Security Bulletin: Multiple security vulnerabilities in IBM WebSphere Application Server Liberty affect Tivoli Storage Manager (IBM Spectrum Protect) Operations Center (CVE-2016-0378, CVE-2016-3040, CVE-2016-3042, CVE-2016-5986)

Summary Multiple security vulnerabilities exist in IBM WebSphere Application Server Liberty that affect Tivoli Storage Manager IBM Spectrum Protect Operations Center. Vulnerability Details CVEID: CVE-2016-0378 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to...

Security Bulletin: Multiple security vulnerabilities has been identified in Websphere Application Server shipped with IBM Operations Analytics - Log Analysis (CVE-2016-0378, CVE-2016-3040, CVE-2016-5986, CVE-2016-5983)

Summary Websphere Application Server - Liberty profile is shipped as a component of IBM Operations Analytics - Log Analysis. Information about a cross-site scripting vulnerability affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:...

Security Bulletin: vulnerabilities in IBM WebSphere Application Server Liberty affects IBM Performance Management products

Summary The vulnerabilities could allow a remote attacker to conduct phishing attacks or obtain sensitive information, or allow cross-site scripting in OpenID Connect clients. Vulnerability Details CVEID: CVE-2016-3040 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote...

Security Bulletin: FileNet Workplace can be affected by the Open URL Redirection Vulnerability (CVE-2016-5878)

Summary FileNet Workplace is susceptible to the Open URL Redirection Vulnerability. Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-5878 DESCRIPTION: IBM FileNet WorkPlace could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a...

Security Bulletin: FileNet Workplace can be affected by the Open Redirection Vulnerability (CVE-2016-3047)

Summary FileNet Workplace is susceptible to the Open Redirection Vulnerability. Vulnerability Details Relevant CVE Information: CVEID: CVE-2016-3047 DESCRIPTION: IBM FileNet Workplace could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim ...

Security Bulletin: IBM Security Access Manager Appliance is affected by an open redirect vulnerability (CVE-2017-1534)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1534 DESCRIPTION: IBM Security Access Manager Appliance could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim t...

Security Bulletin: Multiple vulnerabilities in IBM Tealeaf Customer Experience portal

Summary The IBM Tealeaf Customer Experience web portal is vulnerable to cross-site scripting and redirect attacks and does not manage portal passwords as documented. Vulnerability Details CVEID: CVE-2016-5975 DESCRIPTION: IBM Tealeaf Customer Experience is vulnerable to cross-site scripting. This...

Security Bulletin: IBM Emptoris Sourcing is affected by open redirect vulnerability (CVE-2016-0329).

Summary IBM Emptoris Sourcing product-help system contains an open redirect vulnerability. Vulnerability Details CVEID: CVE-2016-0329 DESCRIPTION: IBM Emptoris Sourcing could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit...

Security Bulletin: Multiple vulnerabilities in Drupal Core affect IBM API Management (CVE-2016-9449, CVE-2016-9450, CVE-2016-9451, CVE-2016-9452)

Summary Drupal is used by the Advanced Developer Portal in IBM API Management. IBM API Management has updated the level of Drupal it provides to address the applicable CVEs. Vulnerability Details CVEID: CVE-2016-9449 DESCRIPTION: Drupal Core could allow a remote authenticated attacker to obtain...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect IBM MQ Light (CVE-2016-5986, CVE-2016-3040, CVE-2016-0378)

Summary There are multiple vulnerabilities in IBM® WebSphere Application Server Liberty 8.5.5.8. These issues were disclosed as part of the IBM Liberty updates in IBM WebSphere Application Server Liberty 16.0.0.3. Vulnerability Details CVEID: CVE-2016-5986 DESCRIPTION: IBM WebSphere Application...

Security Bulletin: Open Redirect vulnerability in WebSphere Application Server Liberty (CVE-2016-3040)

Summary There is a potential for an open redirect vulnerability when using WebSphere Application Server Liberty Profile. Vulnerability Details CVEID: CVE-2016-3040 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to conduct phishing attacks, caused by an open...

Security Bulletin: Security vulnerability in Node.js module affects IBM Business Process Manager (BPM) Configuration Editor (CVE-2015-1164)

Summary A security vulnerability has been reported for a dependent Node.js module "express". CVE-2015-1164 affects IBM Business Process Manager BPM because IBM BPM includes a stand-alone tool for editing configuration properties files that is based on open source Node.js technology. Vulnerability...

Chinese Hackers Carried Out Country-Level Watering Hole Attack

Cybersecurity researchers have uncovered an espionage campaign that has targeted a national data center of an unnamed central Asian country in order to conduct watering hole attacks. The campaign is believed to be active covertly since fall 2017 but was spotted in March by security researchers fr...

CVE-2018-5111

When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded. This allows for phishing attacks where a malicious page can spoof the identify of another site. This vulnerability affects...

CVE-2018-5111

When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded. This allows for phishing attacks where a malicious page can spoof the identify of another site. This vulnerability affects...

A week in security (June 4 – June 10)

Last week on Labs, we took a look at hidden mobile ads, the perils of social media spam, and how to shore up your landline defenses. We also took a deep dive into Emotet malware analysis, and gave you some summertime safety tips. Other news Update your Adobe Flash player if you haven't already...

Open redirect

IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious...

CVE-2017-1748

CVE-2017-1748 affects IBM Connections 5.0, 5.5, and 6.0. The vulnerability is an open redirect that could be exploited remotely to spoof the URL shown to a victim and redirect to a malicious site, enabling phishing and potential data leakage. IBM X-Force ID: 135521. No remediation details are pro...

IRS Warns Tax Professionals of Phishing Scam

The Internal Revenue Service IRS has issued a news release warning tax professionals to beware of a new phishing email scam. Cyber criminals posing as state accounting and professional associations have been sending emails to entice their targets to reveal login credentials. Tax practitioners...

Open redirect

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...