Security Bulletin: Security vulnerability is identified in WebSphere Application Server where Rational Asset Manager is deployed (CVE-2020-4782)

Summary In the WebSphere Application Server WAS admin console where the Rational Asset Manager RAM is deployed, security vulnerability is observed. Information about this security vulnerability affecting WebSphere Application Server is published in the respective security bulletin. Vulnerability...

Automated application scanning: handling complicated logins with AppScan (only!)

Ory Segal @orysegal from IBM Rational reached out with a simpler method to handle this natively in AppScan. It involves configuring AppScan to add a custom parameter to each request. For the sample case in the authexamples GitHub repository it would be handled like this...

Security Bulletin: Multiple vulnerabilities in Open JDK affecting Rational Functional Tester

Summary There are multiple vulnerabilities in Open JDK Version 8, OpenJ9 used by Rational Functional Tester RFT versions 10.0. RFT has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-2962 DESCRIPTION: An unspecified vulnerability in Java SE related to the 2D component could...

Security Bulletin: Security vulnerability are identified in WebSphere Application Server where Rational Asset Manager is deployed (CVE-2020-4329)

Summary In the WebSphere Application Server WAS admin console where the Rational Asset Manager RAM is deployed, allowing a remote attacker obtaining sensitive information caused by improper parameter checking is observed. Information about this security vulnerability affecting WebSphere Applicati...

Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester

Summary IBM Rational Functional Tester is affected by an Eclipse Jetty vulnerability that can allow a local authenticated user to gain elevated privileges on the system. By sending a specially-crafted request, an authenticated user could exploit this vulnerability to gain elevated privileges...

Security Bulletin: Security vulnerability is identified in WebSphere Application Server where Rational Asset Manager is deployed (CVE-2020-4643)

Summary In the WebSphere Application Server WAS admin console where the Rational Asset Manager RAM is deployed, security vulnerability is observed. Information about this security vulnerability affecting WebSphere Application Server is published in the respective security bulletin. Vulnerability...

Security Bulletin: A vulnerability in Eclipse Jetty affects IBM Rational Service Tester (CVE-2020-27216)

Summary IBM Rational Service Tester is vulnerable to Eclipse Jetty possibly allowing a local authenticated user to gain elevated privilegs on the system. By sending a specially-crafted request, an authenticated user could exploit this vulrnerability to gain elevated privileges. Vulnerability...

Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Performance Tester (CVE-2020-27216)

Summary IBM Rational Performance Tester is affected by an Eclipse Jetty vulnerability than can allow a local authenticated user to gain eleved privileges on the system. By sending a specially-crafted request, an authenticated user could exploit this vulnerability to gain elevated privileges...

Security Bulletin: Security vulnerabilities in Java SE affects Rational Build Forge

Summary Java SE that is used by IBM Rational Build Forge has a security vulnerabilities. IBM Rational Build Forge has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14792 DESCRIPTION: An unspecified vulnerability in Java SE related to the Hotspot component could allow an...

Security Bulletin: Security vulnerabilities in OpenSSL affects Rational Build Forge

Summary OpenSSL that is used by IBM Rational Build Forge has a security vulnerability. IBM Rational Build Forge has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow i...

Security Bulletin: Security vulnerability in Java SE affects Rational Build Forge (CVE-2020-14782)

Summary Java SE that is used by IBM Rational Build Forge has a security vulnerability. IBM Rational Build Forge has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an...

Security Bulletin: Rational Test Control Panel affected by Spring Framework vulnerability

Summary Spring Framework is vulnerable to a security issue affecting Rational Test Control Panel Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a...

Security Bulletin: A Session Timeout vulnerability affects IBM Rational Performance Tester

Summary IBM Rational Performance Tester contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID. Vulnerability Details Third Party Entry: PSIRT-ADV0027326 DESCRIPTION: Created from Advisory: ADV0027326 CVSS Base score: 4.3 CVSS Vector:...

Security Bulletin: A Weak Authentication vulnerability affect IBM Rational Performance Tester

Summary IBM Rational Performance Tester uses basic authentication wihch is relatively weak. An attacker could potentially decode the encoded credentials. Vulnerability Details Third Party Entry: PSIRT-ADV0027320 DESCRIPTION: Created from Advisory: ADV0027320 CVSS Base score: 5.9 CVSS Vector:...

Security Bulletin: Security vulnerabilities are identified in WebSphere Application Server where Rational Asset Manager is deployed (CVE-2019-10086 and CVE-2020-4329)

Summary In the WebSphere Application Server WAS admin console where the Rational Asset Manager RAM is deployed, vulnerabilities such as allowing a remote attacker to access the classloader through class property, and an authenticated attacker obtaining sensitive information caused by improper...

Security Bulletin: Security vulnerability in IBM Java SDK affecting Rational Synergy (CVE-2019-4732)

Summary There is a security vulnerability in IBM® SDK Java™ Technology Edition, Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55 used by Rational Synergy versions 7.2.1.0 to 7.2.1.7. Rational Synergy has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-4732...

Security Bulletin: Multiple vulnerabilities in Jasper used in Jetty 8.1.3 Server where Rational Synergy is deployed

Summary There are multiple vulnerabilities in Jasper, Version 2 Service Refresh 2 Fix Pack 2, used by Jetty 8.1.3 is affecting IBM Rational Synergy. Vulnerability Details The following are the list of vulnerabilities affecting IBM Rational Synergy: CVEID: CVE-2018-12538 DESCRIPTION: Eclipse Jetty...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affecting Rational Synergy

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.40 and Version 8.0.5.35 used by Rational Synergy versions 7.2.1.0 to 7.2.1.7. Rational Synergy has addressed the applicable CVEs. Vulnerability Details Rational Synergy has addressed the following: If...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-3426)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 20 that is used by IBM Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-3426...

Security Bulletin:Vulnerability in Diffie-Hellman ciphers affects Rational Synergy (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects Rational Synergy Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey ...