apache PDFBox affects IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2016-2175 DESCRIPTION: Apache PDFBox could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. ...

Security Bulletin: IBM Sterling Order Management is affected by a vulnerability (CVE-2017-5638)

Summary IBM Sterling Order Management use Apache Struts 2 and is affected by some of the vulnerabilities that exist in Apache Struts 2 Vulnerability Details CVEID: CVE-2017-5638 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by an error wh...

Security Bulletin: IBM Call Center for Commerce is affected by Cross Site Scripting (XSS) Vulnerability (CVE-2016-6056)

Summary IBM Call Center for Commerce is vulnerable to a cross-site scripting attack which could lead to unauthorized access through the injected scripts. Vulnerability Details CVEID: CVE-2016-6056 DESCRIPTION: IBM Call Center for Commerce is vulnerable to cross-site scripting. This vulnerability...

Security Bulletin: IBM Sterling Order Management is affected by Apache Struts 2 security vulnerabilities (CVE-2016-3093 , CVE-2016-4436)

Summary IBM Sterling Order Management uses Apache Struts 2 and is affected by some of the vulnerabilities that exist in Apache Struts 2 Vulnerability Details CVEID: CVE-2016-3093 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by the improper implementation of cache used t...

Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure Price Quote are vulnerable to cross-site request forgery.

Summary IBM Sterling Order Management and IBM Sterling Configure Price Quote are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Vulnerability Details CVEID: CVE-2016-9991...

Security Bulletin: IBM Emptoris Sourcing is affected by open redirect vulnerability (CVE-2016-0329).

Summary IBM Emptoris Sourcing product-help system contains an open redirect vulnerability. Vulnerability Details CVEID: CVE-2016-0329 DESCRIPTION: IBM Emptoris Sourcing could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit...

Security Bulletin: Vulnerability in BeanShell affects IBM Emptoris Strategic Supply Management. (CVE-2016-2510).

Summary A BeanShell vulnerability for handling Java object deserialization was addressed by IBM Emptoris Strategic Supply Management Platform, IBM Contract Management and IBM Program Management products. Vulnerability Details CVEID: CVE-2016-2510 DESCRIPTION: BeanShell could allow a remote attack...

Security Bulletin: IBM Sterling Order Management is affected by Apache Commons Collections security vulnerabilities (CVE-2015-7450)

Summary IBM Sterling Order Management use Apache Commons Collections and are affected by some of the vulnerabilities that exist in this component. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the...

Security Bulletin: JBoss RestEasy vulnerabilities in IBM Emptoris Contract Management (CVE-2014-3490)

Summary JBoss RestEasy shipped with IBM Emptoris Contract Management is vulnerable to information disclosure. Vulnerability Details CVE ID: CVE-2014-3490 DESCRIPTION: RESTEasy could allow a remote attacker to obtain sensitive information, caused by an incomplete fix related to the processing of X...

Security Bulletin: IBM® Db2® is affected by vulnerabilities in the IBM® SDK, Java Technology Edition Quarterly Critical Patch Updates (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

Summary Db2 is affected by vulnerabilities in IBM® JDK. This only affects customers using Integrated Text Search. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim ...

Security Bulletin: IBM Streams may be affected by XMLsoft Libxml2 vulnerabilities

Summary The libxml2 library, used by IBM Streams may have security vulnerabilities. IBM Streams has addressed the applicable CVE. Vulnerability Details CVE-ID: CVE-2015-8806 Description: Libxml2 is vulnerable to a denial of service, caused by a heap-buffer overread in dict.c. By persuading a vict...

Security Bulletin: Multiple vulnerabilities in XMLsoft Libxml2 affect IBM Streams

Summary There are multiple vulnerabilities in Libxml2 library used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVE-ID: CVE-2016-2073 Description: libxml2 is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the...

Security Bulletin: Multiple IBM InfoSphere Information Server components are vulnerable due to the following Castor Library vulnerability (CVE-2014-3004)

Summary Castor Library could allow a remote attacker to obtain sensitive information in various IBM Information Server components. This is caused by an XML External Entity Injection XXE error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server (CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server have addressed the applicable CVEs and included the SSL 3.0...

Security Bulletin: Multiple IBM InfoSphere Information Server components are vulnerable due to ClassLoader manipulation vulnerability in Open Source Apache Struts version 1 (CVE-2014-0114)

Summary Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. An attacker could exploit this vulnerability using the class parameter of an ActionForm object to manipulate the ClassLoader and...