Security Bulletin: Multiple vulnerabilities in IBM Tealeaf Customer Experience portal

Summary The IBM Tealeaf Customer Experience web portal is vulnerable to cross-site scripting and redirect attacks and does not manage portal passwords as documented. Vulnerability Details CVEID: CVE-2016-5975 DESCRIPTION: IBM Tealeaf Customer Experience is vulnerable to cross-site scripting. This...

Security Bulletin: IBM Tealeaf Customer Experience Replay Server internal proxy accepts connections from external sources (CVE-2016-5968)

Summary The internal HTTP proxy server deployed as part of the IBM Tealeaf Customer Experience Replay Server accepts requests from any network host, not only from local renderers. Vulnerability Details CVEID: CVE-2016-5968 DESCRIPTION: IBM Tealeaf Replay Server allows remote attackers to use one ...

Security Bulletin: Multiple vulnerabilities in PCRE library affect IBM Tealeaf Customer Experience

Summary Multiple PCRE vulnerabilities were disclosed on November 28, 2015; March 23, 2016; and June 8, 2016. PCRE is used by IBM Tealeaf Customer Experience. IBM Tealeaf Customer Experience has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2014-9769 DESCRIPTION: PCRE is vulnerab...

Security Bulletin: Multiple vulnerabilities in PHP and memcached libraries affect IBM Tealeaf Customer Experience

Summary The IBM Tealeaf Customer Experience PCA component uses versions of PHP and memcached with reported security issues. Vulnerability Details CVEID: CVE-2013-0179 DESCRIPTION: memcached is vulnerable to a denial of service, caused by an error in the processbindelete function within memcached....

Security Bulletin: Multiple security issues in IBM Tealeaf Customer Experience on Cloud Network Capture Add-On

Summary Multiple security vulnerabilities in memcached, PCRE, and PHP affect IBM Tealeaf Customer Experience on Cloud Network Capture Add-On. Installation programs for the Windows components of IBM Tealeaf Customer Experience on Cloud Network Capture Add-On are vulnerable to attack under certain...

Security Bulletin: IBM Tealeaf Customer Experience servers allow unauthenticated access (CVE-2015-4987)

Summary IBM Tealeaf Customer Experience servers allow access to operational data and less privileged operations without authentication. Vulnerability Details CVEID: CVE-2015-4987 DESCRIPTION: The IBM Tealeaf Customer Experience search and replay servers could allow an unauthenticated attacker to...

Security Bulletin: IBM Tealeaf Customer Experience installers vulnerable to attack (CVE-2016-2542)

Summary Installation programs for the Microsoft Windows components of IBM Tealeaf Customer Experience are vulnerable to attack under certain conditions. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera InstallShield could allow a remote attacker to execute arbitrary code on the...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience (CVE-2015-1794, CVE-2015-3194, CVE-2016-0702)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 and March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Tealeaf Customer Experience. IBM Tealeaf Customer Experience has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is...

Security Bulletin: IBM Tealeaf Customer Experience PCA Web UI PHP security issues

Summary The IBM Tealeaf Customer Experience PCA Web UI uses a version of PHP with reported security issues. Vulnerability Details CVEID: CVE-2015-0273 DESCRIPTION: PHP could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error in unserialize with...

Security Bulletin: IBM Tealeaf Customer Experience allows user authentication via unencrypted GET request (CVE-2015-4990)

Summary The IBM Tealeaf Customer Experience portal allows a user to authenticate via means that could result in exposure of credentials. Vulnerability Details CVEID: CVE-2015-4990 DESCRIPTION: The IBM Tealeaf Customer Experience could allow a local privileged user to obtain the authentication...

Security Bulletin: IBM Tealeaf Customer Experience is affected by a security vulnerability (CVE-2015-4989)

Summary The IBM Tealeaf Customer Experience portal is affected by a security vulnerability that might allow unauthorized access to images of charts generated by other users. Vulnerability Details CVEID: CVE-2015-4989 DESCRIPTION: The IBM Tealeaf Customer Experience portal allows an attacker with...

Security Bulletin: IBM Tealeaf Customer Experience allows unauthorized access to system files (CVE-2015-4988)

Summary The IBM Tealeaf Customer Experience replay server could allow an attacker to traverse directories and read any file on the Windows Server system hosting the server. Vulnerability Details CVEID: CVE-2015-4988 DESCRIPTION: The IBM Tealeaf Customer Experience replay server could allow an...

Security Bulletin: IBM Tealeaf Customer Experience internal connections not encrypted (CVE-2015-4961)

Summary Internal connections between IBM Tealeaf Customer Experience servers use unencrypted HTTP. Vulnerability Details CVEID: CVE-2015-4961 DESCRIPTION: In an IBM Tealeaf environment with multiple servers, connections to the Tealeaf Data Service, Search Service, Replay Service, and Tracking...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. OpenSSL is used by IBM Tealeaf Customer Experience. IBM Tealeaf Customer Experience has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial ...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tealeaf Customer Experience (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Tealeaf Customer Experience. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tealeaf Customer Experience (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Tealeaf Customer Experience. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could explo...

Security Bulletin: IBM Tealeaf Customer Experience is affected by vulnerabilities in OpenSSL

Summary Vulnerabilities in OpenSSL including the “FREAK” attack affect IBM Tealeaf Customer Experience. Vulnerability Details CVEID: CVE-2014-3569 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to properly handle attempts to use unsupported protocols by the...

Security Bulletin: IBM Tealeaf Customer Experience is affected by a vulnerability in OpenSSL (CVE-2014-3511, CVE-2014-3512)

Summary IBM Tealeaf Customer Experience is affected by a vulnerability in OpenSSL that could cause a protocol downgrade attack or a buffer overrun attack. Vulnerability Details CVEID: CVE-2014-3511 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by the...

Security Bulletin: IBM Tealeaf Customer Experience may be affected by a vulnerability in the Apache HTTP server (CVE-2014-0226).

Summary IBM Tealeaf Customer Experience may be affected by a vulnerability in the Apache HTTP server, caused by an error in the modstatus module. Vulnerability Details CVEID: CVE-2014-0226 DESCRIPTION: IBM Tealeaf Customer Experiences PCA uses the Apache HTTP server to render its web console...

Security Bulletin: IBM Tealeaf CX is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients an...