Security Bulletin: IBM Security Information Queue uses database components with known vulnerabilities (CVE-2016-3506, CVE-2018-1058, CVE-2018-10936, CVE-2019-9193)

Summary IBM Security Information Queue ISIQ relies on older Oracle JDBC and PostgreSQL JAR files that have known vulnerabilities. As of v1.0.5, ISIQ switched to newer, secure versions of the JAR files. Vulnerability Details CVEID: CVE-2016-3506 DESCRIPTION: Unspecified vulnerability in the JDBC...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2019-25337)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue versions 1.0.0, 1.0.1, and 1.0.2. An...

IBM Security Information Queue Information Disclosure Vulnerability (CNVD-2019-19829)

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue versions 1.0.0, 1.0.1, and 1.0.2. An...

IBM Security Information Queue Input Validation Error Vulnerability

IBM Security Information Queue is a data integration product from IBM USA. The product utilizes Kafka technology and a publish-subscribe model to integrate data between IBM security products. A security vulnerability exists in IBM Security Information Queue versions 1.0.0, 1.0.1, and 1.0.2, which...

CVE-2019-4219

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 159228...

Design/Logic Flaw

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. IBM...

Information disclosure

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 158660...

CVE-2019-4219

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 159228...

Design/Logic Flaw

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

CVE-2019-4161

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 158660...

CVE-2019-4162

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. IBM...

CVE-2019-4162

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. IBM...

CVE-2019-4217

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

CVE-2019-4219

IBM Security Information Queue ISIQ 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 159228...

PT-2019-16940 · Ibm · Ibm Security Information Queue

Name of the Vulnerable Software and Affected Versions: IBM Security Information Queue ISIQ versions 1.0.0 through 1.0.2 Description: The issue discloses sensitive information to unauthorized users, which can be used to mount further attacks on the system. Recommendations: For versions 1.0.0 throu...

PT-2019-16941 · Ibm · Ibm Security Information Queue

Name of the Vulnerable Software and Affected Versions: IBM Security Information Queue ISIQ versions 1.0.0 through 1.0.2 Description: The issue arises from the missing HTTP Strict Transport Security header in the affected software. This allows users to potentially navigate to the unencrypted versi...

Security Bulletin: IBM Security Information Queue reveals internal data in application error messages

Summary IBM Security Information Queue ISIQ reveals too much internal data when displaying application error messages. This data could be used by an attacker. As of v1.0.3, ISIQ's displayed errors are more terse. Detailed diagnostic data is only written to ISIQ log files. Vulnerability Details...

Security Bulletin: IBM Security Information Queue does not prevent caching of sensitive pages

Summary IBM Security Information Queue ISIQ allows web pages containing sensitive content to be cached by a browser and thus become vulnerable to attackers or malware. As of v1.0.3, the ISIQ web server instructs the browser to not cache the content. Vulnerability Details CVEID: CVE-2019-4218...

Security Bulletin: IBM Security Information Queue discloses internal data left over from the product development phases

Summary The initial versions of IBM Security Information Queue ISIQ disclose internal data left over from the product development and Beta phases. In most cases, the data is specific to ISIQ's development environment and not useful to an attacker. Some of it, however, such as ISIQ's exact HTTP...

Security Bulletin: IBM Security Information Queue web server allows downgrading to non-secure HTTP

Summary The IBM Security Information Queue ISIQ web server defaults to HTTPS, but does not enforce it. This could result in users navigating to an unencrypted version of ISIQ's web application. As of ISIQ v1.0.3, HTTPS is now enforced. Vulnerability Details CVEID: CVE-2019-4162 DESCRIPTION: IBM...