Security Bulletin: Financial Transaction Manager for ACH Services and Corporate Payment Services has a potential XML External Entity vulnerability (CVE-2017-1758)

Summary Financial Transaction Manager FTM for ACH Services and FTM for Corporate Payment Services CPS has addressed a potential XML External Entity vulnerability. For some web services, if the request is intercepted and modified, the XML payload could take advantage of XML External Entity Injecti...

Security Bulletin: Vulnerability in Apache POI affects IBM Emptoris Services Procurement (CVE-2017-5644)

Summary Open Source Apache Poi vulnerability affects IBM Emptoris Services Procurement Vulnerability Details CVE-ID: CVE-2017-5644 Description: Apache POI is vulnerable to a denial of service, cause by an XML External Entity Injection XXE error when processing XML data. By using a specially-craft...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Emptoris Strategic Supply Management and IBM Emptoris Services Procurement products.

Summary The IBM Emptoris Strategic Supply Management Suite and IBM Emptoris Services Procurement products are affected by multiple security vulnerabilities that exist in the IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. The security bulletin includes issue...

Security Bulletin: IBM Forms Experience Builder could be susceptible to Apache POI Vulnerabilities

Summary IBM Forms Experience Builder could be susceptible to allowing for a denial of service, cause by an error in Apache POI Libraries Vulnerability Details CVEID: CVE-2014-3574 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error wh...

Security Bulletin: IBM WebSphere Dashboard Framework is affected by a security vulnerability in Apache POI (CVE-2016-5000)

Summary Apache POI, which is bundled with IBM WebSphere Dashboard Framework, could allow a remote attacker to obtain sensitive information. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache POI, which is used by the spreadsheet integration functionality. CVEID:...

Security Bulletin: IBM WebSphere Dashboard Framework is affected by multiple security vulnerabilities in Apache POI

Summary Apache POI, which is bundled with IBM WebSphere Dashboard Framework, is vulnerable to denial of service attacks and could allow a remote attacker to obtain sensitive information. Vulnerability Details IBM WebSphere Dashboard Framework WDF bundles a copy of Apache POI, which is used by the...

Security Bulletin: IBM Forms Experience Builder is vulnerable to XML External Entity (XXE) Processing (CVE-2016-0369)

Summary IBM Forms Experience Builder is vulnerable to an XML External Entity processing exposure potentially leading to information disclosure. Vulnerability Details CVEID : CVE-2016-0369 DESCRIPTION : IBM Forms Experience Builder could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services

Summary Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services. Note the description says ACH Services but the vulnerabilities also apply to Check and CPS. Vulnerability Details CVEID: CVE-2016-0253 DESCRIPTION: IBM Financial...

Security Bulletin: Multiple vulnerabilities in IBM Financial Transaction Manager for Corporate Payment Services

Summary Multiple vulnerabilities in IBM Financial Transaction Manager for Corporate Payment Services. Note the description says ACH Services but the vulnerabilities also apply to CPS. Vulnerability Details CVEID: CVE-2016-0253 DESCRIPTION: IBM Financial Transaction Manager for ACH Services for...

Security Bulletin: XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2015-0194)

Summary A vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway XML External Entity XXE processing could allow a remote attacker to obtain sensitive information. Vulnerability Details CVE ID: CVE-2015-0194 DESCRIPTION: IBM Sterling File Gateway could allow a remote attacker t...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Streams

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, Service Refresh 4, Fix Pack 1 used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-1289 DESCRIPTION: IBM SDK, Java Technology Edition is vulnerable XML...

Security Bulletin: Vulnerabilities in Apache POI affects IBM InfoSphere Information Server

Summary Apache POI vulnerabilities were addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2012-0213 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by the improper handling of memory when processing certain Channel Definition Format CDF/ Compoun...

Security Bulletin: InfoSphere Information Server is vulnerable to XML External Entity Injection (XXE) (CVE-2016-6059)

Summary IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2016-6059 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to a denial of service, caused by ...

Security Bulletin: IBM Streams is affected by Libxml2 vulnerabilities (CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

Summary A set of Libxml2 vulnerabilities were disclosed by the Libxml2 Project. Libxml2 is used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-4447 DESCRIPTION: libxml2 is vulnerable to a denial of service, caused by a heap-based buffer...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6 and 7 used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID: CVE-2017-3544 DESCRIPTION: An unspecified vulnerability relat...

Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Cognos Metrics Manager (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7941, CVE-2015-7942, CVE-2015-8035, CVE-2015-8241, CVE-2015-8317)

Summary The vulnerabilities have been addressed in the libxml2 component of IBM Cognos Metrics Manager Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreader when processing XML dat...

Security Bulletin: DataPower GUI vulnerable to XML External Entity Injection attack (CVE-2018-1421)

Summary DataPower GUI is vulnerable to an XML External Entity Injection attack from a low-privileged DataPower account. IBM has addressed the applicable CVE Vulnerability Details CVEID: CVE-2018-1421 DESCRIPTION: IBM DataPower Gateways is vulnerable to a XML External Entity Injection XXE attack...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM PureApplication System. These issues were disclosed as part of the IBM Java SDK updates in April 2017. IBM PureApplication System has addressed the applicable CVEs. These issues were also addressed by IBM...

Security Bulletin: Vulnerability in dependent component distributed in IBM Development Package for Apache Spark (CVE-2015-1832)

Summary Apache Derby versions up to 10.12.1.1 may be susceptible to an XML external entity XXE attack. Hive's metastore, where created, requires Derby when Apache Hadoop data sources are used with Apache Spark. Apache Derby is therefore included in the IBM Development Package for Apache Spark...

Security Bulletin: Vulnerability in Apache Standard Taglibs affects Liberty for Java for IBM Bluemix (CVE-2015-0254)

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system,...