Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server January 2015 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details The following advisories are included in the IBM® SDK Java™...

Security Bulletin: Multiple vulnerabilities in IBM SDK for Java Technology Edition affect WebSphere Dynamic Process Edition (CVE-2014-6512, CVE-2014-6457, CVE-2014-6558, CVE-2014-3566)

Summary There are multiple vulnerabilities in IBM® SDK for Java™ Technology Edition that is used by WebSphere Dynamic Process Edition. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed as part of t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Service Registry and Repository October 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Service Registry and Repository. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed...

Security Bulletin: Several Vulnerabilities in the Java SDK affect WebSphere eXtreme Scale

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere eXtreme Scale. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details The following two advisories are included in the IBM® SDK Java™...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere Process Server, WebSphere Business Compass, WebSphere Business Modeler and WebSphere Business Modeler Publishing Server (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in WebSphere Process Server, WebSphere Business Compass, WebSphere Business Modeler, and WebSphere Business Modeler Publishing Server. Vulnerabili...

Security Bulletin: Vulnerability in SSLv3 affects WebSphere Lombardi Edition (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in WebSphere Lombardi Edition. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: WebSphere Lombardi Edition could allow a remote attacker t...

Security Bulletin: Vulnerability in SSLv3 affects IBM Business Process Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Business Process Manager. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : IBM Business Process Manager could allow a remote...

Security Bulletin: Security vulnerability about Apache Tomcat JSP file upload in WebSphere Application Server Community Edition 3.0.0.4

Summary Unrestricted file upload vulnerability in Apache Tomcat which is shipped with WASCE 3.0.0.4, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. Vulnerability...

Security Bulletin: Vulnerability in SSLv3 affects IBM Support Assistant Team Server (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM® Support Assistant Team Server. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : Product could allow a remote attacker to obtain...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server October 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed as part of t...

Security Bulletin: Security vulnerabilities in Apache Tomcat for WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4（CVE-2014-0075, CVE-2014-0096 and CVE-2014-0119）

Summary Security vulnerabilities exist in Apache Tomcat May 2014 X-Force Report that is shipped with IBM WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4 Vulnerability Details CVE ID: CVE-2014-0075 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by the...

Security Bulletin: Potential Security exposures with WebSphere Application Server (CVE-2014-4770 and CVE-2014-4816)

Summary There is a potential cross-site scripting XSS and a potential cross-site request forgery CSRF security vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2014-4770 Description: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Lombardi Edition (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by WebSphere Lombardi Edition. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified vulnerability related to t...

Security Bulletin:Security vulnerability in current IBM SDK for Java for WebSphere Application Server Community Edition 3.0.0.4 July 2014 CPU (CVE-2014-4244)

Summary A security vulnerability exists in the IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM WebSphere Application Server Community Edition 3.0.0.4. This issue was disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVE ID: CVE-2014-4244...

Security Bulletin: Java.policy file change in Default Socket Permissions for WebSphere Application Server

Summary IBM® SDK Java™ Technology Edition released by IBM and Oracle JDKs have made a change to the default socket permissions in the java.policy file. Vulnerability Details IBM® SDK Java™ Technology Edition released by IBM and the Oracle JDK's have made a change to the default socket permissions...

Security Bulletin: Security vulnerabilities in Apache Tomcat for WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4(CVE-2013-4286,CVE-2012-3544,CVE-2013-4322,CVE-2013-4590,CVE-2014-0033)

Summary Security vulnerabilities exist in Apache Tomcat which is shipped with IBM WebSphere Application Server Community Edition 2.1.1.6 and 3.0.0.4. Vulnerability Details CVE ID: CVE-2013-4286 DESCRIPTION: Apache Tomcat before 6.0.39, and 7.x before 7.0.47, when an HTTP connector or AJP connecto...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server CVE-2014-0114

Summary WebSphere Application Server is shipped as a component of WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details For vulnerability details, see the Classloader Manipulation...

Security Bulletin: Potential Security exposure with WebSphere Application Server (CVE-2014-3070)

Summary There is a potential bypass security vulnerability in WebSphere Application Server Version 8.0 and higher with Virtual Member Manager VMM. Vulnerability Details CVEID: CVE-2014-3070 Description: WebSphere Application Server could allow a remote attacker to bypass security restrictions...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server, which is shipped with IBM WebSphere Lombardi Edition (IBM SDK for Java CPU April 2014)

Summary IBM WebSphere Application Server is shipped as a component of IBM WebSphere Lombardi Edition. Information about a security vulnerability, which affects IBM WebSphere Application Server, has been published in a security bulletin. Vulnerability Details For vulnerability details, see the...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server, which is shipped with IBM WebSphere Business Services Fabric (IBM SDK for Java CPU April 2014)

Summary IBM WebSphere Application Server is shipped as a component of IBM WebSphere Business Services Fabric. Information about a security vulnerability, which affects IBM WebSphere Application Server, has been published in a security bulletin. Vulnerability Details For vulnerability details, see...