Security Bulletin: Apache Tomcat and FileUpload Vulnerabilities in IBM UrbanCode Deploy (CVE-2014-0050, CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590)

Summary Previous releases of IBM UrbanCode Deploy are affected by vulnerabilities in Apache Tomcat and FileUpload that may allow remote attackers to influence the availability of the server or obtain sensitive information. Vulnerability Details | Subscribe to My Notifications to be notified of...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2018-10455)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

CVE-2017-1752

IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547...

Code injection

IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547...

CVE-2017-1752

IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547...

CVE-2017-1752

IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547...

CVE-2017-1752

CVE-2017-1752 affects IBM UrbanCode Deploy 6.1 (up to 6.1.3.8) and 6.2 (up to 6.2.7.0). The issue allows an authenticated privileged user to obtain highly sensitive information due to improper access controls in the deployment tool. Affected versions: IBM UrbanCode Deploy 6.1.x and 6.2.x. The rem...

IBM UrbanCode Deploy Access Bypass Vulnerability

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

CVE-2017-1493

IBM UrbanCode Deploy UCD 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691...

CVE-2017-1493

IBM UrbanCode Deploy UCD 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691...

CVE-2017-1493

IBM UrbanCode Deploy UCD 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691...

CVE-2017-1493

IBM UrbanCode Deploy (UCD) 6.1 (6.1.0–6.1.3.6) and 6.2 (6.2.0–6.2.6.1) are affected by CVE-2017-1493, where an authenticated user could edit objects they should not have access to due to improper access controls. The advisory from IBM reiterates that previous releases allow unauthorized edits. Re...

The vulnerability of the software for automating the deployment of IBM UrbanCode Deploy (UCD) applications, related to lack of access control, allows a perpetrator to execute arbitrary code.

The vulnerability of the software for automating the deployment of IBM UrbanCode Deploy UCD applications is related to lack of access control. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code on machines equipped with the UCD agent where client...

CVE-2014-8900

Cross-site request forgery CSRF vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier...

CVE-2014-8900

Cross-site request forgery CSRF vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier...

CVE-2014-8900

IBM UrbanCode Release is vulnerable to cross-site request forgery (CSRF) due to improper validation of user-supplied input. A remote attacker could entice an authenticated user to visit a malicious site to send crafted requests, potentially enabling cross-site scripting, web cache poisoning, and ...

Xxe

IBM UrbanCode Deploy UCD 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM...

CVE-2017-1149

IBM UrbanCode Deploy UCD 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM...

CVE-2017-1149

CVE-2017-1149 affects IBM UrbanCode Deploy (UCD) versions 6.0, 6.1, and 6.2. The vulnerability is an XML External Entity (XXE) injection in XML data processing, enabling a remote attacker to cause a denial of service and potentially disclose sensitive information or exhaust memory resources. The ...