Security Bulletin:A vulnerability in GSKit and GSKit-Crypto affects IBM Performance Management products (CVE-2018-1447)

Summary A vulnerability in GSKit and GSKit-Crypto affects IBM Performance Management products. The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change passwor...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affect IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and the Java SE Embedded impact the IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2018-2800 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, JRockit RMI component could allow an...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Multiple vulnerabilities in the IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2018-1447 DESCRIPTION: The GSKit CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and the Java SE Embedded impact the IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2016-5542 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Libraries component has no...

Security Bulletin: A vulnerability in Apache Commons FileUpload affects the IBM Performance Management product (CVE-2016-1000031)

Summary Apache Commons FileUpload could allow a remote attacker to execute arbitrary code on the system, caused by deserialization of untrusted data in DiskFileItem class of the FileUpload library. A remote attacker could exploit this vulnerability to execute arbitrary code under the context of t...

Security Bulletin: Vulnerabilities in IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products

Summary Vulnerabilities in IBM GSKit and IBM GSKit-Crypto affect IBM Performance Management products. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA private keys. An attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in the IBM Java SDK affect IBM Performance management products

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Cloud APM Private 8.1.4, IBM Cloud Application Performance Management, and IBM Application Performance Management 8.1.3. These issues were disclosed as part of the IBM Java SDK updates in Januar...

Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty affects the IBM Performance Management product (CVE-2017-1681)

Summary IBM WebSphere Application Server could allow a local attacker to obtain sensitive information, caused by improper handling of application requests, which could allow unauthorized access to read a file. Vulnerability Details CVEID: CVE-2017-1681 DESCRIPTION: IBM WebSphere Application Serve...

Security Bulletin: IBM HTTP Server Response Time module is affected by JavaScript injection vulnerability.

Summary IBM HTTP Server Response Time module, which is delivered as part of IBM Performance Management, has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-1441 DESCRIPTION: IBM Application Performance Management - Response Time Monitoring Agent is vulnerable to...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and the Java SE Embedded impact the IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2017-10346 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded Hotspot component could all...

Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty affects the IBM Performance Management product (CVE-2017-1194).

Summary IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Vulnerability Details CVEID: CVE-2017-1194 DESCRIPTION: IBM WebSphere Application Serve...

Security Bulletin: Security vulnerabilities have been identified in DB2 which is shipped with IBM Performance Management products

Summary DB2 is shipped with IBM Performance Management products. Some of the information about security vulnerabilities affecting DB2 has been published in security bulletins. Vulnerability Details CVEID: CVE-2017-1520 DESCRIPTION: IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorize...

Security Bulletin: A vulnerability in the SQLite component of the Response Time agent affects IBM Performance Management products

Summary SQLite is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by getNodeSize function in ext/rtree/rtree.c. By using a specially-crafted database, a remote attacker could overflow a buffer and cause unspecified impacts on the system. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in the agent core framework affects IBM Performance Management products

Summary The agent core framework component makes use of expat. Expat, when used in a parser that has not called XMLSetHashSalt or passed it a seed of 0, could provide weaker than expected security. The expat XML parser is vulnerable to a denial of service, caused by the failure to use sufficient...

Security Bulletin: A vulnerability in the SQLite component of the Response Time agent affects IBM Performance Management products (CVE-2016-6153)

Summary SQLite could allow a local attacker to gain elevated privileges on the system, caused by the creation of temporary files in directory with insecure permissions. An attacker could exploit this vulnerability to obtain leaked data. Vulnerability Details CVEID: CVE-2016-6153 DESCRIPTION: SQLi...

Security Bulletin: A vulnerability in the Firefox component of the Synthetic Playback agent affects IBM Performance Management products.

Summary Multiple browsers could allow a remote attacker to obtain sensitive information, caused by the failure to consider the role of the TCP congestion window in providing information about content length by the HTTPS protocol or by the HTTP/2 protocol. By visiting a Web site owned by a malicio...

Security Bulletin: A vulnerability in the GSKIT component of the Core Framework affects IBM Performance Management products (CVE-2016-2183)

Summary OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a...

Security Bulletin: A vulnerability in the Apache Xerces-C XML Parser library affects IBM Performance Management products (CVE-2016-4463)

Summary The Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing a deeply nested DTD. A remote attacker could exploit this vulnerability to cause a denial of service. Vulnerability Details CVEID: CVE-2016-4463 DESCRIPTION:...

Security Bulletin: vulnerabilities in IBM WebSphere Application Server Liberty affects IBM Performance Management products

Summary The vulnerabilities could allow a remote attacker to conduct phishing attacks or obtain sensitive information, or allow cross-site scripting in OpenID Connect clients. Vulnerability Details CVEID: CVE-2016-3040 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote...

Security Bulletin: a vulnerability in MongoDB affects IBM Performance Management products (CVE-2016-6494)

Summary MongoDB could allow a local attacker to obtain sensitive information, caused by incorrect file permissions on .dbshell history files. An attacker could exploit this vulnerability to obtain sensitive information from .dbshell history files. Vulnerability Details CVEID: CVE-2016-6494...