Security Bulletin: Vulnerability in IBM Java runtime affects IBM SOA Policy Gateway Pattern for Red Hat Enterprise Linux Server (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability may affect some configurations of WebSphere Application Server used by WebSphere Service Registry and Repository. Vulnerability Details CVEID : CVE-2015-0138 DESCRIPTION : A vulnerability in various I...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2015-0138)

Summary WebSphere Application Server is shipped as a component of WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details For vulnerability details, see the security bulletin...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2014-8917)

Summary WebSphere Application Server is shipped as a component of WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details For vulnerability details, see the security bulletin...

Security Bulletin: Multiple vulnerabilities in IBM SDK Java™ Technology Edition affect IBM Business Process Manager and WebSphere Lombardi Edition

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by WebSphere Application Server underneath IBM Business Process Manager and WebSphere Lombardi Edition. These issues were disclosed as part of the IBM SDK Java™ Technology Edition updates in January 2015...

Security Bulletin: Vulnerability in Dojo Toolkit affect WebSphere Application Server (CVE-2014-8917)

Summary There is a cross-site scripting vulnerability in the Dojo Toolkits that are used by WebSphere Application Server Admin Console and Web 2.0 and Mobile Feature Packs. Vulnerability Details CVEID: CVE-2014-8917 DESCRIPTION: IBM Dojo Toolkit is vulnerable to cross-site scripting, caused by...

Security Bulletin: Java Technology Edition Quarterly CPU - October 2014 for WebSphere Application Server Community Edition 3.0.0.4(CVE-2014-3065,CVE-2014-3566,CVE-2014-6457)

Summary Multiple security vulnerabilities exist in IBM SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server Community 3.0.0.4. Vulnerability Details CVE-ID: CVE-2014-3065 DESCRIPTION: IBM Java SDK contains a vulnerability in which the default configuration for the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details The following advisories are included in the IBM® SDK Java™...

Security Bulletin: Multiple vulnerabilities in IBM SDK for Java Technology Edition affect WebSphere Dynamic Process Edition (CVE-2014-6512, CVE-2014-6457, CVE-2014-6558, CVE-2014-3566)

Summary There are multiple vulnerabilities in IBM® SDK for Java™ Technology Edition that is used by WebSphere Dynamic Process Edition. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed as part of t...

Security Bulletin: Several Vulnerabilities in the Java SDK affect WebSphere eXtreme Scale

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere eXtreme Scale. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details The following two advisories are included in the IBM® SDK Java™...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere Process Server, WebSphere Business Compass, WebSphere Business Modeler and WebSphere Business Modeler Publishing Server (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in WebSphere Process Server, WebSphere Business Compass, WebSphere Business Modeler, and WebSphere Business Modeler Publishing Server. Vulnerabili...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere Lombardi Edition (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in WebSphere Lombardi Edition. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: WebSphere Lombardi Edition could allow a remote attacker t...

Security Bulletin: Vulnerability in SSLv3 affects IBM Business Process Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Business Process Manager. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : IBM Business Process Manager could allow a remote...

Security Bulletin: Security vulnerability about Apache Tomcat JSP file upload in WebSphere Application Server Community Edition 3.0.0.4

Summary Unrestricted file upload vulnerability in Apache Tomcat which is shipped with WASCE 3.0.0.4, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. Vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server October 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed as part of t...

Security Bulletin: Vulnerability in SSLv3 affects IBM Support Assistant Team Server (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM® Support Assistant Team Server. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : Product could allow a remote attacker to obtain...

Security Bulletin: Security vulnerabilities in Apache Tomcat for WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4（CVE-2014-0075, CVE-2014-0096 and CVE-2014-0119）

Summary Security vulnerabilities exist in Apache Tomcat May 2014 X-Force Report that is shipped with IBM WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4 Vulnerability Details CVE ID: CVE-2014-0075 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by the...

Security Bulletin: Potential Security exposures with WebSphere Application Server (CVE-2014-4770 and CVE-2014-4816)

Summary There is a potential cross-site scripting XSS and a potential cross-site request forgery CSRF security vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2014-4770 Description: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused ...

Security Bulletin:Security vulnerability in current IBM SDK for Java for WebSphere Application Server Community Edition 3.0.0.4 July 2014 CPU (CVE-2014-4244)

Summary A security vulnerability exists in the IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM WebSphere Application Server Community Edition 3.0.0.4. This issue was disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVE ID: CVE-2014-4244...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Lombardi Edition (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by WebSphere Lombardi Edition. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability related to t...

Security Bulletin: Java.policy file change in Default Socket Permissions for WebSphere Application Server

Summary IBM® SDK Java™ Technology Edition released by IBM and Oracle JDKs have made a change to the default socket permissions in the java.policy file. Vulnerability Details IBM® SDK Java™ Technology Edition released by IBM and the Oracle JDK's have made a change to the default socket permissions...