CVE-2018-1705

CVE-2018-1705 affects IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2. It is an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. Remediation is available via IBM Fix Central for the l...

CVE-2018-1705

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340...

IBM Spectrum Symphony and Platform Symphony Command Execution Vulnerabilities

IBM Spectrum Symphony and Platform Symphony are both products of IBM Corporation in the U.S. IBM Spectrum Symphony is a suite of enterprise-class management software for running compute- and data-intensive distributed applications on shared grids.Platform Symphony is a set of SOA-based architectu...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: Stored Cross-Site Scripting (XSS) vulnerability (CVE-2018-1707) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Stored Cross-Site Scripting XSS vulnerability CVE-2018-1707 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1707 DESCRIPTION: IBM Platform Symphony is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri...

Security Bulletin: Vulnerability to allow an authenticated user to obtain sensitive user information (CVE-2018-1708) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Vulnerability to allow an authenticated user to obtain sensitive user information such as passwords through the WebUI CVE-2018-1708 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1708 DESCRIPTION: IBM Spectrum Symphony could allow an authenticat...

Security Bulletin: Arbitrary URL Redirection (CVE-2018-1704) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary URL Redirection CVE-2018-1704 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1704 DESCRIPTION: IBM Platform Symphony could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to...

Security Bulletin: Arbitrary File Reads (CVE-2018-1705) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary File Reads CVE-2018-1705 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1705 DESCRIPTION: IBM Platform Symphony contains an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive...

Input validation

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

CVE-2018-1595

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

CVE-2018-1595

CVE-2018-1595 affects IBM Platform Symphony and IBM Spectrum Symphony. Concrete details in connected sources show a Remote Command Execution flaw caused by improper handling of user input, enabling an authenticated user to execute arbitrary commands. Affected products/versions include Platform Sy...

Security Bulletin: RCE vulnerability (CVE-2018-1595) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary A security vulnerability related to Remote Command Execution RCE, caused by dynamic JSP file builds, has been identified in IBM Platform Symphony 6.1.1, 7.1 Fix Pack 1, 7.1.1 and IBM Spectrum Symphony 7.1.2, 7.2.0.2. Vulnerability Details CVEID: CVE-2018-1595 DESCRIPTION: IBM Spectrum...

Security Bulletin: Vertical authorization bypass vulnerability (CVE-2018-1613) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary The vertical authorization bypass vulnerability affects the Symping utility in IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2. Vulnerability Details CVEID: CVE-2018-1613 DESCRIPTION: IBM Platform Symphony and IBM Spectrum Symphony could allow a...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Platform Symphony and IBM Spectrum Symphony

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions, Version 6 Service Refresh 16 Fix Pack 55 and earlier releases used by IBM Platform Symphony 6.1.1, Version 7 Service Refresh 10 Fix Pack 15 and earlier releases used by IBM Platform Symphony 7.1 Fix Pack 1,...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony, IBM Spectrum Symphony (CVE-2017-15698, CVE-2017-15706, CVE-2018-1323, CVE-2018-1305, CVE-2018-1304)

Summary This interim fix provides instructions on upgrading Apache Tomcat from v5.5.36 to v7.0.88 in IBM Platform Symphony 6.1.1 and from v6.0.43 to v8.5.31 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address a security vulnerability in Tomcat CVE-2017-15698, CVE-2017-15706, CVE-2018-1323...

Security Bulletin: Vulnerability in Apache Commons FileUpload DiskFileItem File Manipulation affects IBM Platform Symphony, IBM Spectrum Symphony (CVE-2016-1000031)

Summary A security vulnerability relating to remote code execution CVE-2016-1000031 has been reported against Apache Commons FileUpload DiskFileItem File Manipulation, which IBM Platform Symphony uses as a framework for its WEBGUI service. The Commons FileUpload version that is vulnerable to thes...

Security Bulletin: A vulnerability in Apache Struts 2 affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2017-5638)

Summary A Security vulnerability relating to remote code execution CVE-2017-5638 S2-045 has been reported against Apache Struts 2, which IBM Platform Symphony uses as a framework for its WEBGUI service. The Struts 2 package version that is vulnerable to these issues is included in several past...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2016-3610 CVE-2016-3598 CVE-2016-3606 CVE-2016-3587 CVE-2016-3511 CVE-2016-3550 CVE-2016-3485)

Summary Vulnerability in IBM Java SDK affects IBM Platform Symphony and IBM Spectrum Symphony Vulnerability Details CVE IDs: CVE-2016-3610 CVE-2016-3598 CVE-2016-3606 CVE-2016-3587 CVE-2016-3511 CVE-2016-3550 CVE-2016-3485 Affected Products and Versions IBM Platform Symphony: 5.2, 6.1.0.1, 6.1.1,...

Security Bulletin: Vulnerability in SSLv3 affects IBM Platform Symphony (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Platform Symphony. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM Platform Symphony (CVE-2014-0094, CVE-2014-0112, CVE-2014-0113, CVE-2014-0116)

Summary Several security vulnerabilities have been reported against Apache Struts 2 through May 2014. IBM Platform Symphony’s GUI uses Struts 2 as a framework for Java web applications. A version of the package that is vulnerable to these issues is included in several past versions of IBM Platfor...