Refine your search
55 vulnerabilities found for Tivoli by IBM
CERTFR-2025-AVI-0651
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Informix Dynamic Server | Informix Dynamic Server versions 14.10.x sans le dernier correctif de sécurité | ||
| IBM | Db2 | Db2 versions 12.1.x antérieures à 12.1.2 | ||
| IBM | QRadar | QRadar Investigation Assistant versions 1.x antérieures à 1.1.0 | ||
| IBM | Informix Dynamic Server | Informix Dynamic Server versions 12.10.x sans le dernier correctif de sécurité | ||
| IBM | Cognos Analytics | Cognos Analytics 12.1.x antérieures à 12.1.0 IF2 | ||
| IBM | WebSphere | WebSphere Hybrid Edition version 5.1 sans les correctifs de sécurité PH67120 et PH67183 | ||
| IBM | Db2 | Db2 versions 11.1.x antérieures à 11.1.4 FP7 sans le dernier correctif de sécurité temporaire | ||
| IBM | Tivoli | Tivoli System Automation Application Manager 4.1 sans le correctif de sécurité pour WebSphere Application Server 9.0 | ||
| IBM | Cognos Analytics | Cognos Analytics 11.2.x antérieures à 11.2.4 FP6 | ||
| IBM | Db2 | Db2 versions 11.5.x antérieures à 11.5.9 sans le dernier correctif de sécurité temporaire | ||
| IBM | Cognos Analytics | Cognos Analytics 12.0.x antérieures à 12.0.4 FP1 | ||
| IBM | Db2 | Db2 versions 10.5.x antérieures à 10.5 FP11 sans le dernier correctif de sécurité temporaire |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Informix Dynamic Server versions 14.10.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Informix Dynamic Server",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Db2 versions 12.1.x ant\u00e9rieures \u00e0 12.1.2",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Investigation Assistant versions 1.x ant\u00e9rieures \u00e0 1.1.0",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Informix Dynamic Server versions 12.10.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Informix Dynamic Server",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics\t12.1.x ant\u00e9rieures \u00e0 12.1.0 IF2",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Hybrid Edition version 5.1 sans les correctifs de s\u00e9curit\u00e9 PH67120 et PH67183",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Db2 versions 11.1.x ant\u00e9rieures \u00e0 11.1.4 FP7 sans le dernier correctif de s\u00e9curit\u00e9 temporaire",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Tivoli System Automation Application Manager 4.1 sans le correctif de s\u00e9curit\u00e9 pour WebSphere Application Server 9.0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics\t11.2.x ant\u00e9rieures \u00e0 11.2.4 FP6",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Db2 versions 11.5.x ant\u00e9rieures \u00e0 11.5.9 sans le dernier correctif de s\u00e9curit\u00e9 temporaire",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics\t12.0.x ant\u00e9rieures \u00e0 12.0.4 FP1",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Db2 versions 10.5.x ant\u00e9rieures \u00e0 10.5 FP11 sans le dernier correctif de s\u00e9curit\u00e9 temporaire",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-0755",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0755"
},
{
"name": "CVE-2024-21144",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21144"
},
{
"name": "CVE-2024-49342",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49342"
},
{
"name": "CVE-2024-45492",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45492"
},
{
"name": "CVE-2025-30472",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30472"
},
{
"name": "CVE-2025-24970",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
},
{
"name": "CVE-2025-33092",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-33092"
},
{
"name": "CVE-2023-22081",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
},
{
"name": "CVE-2025-36097",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-36097"
},
{
"name": "CVE-2024-45490",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45490"
},
{
"name": "CVE-2024-45491",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45491"
},
{
"name": "CVE-2025-50182",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50182"
},
{
"name": "CVE-2025-50181",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50181"
},
{
"name": "CVE-2023-22067",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
},
{
"name": "CVE-2024-21147",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21147"
},
{
"name": "CVE-2024-21140",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21140"
},
{
"name": "CVE-2024-49343",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49343"
},
{
"name": "CVE-2025-47278",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47278"
},
{
"name": "CVE-2024-21138",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21138"
},
{
"name": "CVE-2024-47081",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47081"
},
{
"name": "CVE-2023-5676",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
},
{
"name": "CVE-2024-21145",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21145"
},
{
"name": "CVE-2024-50602",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-50602"
},
{
"name": "CVE-2025-5889",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5889"
},
{
"name": "CVE-2025-27607",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27607"
},
{
"name": "CVE-2025-48387",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48387"
},
{
"name": "CVE-2024-21131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21131"
},
{
"name": "CVE-2024-27267",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27267"
}
],
"initial_release_date": "2025-08-01T00:00:00",
"last_revision_date": "2025-08-01T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0651",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-08-01T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": "2025-07-29",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240941",
"url": "https://www.ibm.com/support/pages/node/7240941"
},
{
"published_at": "2025-07-25",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240649",
"url": "https://www.ibm.com/support/pages/node/7240649"
},
{
"published_at": "2025-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240898",
"url": "https://www.ibm.com/support/pages/node/7240898"
},
{
"published_at": "2025-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240775",
"url": "https://www.ibm.com/support/pages/node/7240775"
},
{
"published_at": "2025-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240798",
"url": "https://www.ibm.com/support/pages/node/7240798"
},
{
"published_at": "2025-07-25",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239462",
"url": "https://www.ibm.com/support/pages/node/7239462"
},
{
"published_at": "2025-07-29",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240952",
"url": "https://www.ibm.com/support/pages/node/7240952"
},
{
"published_at": "2025-07-29",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240940",
"url": "https://www.ibm.com/support/pages/node/7240940"
},
{
"published_at": "2025-07-29",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240946",
"url": "https://www.ibm.com/support/pages/node/7240946"
},
{
"published_at": "2025-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240777",
"url": "https://www.ibm.com/support/pages/node/7240777"
},
{
"published_at": "2025-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240899",
"url": "https://www.ibm.com/support/pages/node/7240899"
},
{
"published_at": "2025-07-29",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7240977",
"url": "https://www.ibm.com/support/pages/node/7240977"
}
]
}
CERTFR-2025-AVI-0590
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Sterling | Sterling Connect:Direct Web Services versions 6.3.0.x antérieures à 6.3.0.14 | ||
| IBM | Tivoli | Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans le dernier correctif de sécurité | ||
| IBM | Sterling | Sterling External Authentication Server versions 6.1.0.x antérieures à 6.1.0.2 iFix 03 | ||
| IBM | Db2 | DB2 Data Management Console on CPD versions 4.7.1 antérieures à 4.7.2 | ||
| IBM | Db2 | DB2 Data Management Console versions 3.1.11 à 3.1.13.x antérieures à 3.1.13.1 | ||
| IBM | QRadar | QRadar SIEM versions 7.5.0 sans le dernier correctif de sécurité | ||
| IBM | Tivoli | Tivoli Composite Application Manager for Application Diagnostics version 7.1.0 sans le dernier correctif de sécurité | ||
| IBM | Sterling | Sterling Connect:Direct Web Services versions 6.4.0.x antérieures à 6.4.0.3 | ||
| IBM | WebSphere | WebSphere Hybrid Edition versions 5.1 sans le correctif de sécurité PH66674 | ||
| IBM | Sterling | Sterling Connect:Direct Web Services versions 6.2.0.x antérieures à 6.2.0.28 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Sterling Connect:Direct Web Services versions 6.3.0.x ant\u00e9rieures \u00e0 6.3.0.14",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling External Authentication Server versions 6.1.0.x ant\u00e9rieures \u00e0 6.1.0.2 iFix 03",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "DB2 Data Management Console on CPD versions 4.7.1 ant\u00e9rieures \u00e0 4.7.2",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "DB2 Data Management Console versions 3.1.11 \u00e0 3.1.13.x ant\u00e9rieures \u00e0 3.1.13.1",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar SIEM versions 7.5.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Tivoli Composite Application Manager for Application Diagnostics version 7.1.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Connect:Direct Web Services versions 6.4.0.x ant\u00e9rieures \u00e0 6.4.0.3",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Hybrid Edition versions 5.1 sans le correctif de s\u00e9curit\u00e9 PH66674",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Connect:Direct Web Services versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.28",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-4447",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4447"
},
{
"name": "CVE-2022-29162",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29162"
},
{
"name": "CVE-2020-13956",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13956"
},
{
"name": "CVE-2021-43816",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43816"
},
{
"name": "CVE-2023-21830",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21830"
},
{
"name": "CVE-2023-27561",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27561"
},
{
"name": "CVE-2022-31030",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31030"
},
{
"name": "CVE-2021-35516",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35516"
},
{
"name": "CVE-2022-32149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32149"
},
{
"name": "CVE-2019-19921",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19921"
},
{
"name": "CVE-2021-35517",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35517"
},
{
"name": "CVE-2021-36090",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36090"
},
{
"name": "CVE-2021-43784",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43784"
},
{
"name": "CVE-2021-32760",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32760"
},
{
"name": "CVE-2023-25173",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25173"
},
{
"name": "CVE-2024-45296",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
},
{
"name": "CVE-2025-21587",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21587"
},
{
"name": "CVE-2023-25809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25809"
},
{
"name": "CVE-2024-25710",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25710"
},
{
"name": "CVE-2023-25153",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25153"
},
{
"name": "CVE-2023-33850",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
},
{
"name": "CVE-2025-30698",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30698"
},
{
"name": "CVE-2022-41721",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41721"
},
{
"name": "CVE-2023-28642",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28642"
},
{
"name": "CVE-2022-23471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23471"
},
{
"name": "CVE-2025-2900",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2900"
},
{
"name": "CVE-2022-41723",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41723"
},
{
"name": "CVE-2021-35515",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-35515"
},
{
"name": "CVE-2022-23648",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23648"
},
{
"name": "CVE-2021-41103",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41103"
},
{
"name": "CVE-2025-36038",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-36038"
},
{
"name": "CVE-2022-27664",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27664"
},
{
"name": "CVE-2016-1000027",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1000027"
}
],
"initial_release_date": "2025-07-11T00:00:00",
"last_revision_date": "2025-07-11T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0590",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-07-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": "2025-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239103",
"url": "https://www.ibm.com/support/pages/node/7239103"
},
{
"published_at": "2025-07-07",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239009",
"url": "https://www.ibm.com/support/pages/node/7239009"
},
{
"published_at": "2025-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239143",
"url": "https://www.ibm.com/support/pages/node/7239143"
},
{
"published_at": "2025-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239362",
"url": "https://www.ibm.com/support/pages/node/7239362"
},
{
"published_at": "2025-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239476",
"url": "https://www.ibm.com/support/pages/node/7239476"
},
{
"published_at": "2025-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239247",
"url": "https://www.ibm.com/support/pages/node/7239247"
},
{
"published_at": "2025-07-08",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239178",
"url": "https://www.ibm.com/support/pages/node/7239178"
},
{
"published_at": "2025-07-11",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7239475",
"url": "https://www.ibm.com/support/pages/node/7239475"
}
]
}
CERTFR-2024-AVI-0547
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | Tivoli Netcool Impact versions 7.1.0.x antérieures à 7.1.0.34 | ||
| IBM | Cognos Transformer | Cognos Transformer version 11.2.4 sans le correctif FP4 | ||
| IBM | Tivoli | Tivoli Application Dependency Discovery Manager versions 7.3.0.0 à 7.3.0.11 sans le correctif de sécurité efix_WLP_PSIRT_24006_FP11230825.zip | ||
| IBM | Cognos Transformer | Cognos Transformer versions 12.0.x antérieures à 12.0.3 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Tivoli Netcool Impact versions 7.1.0.x ant\u00e9rieures \u00e0 7.1.0.34",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Transformer version 11.2.4 sans le correctif FP4",
"product": {
"name": "Cognos Transformer",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Tivoli Application Dependency Discovery Manager versions 7.3.0.0 \u00e0 7.3.0.11 sans le correctif de s\u00e9curit\u00e9 efix_WLP_PSIRT_24006_FP11230825.zip",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Transformer versions 12.0.x ant\u00e9rieures \u00e0 12.0.3",
"product": {
"name": "Cognos Transformer",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-20919",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
},
{
"name": "CVE-2024-20926",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
},
{
"name": "CVE-2024-20921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
},
{
"name": "CVE-2023-22081",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22081"
},
{
"name": "CVE-2024-25026",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25026"
},
{
"name": "CVE-2023-22067",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22067"
},
{
"name": "CVE-2023-51775",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
},
{
"name": "CVE-2024-27268",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27268"
},
{
"name": "CVE-2023-33850",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
},
{
"name": "CVE-2023-5676",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5676"
},
{
"name": "CVE-2024-20918",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
},
{
"name": "CVE-2024-20945",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
},
{
"name": "CVE-2024-22354",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22354"
},
{
"name": "CVE-2024-20952",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
}
],
"initial_release_date": "2024-07-05T00:00:00",
"last_revision_date": "2024-07-05T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0547",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-05T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": "2024-07-01",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159323",
"url": "https://www.ibm.com/support/pages/node/7159323"
},
{
"published_at": "2024-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159530",
"url": "https://www.ibm.com/support/pages/node/7159530"
},
{
"published_at": "2024-07-01",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159308",
"url": "https://www.ibm.com/support/pages/node/7159308"
},
{
"published_at": "2024-09-26",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7159172",
"url": "https://www.ibm.com/support/pages/node/7159172"
}
]
}
CERTFR-2024-AVI-0279
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | N/A | Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.2.x antérieures à 6.1.2.9 | ||
| IBM | Sterling | Sterling Connect Direct pour UNIX versions 6.1.x antérieures à 6.1.0.4.iFix106 | ||
| IBM | WebSphere | WebSphere Application Server Liberty versions postérieures à 21.0.0.2 et antérieures à 24.0.0.4 | ||
| IBM | Sterling | Sterling Connect Direct pour UNIX versions 6.3.x antérieures à 6.3.0.2.iFix021 | ||
| IBM | Sterling | Sterling Connect Direct pour UNIX versions 6.0.x antérieures à 6.0.0.2.iFix164 | ||
| IBM | Tivoli | Tivoli Netcool Impact versions 7.1.0.x antérieures à 7.1.0.33 | ||
| IBM | N/A | Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.9.x antérieures à 6.1.9.2 | ||
| IBM | WebSphere | WebSphere Application Server versions 9.x antérieures à 9.0.5.19 | ||
| IBM | WebSphere | WebSphere Application Server versions postérieures à 8.5.5.2 antérieures à 8.5.5.26 | ||
| IBM | Sterling | Sterling Connect Direct pour UNIX versions 6.2.x antérieures à 6.2.0.7.iFix015 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.2.x ant\u00e9rieures \u00e0 6.1.2.9",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Connect Direct pour UNIX versions 6.1.x ant\u00e9rieures \u00e0 6.1.0.4.iFix106",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server Liberty versions post\u00e9rieures \u00e0 21.0.0.2 et ant\u00e9rieures \u00e0 24.0.0.4",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Connect Direct pour UNIX versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.2.iFix021",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Connect Direct pour UNIX versions 6.0.x ant\u00e9rieures \u00e0 6.0.0.2.iFix164",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Tivoli Netcool Impact versions 7.1.0.x ant\u00e9rieures \u00e0 7.1.0.33",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Storage Scale System 3000, 3200, 3500, 5000 et 6000 versions 6.1.9.x ant\u00e9rieures \u00e0 6.1.9.2",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 9.x ant\u00e9rieures \u00e0 9.0.5.19",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions post\u00e9rieures \u00e0 8.5.5.2 ant\u00e9rieures \u00e0 8.5.5.26",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Connect Direct pour UNIX versions 6.2.x ant\u00e9rieures \u00e0 6.2.0.7.iFix015",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-20919",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20919"
},
{
"name": "CVE-2024-20926",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20926"
},
{
"name": "CVE-2024-20921",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20921"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-51775",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
},
{
"name": "CVE-2023-52428",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52428"
},
{
"name": "CVE-2023-33850",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33850"
},
{
"name": "CVE-2024-20918",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20918"
},
{
"name": "CVE-2023-46158",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46158"
},
{
"name": "CVE-2024-20945",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20945"
},
{
"name": "CVE-2024-20952",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20952"
}
],
"initial_release_date": "2024-04-05T00:00:00",
"last_revision_date": "2024-04-05T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0279",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-04-05T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7145606 du 01 avril 2024",
"url": "https://www.ibm.com/support/pages/node/7145606"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7145538 du 29 mars 2024",
"url": "https://www.ibm.com/support/pages/node/7145538"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7145743 du 02 avril 2024",
"url": "https://www.ibm.com/support/pages/node/7145743"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7145942 du 04 avril 2024",
"url": "https://www.ibm.com/support/pages/node/7145942"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7145926 du 04 avril 2024",
"url": "https://www.ibm.com/support/pages/node/7145926"
}
]
}
CERTFR-2023-AVI-0798
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | MaaS360 | Module VPN MaaS360 versions antérieures à 3.000.200 | ||
| IBM | QRadar | QRadar Data Synchronization App versions 1.0.x à 3.1.1 antérieures à 3.1.2 | ||
| IBM | Tivoli | Tivoli Netcool Impact versions 7.1.x antérieures à 7.1.0.31 | ||
| IBM | MaaS360 | MaaS360 Mobile Enterprise Gateway versions antérieures à 3.000.200 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Module VPN MaaS360 versions ant\u00e9rieures \u00e0 3.000.200",
"product": {
"name": "MaaS360",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Data Synchronization App versions 1.0.x \u00e0 3.1.1 ant\u00e9rieures \u00e0 3.1.2",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Tivoli Netcool Impact versions 7.1.x ant\u00e9rieures \u00e0 7.1.0.31",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "MaaS360 Mobile Enterprise Gateway versions ant\u00e9rieures \u00e0 3.000.200",
"product": {
"name": "MaaS360",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-28867",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28867"
},
{
"name": "CVE-2022-46175",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46175"
},
{
"name": "CVE-2023-26049",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26049"
},
{
"name": "CVE-2023-2650",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
},
{
"name": "CVE-2023-20863",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20863"
},
{
"name": "CVE-2022-25881",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25881"
},
{
"name": "CVE-2023-24998",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
},
{
"name": "CVE-2023-26048",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26048"
}
],
"initial_release_date": "2023-10-03T00:00:00",
"last_revision_date": "2023-10-03T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0798",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-03T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es, une ex\u00e9cution de code arbitraire \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7043471 du 02 octobre 2023",
"url": "https://www.ibm.com/support/pages/node/7043471"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7042785 du 29 septembre 2023",
"url": "https://www.ibm.com/support/pages/node/7042785"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7043103 du 29 septembre 2023",
"url": "https://www.ibm.com/support/pages/node/7043103"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7040883 du 29 septembre 2023",
"url": "https://www.ibm.com/support/pages/node/7040883"
}
]
}
CERTFR-2022-AVI-997
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans IBM Tivoli. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Monitoring versions ant\u00e9rieures \u00e0 6.3.0.7 Plus Service Pack 5",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-2163",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-2163"
},
{
"name": "CVE-2022-22473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22473"
},
{
"name": "CVE-2022-22477",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22477"
},
{
"name": "CVE-2022-34336",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34336"
},
{
"name": "CVE-2022-40674",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40674"
},
{
"name": "CVE-2022-34165",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34165"
}
],
"initial_release_date": "2022-11-08T00:00:00",
"last_revision_date": "2022-11-08T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-997",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Tivoli.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des\ndonn\u00e9es et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6837645 du 07 novembre 2022",
"url": "https://www.ibm.com/support/pages/node/6837645"
}
]
}
CERTFR-2022-AVI-850
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Netcool Impact versions 7.1.x ant\u00e9rieures \u00e0 7.1.25",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Spectrum Protect Plus versions 10.1.x ant\u00e9rieures \u00e0 10.1.12",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-26520",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26520"
},
{
"name": "CVE-2022-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1292"
},
{
"name": "CVE-2022-2068",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-2068"
},
{
"name": "CVE-2021-4160",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4160"
},
{
"name": "CVE-2022-21724",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21724"
},
{
"name": "CVE-2022-0778",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0778"
}
],
"initial_release_date": "2022-09-22T00:00:00",
"last_revision_date": "2022-09-22T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-850",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-09-22T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6622079 du 21 septembre 2022",
"url": "https://www.ibm.com/support/pages/node/6622079"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6602599 du 16 juin 2022",
"url": "https://www.ibm.com/support/pages/node/6602599"
}
]
}
CERTFR-2022-AVI-647
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans IBM Tivoli Netcool/OMNIbus. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Tivoli Netcool/OMNIbus WebGUI versions ant\u00e9rieures \u00e0 8.1.0 Fix Pack 27",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-3918",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3918"
}
],
"initial_release_date": "2022-07-15T00:00:00",
"last_revision_date": "2022-07-15T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-647",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans IBM Tivoli Netcool/OMNIbus. Elle\npermet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0\ndistance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans IBM Tivoli Netcool/OMNIbus",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6603645 du 13 juillet 2022",
"url": "https://www.ibm.com/support/pages/node/6603645"
}
]
}
CERTFR-2022-AVI-349
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans IBM Tivoli Network Manager. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Tivoli Network Manager versions 4.2.x ant\u00e9rieures \u00e0 4.2.0.14",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-40865",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40865"
},
{
"name": "CVE-2021-38294",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38294"
}
],
"initial_release_date": "2022-04-15T00:00:00",
"last_revision_date": "2022-04-15T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-349",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Tivoli Network\nManager. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Network Manager",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6572281 du 14 avril 2022",
"url": "https://www.ibm.com/support/pages/node/6572281"
}
]
}
CERTFR-2021-AVI-474
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Contournement provisoire
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Netcool/OMNIbus Integration - Transport Module Common Integration Library versions antérieures à common-transportmodule-29_0 | ||
| IBM | QRadar SIEM | IBM QRadar SIEM versions 7.4 sans le dernier correctif | ||
| IBM | QRadar SIEM | IBM QRadar SIEM versions 7.3 sans le dernier correctif | ||
| IBM | Tivoli | IBM Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services versions antérieures à nco-p-ews-3_0 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Netcool/OMNIbus Integration - Transport Module Common Integration Library versions ant\u00e9rieures \u00e0 common-transportmodule-29_0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM QRadar SIEM versions 7.4 sans le dernier correctif",
"product": {
"name": "QRadar SIEM",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM QRadar SIEM versions 7.3 sans le dernier correctif",
"product": {
"name": "QRadar SIEM",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services versions ant\u00e9rieures \u00e0 nco-p-ews-3_0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\n## Contournement provisoire\n",
"cves": [
{
"name": "CVE-2021-29425",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29425"
},
{
"name": "CVE-2021-21409",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21409"
},
{
"name": "CVE-2020-36282",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-36282"
},
{
"name": "CVE-2021-21295",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21295"
},
{
"name": "CVE-2021-21290",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21290"
}
],
"initial_release_date": "2021-06-18T00:00:00",
"last_revision_date": "2021-06-18T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-474",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-06-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6464851 du 17 juin 2021",
"url": "https://www.ibm.com/support/pages/node/6464851"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6462245 du 17 juin 2021",
"url": "https://www.ibm.com/support/pages/node/6462245"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6462247 du 17 juin 2021",
"url": "https://www.ibm.com/support/pages/node/6462247"
}
]
}
CERTFR-2021-AVI-417
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Spectrum | IBM Spectrum Scale versions 5.1.x antérieures à 5.1.1.0 | ||
| IBM | Tivoli | IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.0 à 7.3.0.8 | ||
| IBM | Spectrum | IBM Spectrum Scale versions 5.0.x antérieures à 5.0.5.7 | ||
| IBM | N/A | Content Collector for Email versions 4.0.x antérieures à 4.0.1 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Spectrum Scale versions 5.1.x ant\u00e9rieures \u00e0 5.1.1.0",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.0 \u00e0 7.3.0.8",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Spectrum Scale versions 5.0.x ant\u00e9rieures \u00e0 5.0.5.7",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Content Collector for Email versions 4.0.x ant\u00e9rieures \u00e0 4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-22696",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22696"
},
{
"name": "CVE-2021-29740",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29740"
},
{
"name": "CVE-2021-20454",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20454"
}
],
"initial_release_date": "2021-06-02T00:00:00",
"last_revision_date": "2021-06-02T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-417",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-06-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6457629 du 31 mai 2021",
"url": "https://www.ibm.com/support/pages/node/6457629"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6457727 du 01 juin 2021",
"url": "https://www.ibm.com/support/pages/node/6457727"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6457777 du 01 juin 2021",
"url": "https://www.ibm.com/support/pages/node/6457777"
}
]
}
CERTFR-2021-AVI-254
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Composite Application Manager (ITCAM) for Transactions versions 7.4.0.x antérieures à 7.4.0.1 avec le correctif IF0052 | ||
| IBM | N/A | InfoSphere Information Server on Cloud versions antérieures à 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1 | ||
| IBM | Tivoli | IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.x dans le dernier correctif | ||
| IBM | N/A | InfoSphere Information Server versions antérieures à 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Composite Application Manager (ITCAM) for Transactions versions 7.4.0.x ant\u00e9rieures \u00e0 7.4.0.1 avec le correctif IF0052",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "InfoSphere Information Server on Cloud versions ant\u00e9rieures \u00e0 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Application Dependency Discovery Manager versions 7.3.0.x dans le dernier correctif",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "InfoSphere Information Server versions ant\u00e9rieures \u00e0 11.7.1.1 ou 11.7.1.0 avec le correctif Fix Pack 1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-2654",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2654"
},
{
"name": "CVE-2020-2803",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2803"
},
{
"name": "CVE-2020-14803",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14803"
},
{
"name": "CVE-2019-2978",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2978"
},
{
"name": "CVE-2019-2945",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2945"
},
{
"name": "CVE-2019-2958",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2958"
},
{
"name": "CVE-2020-2773",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2773"
},
{
"name": "CVE-2020-2805",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2805"
},
{
"name": "CVE-2019-2987",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2987"
},
{
"name": "CVE-2020-2830",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2830"
},
{
"name": "CVE-2020-2781",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2781"
},
{
"name": "CVE-2019-2988",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2988"
},
{
"name": "CVE-2020-2601",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2601"
},
{
"name": "CVE-2020-2593",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2593"
},
{
"name": "CVE-2020-27221",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27221"
},
{
"name": "CVE-2020-2754",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2754"
},
{
"name": "CVE-2021-25329",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25329"
},
{
"name": "CVE-2020-2778",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2778"
},
{
"name": "CVE-2019-2962",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2962"
},
{
"name": "CVE-2019-2981",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2981"
},
{
"name": "CVE-2019-2989",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2989"
},
{
"name": "CVE-2020-2755",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2755"
},
{
"name": "CVE-2019-2933",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2933"
},
{
"name": "CVE-2020-2583",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2583"
},
{
"name": "CVE-2019-2964",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2964"
},
{
"name": "CVE-2021-25122",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25122"
},
{
"name": "CVE-2019-2999",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2999"
},
{
"name": "CVE-2020-2604",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2604"
},
{
"name": "CVE-2019-2949",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2949"
},
{
"name": "CVE-2020-2800",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2800"
},
{
"name": "CVE-2020-2816",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2816"
},
{
"name": "CVE-2020-2757",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2757"
},
{
"name": "CVE-2020-2655",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2655"
},
{
"name": "CVE-2019-2894",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2894"
},
{
"name": "CVE-2020-2590",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2590"
},
{
"name": "CVE-2020-2767",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2767"
},
{
"name": "CVE-2019-2992",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2992"
},
{
"name": "CVE-2019-2973",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2973"
},
{
"name": "CVE-2020-2756",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2756"
},
{
"name": "CVE-2019-2977",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2977"
},
{
"name": "CVE-2019-2983",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2983"
},
{
"name": "CVE-2019-2975",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-2975"
}
],
"initial_release_date": "2021-04-14T00:00:00",
"last_revision_date": "2021-04-14T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-254",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-04-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6436421 du 01 avril 2021",
"url": "https://www.ibm.com/support/pages/node/6436421"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6440909 du 07 avril 2021",
"url": "https://www.ibm.com/support/pages/node/6440909"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6442857 du 13 avril 2021",
"url": "https://www.ibm.com/support/pages/node/6442857"
}
]
}
CERTFR-2020-AVI-677
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Monitoring version 6.3.0",
"product": {
"name": "Tivoli Monitoring",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli System Automation Application Manager 4.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli System Automation pour Multiplatforms 4.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Enterprise Content Management System Monitor version 5.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-4449",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4449"
},
{
"name": "CVE-2020-14621",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14621"
},
{
"name": "CVE-2019-17566",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17566"
},
{
"name": "CVE-2020-14579",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14579"
},
{
"name": "CVE-2020-14593",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14593"
},
{
"name": "CVE-2020-14578",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14578"
},
{
"name": "CVE-2020-14556",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14556"
},
{
"name": "CVE-2020-4578",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4578"
},
{
"name": "CVE-2019-4473",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-4473"
},
{
"name": "CVE-2019-11771",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11771"
},
{
"name": "CVE-2020-4329",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4329"
},
{
"name": "CVE-2020-4362",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4362"
},
{
"name": "CVE-2019-4720",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-4720"
},
{
"name": "CVE-2020-4534",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4534"
},
{
"name": "CVE-2020-4464",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4464"
},
{
"name": "CVE-2020-4365",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4365"
},
{
"name": "CVE-2020-14583",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14583"
},
{
"name": "CVE-2020-4643",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4643"
},
{
"name": "CVE-2020-4276",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-4276"
}
],
"initial_release_date": "2020-10-23T00:00:00",
"last_revision_date": "2020-10-23T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-677",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-10-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6351367 du 21 octobre 2020",
"url": "https://www.ibm.com/support/pages/node/6351367"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6351365 du 21 octobre 2020",
"url": "https://www.ibm.com/support/pages/node/6351365"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6351391 du 22 octobre 2020",
"url": "https://www.ibm.com/support/pages/node/6351391"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 6351443 du 22 octobre 2020",
"url": "https://www.ibm.com/support/pages/node/6351443"
}
]
}
CERTFR-2019-AVI-018
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Security Identity Manager versions 7.0.1 \u00e0 7.0.1.10",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Security Identity Manager versions 6.0.0 \u00e0 6.0.0.20",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Spectrum Control versions 5.2.8 \u00e0 5.2.13",
"product": {
"name": "Spectrum",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Productivity Center versions 5.2.0 \u00e0 5.2.7.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-1956",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1956"
},
{
"name": "CVE-2018-1904",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1904"
},
{
"name": "CVE-2018-1967",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1967"
},
{
"name": "CVE-2017-1788",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1788"
},
{
"name": "CVE-2018-1969",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1969"
}
],
"initial_release_date": "2019-01-14T00:00:00",
"last_revision_date": "2019-01-14T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-018",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-01-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10794615 du 11 janvier 2019",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10794615"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10794617 du 11 janvier 2019",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10794617"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10793725 du 11 janvier 2019",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10793725"
}
]
}
CERTFR-2018-AVI-544
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | N/A | IBM Network Performance Insight versions 1.2.1, 1.2.2, 1.2.3 | ||
| IBM | N/A | IBM Installation Manager et IBM Packaging Utility versions antérieures à 1.8.9.2 | ||
| IBM | N/A | IBM Content Collector for Email versions 4.0.1.x sans le dernier correctif de sécurité | ||
| IBM | N/A | IBM Content Collector for SharePoint versions 4.0.1.x sans le dernier correctif de sécurité | ||
| IBM | WebSphere | IBM WebSphere Application Server versions 9.0.x antérieures à 9.0.0.9 | ||
| IBM | N/A | IBM Content Collector for File Systems versions 4.0.1.x sans le dernier correctif de sécurité | ||
| IBM | N/A | IBM Content Collector for IBM Connections versions 4.0.1.x sans le dernier correctif de sécurité | ||
| IBM | WebSphere | IBM WebSphere Application Server versions 8.0.x sans le dernier correctif de sécurité | ||
| IBM | WebSphere | IBM WebSphere Application Server versions 8.5.x antérieures à 8.5.5.14 | ||
| IBM | Tivoli | IBM Tivoli System Automation for Multiplatforms versions 4.1.x sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Network Performance Insight versions 1.2.1, 1.2.2, 1.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Installation Manager et IBM Packaging Utility versions ant\u00e9rieures \u00e0 1.8.9.2",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector for Email versions 4.0.1.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector for SharePoint versions 4.0.1.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM WebSphere Application Server versions 9.0.x ant\u00e9rieures \u00e0 9.0.0.9",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector for File Systems versions 4.0.1.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector for IBM Connections versions 4.0.1.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM WebSphere Application Server versions 8.0.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM WebSphere Application Server versions 8.5.x ant\u00e9rieures \u00e0 8.5.5.14",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli System Automation for Multiplatforms versions 4.1.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-1656",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1656"
},
{
"name": "CVE-2018-1643",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1643"
},
{
"name": "CVE-2018-11776",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11776"
},
{
"name": "CVE-2018-11771",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11771"
},
{
"name": "CVE-2018-1517",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1517"
},
{
"name": "CVE-2018-12539",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12539"
}
],
"initial_release_date": "2018-11-13T00:00:00",
"last_revision_date": "2018-11-13T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-544",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM .\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10716857 du 13 novembre 2018",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10716857"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10735325 du 13 novembre 2018",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10735325"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10738729 du 13 novembre 2018",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10738729"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10739173 du 12 novembre 2018",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10739173"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10739183 du 12 novembre 2018",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10739183"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 10730391 du 12 novembre 2018",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10730391"
}
]
}
CERTFR-2015-AVI-072
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits IBM. Elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une élévation de privilèges.
Contournement provisoire
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Workload Scheduler 8.x | ||
| IBM | N/A | MegaRAID Storage Management 13.x | ||
| IBM | N/A | IBM Content Collector 3.x | ||
| IBM | N/A | IBM Cúram Social Program Management 6.x | ||
| IBM | N/A | IBM Cloud Manager with OpenStack 4.x | ||
| IBM | N/A | IBM MessageSight 1.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client 6.x | ||
| IBM | N/A | IBM Business Process Manager 7.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client 7.x | ||
| IBM | WebSphere | IBM WebSphere Transformation Extender 8.x | ||
| IBM | N/A | IBM Content Collector for Email 4.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client 5.x | ||
| IBM | N/A | IBM Content Collector 4.x | ||
| IBM | Tivoli | IBM Tivoli Workload Scheduler 9.x | ||
| IBM | N/A | IBM System x Integrated Management Module 2 (IMM2) 4.x |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Workload Scheduler 8.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "MegaRAID Storage Management 13.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector 3.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM C\u00faram Social Program Management 6.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Cloud Manager with OpenStack 4.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM MessageSight 1.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client 6.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Business Process Manager 7.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client 7.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM WebSphere Transformation Extender 8.x",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector for Email 4.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client 5.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Content Collector 4.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Workload Scheduler 9.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM System x Integrated Management Module 2 (IMM2) 4.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Contournement provisoire\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2015-0101",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0101"
},
{
"name": "CVE-2014-6512",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6512"
},
{
"name": "CVE-2014-7144",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7144"
},
{
"name": "CVE-2014-7230",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7230"
},
{
"name": "CVE-2014-4803",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4803"
},
{
"name": "CVE-2014-3509",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3509"
},
{
"name": "CVE-2014-3567",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3567"
},
{
"name": "CVE-2015-0146",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0146"
},
{
"name": "CVE-2014-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3505"
},
{
"name": "CVE-2014-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0221"
},
{
"name": "CVE-2014-0195",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0195"
},
{
"name": "CVE-2014-3641",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3641"
},
{
"name": "CVE-2014-6468",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6468"
},
{
"name": "CVE-2014-3513",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3513"
},
{
"name": "CVE-2014-0224",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0224"
},
{
"name": "CVE-2014-4263",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4263"
},
{
"name": "CVE-2014-0139",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0139"
},
{
"name": "CVE-2014-2532",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2532"
},
{
"name": "CVE-2014-0138",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0138"
},
{
"name": "CVE-2014-3511",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3511"
},
{
"name": "CVE-2014-3568",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3568"
},
{
"name": "CVE-2014-3470",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3470"
},
{
"name": "CVE-2014-3507",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3507"
},
{
"name": "CVE-2014-3608",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3608"
},
{
"name": "CVE-2014-6414",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6414"
},
{
"name": "CVE-2014-3621",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3621"
},
{
"name": "CVE-2014-3510",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3510"
},
{
"name": "CVE-2015-0235",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0235"
},
{
"name": "CVE-2013-2174",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2174"
},
{
"name": "CVE-2014-3508",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3508"
},
{
"name": "CVE-2014-8373",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8373"
},
{
"name": "CVE-2014-4813",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4813"
},
{
"name": "CVE-2014-0015",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0015"
},
{
"name": "CVE-2014-0198",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0198"
},
{
"name": "CVE-2014-3506",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3506"
},
{
"name": "CVE-2014-7231",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7231"
},
{
"name": "CVE-2014-8917",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8917"
},
{
"name": "CVE-2014-5356",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-5356"
}
],
"initial_release_date": "2015-02-16T00:00:00",
"last_revision_date": "2015-02-16T00:00:00",
"links": [],
"reference": "CERTFR-2015-AVI-072",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2015-02-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un d\u00e9ni de service \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM du 16 f\u00e9vrier 2015",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21693134"
}
]
}
CERTFR-2015-AVI-057
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits IBM. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Change and Configuration Management Database 7 | ||
| IBM | N/A | IBM Maximo Asset Management Essentials 7 | ||
| IBM | N/A | IBM SmartCloud Control Desk 7 | ||
| IBM | N/A | IBM Maximo Asset Management 7 | ||
| IBM | Tivoli | IBM Tivoli Service Request Manager 7 | ||
| IBM | Tivoli | IBM Tivoli Asset Management for IT 7 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Change and Configuration Management Database 7",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Maximo Asset Management Essentials 7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SmartCloud Control Desk 7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Maximo Asset Management 7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Service Request Manager 7",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Asset Management for IT 7",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-6194",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6194"
}
],
"initial_release_date": "2015-02-06T00:00:00",
"last_revision_date": "2015-02-06T00:00:00",
"links": [],
"reference": "CERTFR-2015-AVI-057",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2015-02-06T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eIBM\u003c/span\u003e. Elles permettent \u00e0 un attaquant de provoquer\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21694035 du 06 f\u00e9vrier 2015",
"url": "https://www.ibm.com/support/docview.wss?uid=swg21694035"
}
]
}
CERTFR-2015-AVI-050
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | N/A | IBM Maximo Asset Management Essentials 7 | ||
| IBM | N/A | IBM Maximo Asset Management 7 | ||
| IBM | Tivoli | IBM Tivoli Change 7 | ||
| IBM | Tivoli | IBM Tivoli Asset Management pour IT 7 | ||
| IBM | Tivoli | IBM Tivoli Service Request Manager 7 | ||
| IBM | WebSphere | IBM WebSphere Cast Iron Cloud 6, 7.0.0.0, 7.0.0.1, et 7.0.0.2 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Maximo Asset Management Essentials 7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Maximo Asset Management 7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Change 7",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Asset Management pour IT 7",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Service Request Manager 7",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM WebSphere Cast Iron Cloud 6, 7.0.0.0, 7.0.0.1, et 7.0.0.2",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2015-0108",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0108"
},
{
"name": "CVE-2015-0109",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0109"
},
{
"name": "CVE-2015-0107",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0107"
},
{
"name": "CVE-2014-3567",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3567"
},
{
"name": "CVE-2014-3513",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3513"
},
{
"name": "CVE-2014-4263",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4263"
},
{
"name": "CVE-2014-3568",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3568"
},
{
"name": "CVE-2014-4244",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4244"
},
{
"name": "CVE-2014-3596",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3596"
}
],
"initial_release_date": "2015-02-02T00:00:00",
"last_revision_date": "2015-02-02T00:00:00",
"links": [],
"reference": "CERTFR-2015-AVI-050",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2015-02-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eIBM\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21695670 du 02 f\u00e9vrier 2015",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21695670"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21695324 du 02 f\u00e9vrier 2015",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21695324"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21694974 du 02 f\u00e9vrier 2015",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21694974"
}
]
}
CERTFR-2014-AVI-513
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits IBM. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Contournement provisoire
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Algo One versions 4.x et 5.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager versions 6.x et 7.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM WebSphere DataPower XC10 2.x",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage FlashCopy Manager versions 3.x et 4.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Contournement provisoire\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-0119",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0119"
},
{
"name": "CVE-2014-0099",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0099"
},
{
"name": "CVE-2014-6163",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6163"
},
{
"name": "CVE-2014-0224",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0224"
},
{
"name": "CVE-2014-4263",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4263"
},
{
"name": "CVE-2014-3470",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3470"
},
{
"name": "CVE-2014-4244",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4244"
},
{
"name": "CVE-2014-3058",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3058"
},
{
"name": "CVE-2014-6143",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6143"
},
{
"name": "CVE-2014-0198",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0198"
},
{
"name": "CVE-2014-0096",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0096"
}
],
"initial_release_date": "2014-12-10T00:00:00",
"last_revision_date": "2014-12-10T00:00:00",
"links": [],
"reference": "CERTFR-2014-AVI-513",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-12-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0\ndistance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM du 09 d\u00e9cembre 2014",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21690128"
}
]
}
CERTFR-2014-AVI-463
Vulnerability from certfr_avis
Une vulnérabilité a été corrigée dans IBM Tivoli Application Dependency Discovery Manager. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "TADDM version 7.2.2.0 \u00e0 7.2.2.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "TADDM version 7.2.1.0 \u00e0 7.2.1.6",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "TADDM version 7.2.0.0 \u00e0 7.2.0.10",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-6149",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6149"
}
],
"initial_release_date": "2014-11-10T00:00:00",
"last_revision_date": "2014-11-10T00:00:00",
"links": [],
"reference": "CERTFR-2014-AVI-463",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-11-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eIBM Tivoli\nApplication Dependency Discovery Manager\u003c/span\u003e. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans IBM Tivoli Application Dependency Discovery Manager",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM du 30 octobre 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21688296"
}
]
}
CERTFR-2014-AVI-368
Vulnerability from certfr_avis
Une vulnérabilité a été corrigée dans IBM Tivoli. Elle permet à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Storage Manager Operations Cente version 7.1.0.100 | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Operations Cente version 6.4.0.100 | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Operations Cente version 7.1.0.000 | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Operations Cente version 6.4.1.000 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Storage Manager Operations Cente version 7.1.0.100",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Operations Cente version 6.4.0.100",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Operations Cente version 7.1.0.000",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Operations Cente version 6.4.1.000",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0050"
}
],
"initial_release_date": "2014-09-02T00:00:00",
"last_revision_date": "2014-09-02T00:00:00",
"links": [],
"reference": "CERTFR-2014-AVI-368",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-09-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eIBM\nTivoli\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de\nservice \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans IBM Tivoli",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM du 12 ao\u00fbt 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680564"
}
]
}
CERTFR-2014-AVI-199
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | N/A | IBM HMC V7 Release 7.7.0 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 4.0.4 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 4.0.1 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 3.0.1 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 4.0.5 | ||
| IBM | N/A | IBM TS3000 (TSSC) version 7.2.x | ||
| IBM | N/A | IBM Rhapsody Design Manager version 3.0.0.1 | ||
| IBM | N/A | IBM SmartCloud Provisioning 2.3.0 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 4.0.2 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 4.0.3 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 4.0 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 4.0 | ||
| IBM | N/A | IBM Initiate Master Data Service version 10.1 | ||
| IBM | N/A | IBM Initiate Master Data Service version 10.0 | ||
| IBM | N/A | IBM Initiate Master Data Service version 9.5 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 4.0.4 | ||
| IBM | N/A | IBM SDN VE, Unified Controller, KVM Edition: 1.0.0 | ||
| IBM | N/A | IBM Initiate Master Data Service version 9.7 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 4.0.3 | ||
| IBM | N/A | IBM Initiate Master Data Service Patient Hub version 9.7 | ||
| IBM | N/A | IBM InfoSphere Master Data Management Patient Hub version 10.0 | ||
| IBM | N/A | IBM Initiate Master Data Service Provider Hub version 9.5 | ||
| IBM | N/A | IBM Worklight Consumer Edition version 6.1.0 Fix Pack 1 | ||
| IBM | N/A | IBM Worklight Enterprise Edition version 6.1.0 Fix Pack 1 | ||
| IBM | N/A | IBM i version V5R3 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 4.0.2 | ||
| IBM | N/A | IBM i version 7.1 | ||
| IBM | N/A | IBM Connections 4.0 | ||
| IBM | N/A | IBM InfoSphere Master Data Management Standard/Advanced Edition version 11.0 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 3.0 | ||
| IBM | Tivoli | IBM Tivoli Storage Productivity Center versions 5.1.1.3 et antérieures | ||
| IBM | N/A | IBM i version 6.1 | ||
| IBM | Tivoli | IBM Tivoli Storage Productivity Center versions 4.2.2.177 et antérieures | ||
| IBM | N/A | IBM Initiate Master Data Service Patient Hub version 9.5 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 4.0.5 | ||
| IBM | N/A | IBM i version V5R4 | ||
| IBM | N/A | IBM SDN VE, Unified Controller, VMware Edition: 1.0.0 | ||
| IBM | N/A | IBM Connections 4.5 | ||
| IBM | Tivoli | IBM Tivoli Provisioning Manager for Software 5.1 | ||
| IBM | N/A | IBM HMC V7 Release 7.8.0 | ||
| IBM | N/A | IBM Initiate Master Data Service Provider Hub version 9.7 | ||
| IBM | N/A | IBM InfoSphere Master Data Management Provider Hub version 10.0 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 3.0.0.1 | ||
| IBM | N/A | IBM Rational Software Architect Design Manager version 3.0 | ||
| IBM | N/A | IBM Rhapsody Design Manager version 4.0.1 | ||
| IBM | N/A | IBM SDN VE, Unified Controller, OpenFlow Edition: 1.0.0 | ||
| IBM | N/A | IBM SDN VE, Dove Management Console, VMware Edition: 1.0.0 | ||
| IBM | Tivoli | IBM Tivoli Storage Productivity Center versions 5.2.1.0 et antérieures | ||
| IBM | N/A | IBM Rhapsody Design Manager version 3.0.1 | ||
| IBM | N/A | IBM Worklight Enterprise Edition Versions 6.1.0.0 | ||
| IBM | N/A | IBM Worklight Consumer Edition version 6.1.0.0 | ||
| IBM | N/A | IBM Connections 3.0.1.1 et versions antérieures |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM HMC V7 Release 7.7.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 4.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 3.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 4.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM TS3000 (TSSC) version 7.2.x",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 3.0.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SmartCloud Provisioning 2.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 4.0.2",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 4.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service version 10.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service version 9.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 4.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SDN VE, Unified Controller, KVM Edition: 1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service version 9.7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 4.0.3",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service Patient Hub version 9.7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM InfoSphere Master Data Management Patient Hub version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service Provider Hub version 9.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Worklight Consumer Edition version 6.1.0 Fix Pack 1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Worklight Enterprise Edition version 6.1.0 Fix Pack 1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM i version V5R3",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 4.0.2",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM i version 7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Connections 4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM InfoSphere Master Data Management Standard/Advanced Edition version 11.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Productivity Center versions 5.1.1.3 et ant\u00e9rieures",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM i version 6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Productivity Center versions 4.2.2.177 et ant\u00e9rieures",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service Patient Hub version 9.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 4.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM i version V5R4",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SDN VE, Unified Controller, VMware Edition: 1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Connections 4.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Provisioning Manager for Software 5.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM HMC V7 Release 7.8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Initiate Master Data Service Provider Hub version 9.7",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM InfoSphere Master Data Management Provider Hub version 10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 3.0.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rational Software Architect Design Manager version 3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 4.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SDN VE, Unified Controller, OpenFlow Edition: 1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SDN VE, Dove Management Console, VMware Edition: 1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Productivity Center versions 5.2.1.0 et ant\u00e9rieures",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Rhapsody Design Manager version 3.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Worklight Enterprise Edition Versions 6.1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Worklight Consumer Edition version 6.1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Connections 3.0.1.1 et versions ant\u00e9rieures",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-0417",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0417"
},
{
"name": "CVE-2013-5803",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5803"
},
{
"name": "CVE-2013-5459",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5459"
},
{
"name": "CVE-2013-5843",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5843"
},
{
"name": "CVE-2013-5814",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5814"
},
{
"name": "CVE-2013-5778",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5778"
},
{
"name": "CVE-2014-0411",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0411"
},
{
"name": "CVE-2014-0160",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0160"
},
{
"name": "CVE-2013-5801",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5801"
},
{
"name": "CVE-2014-0422",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0422"
},
{
"name": "CVE-2013-5907",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5907"
},
{
"name": "CVE-2013-4353",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4353"
},
{
"name": "CVE-2013-5782",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5782"
},
{
"name": "CVE-2013-6449",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6449"
},
{
"name": "CVE-2013-5790",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5790"
},
{
"name": "CVE-2013-5802",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5802"
},
{
"name": "CVE-2013-5849",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5849"
},
{
"name": "CVE-2013-5842",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5842"
},
{
"name": "CVE-2014-0423",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0423"
},
{
"name": "CVE-2014-0376",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0376"
},
{
"name": "CVE-2014-0416",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0416"
},
{
"name": "CVE-2013-3829",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-3829"
},
{
"name": "CVE-2013-5850",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5850"
},
{
"name": "CVE-2013-5804",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5804"
},
{
"name": "CVE-2013-5780",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5780"
},
{
"name": "CVE-2013-5797",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5797"
},
{
"name": "CVE-2013-5840",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5840"
},
{
"name": "CVE-2013-5829",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5829"
},
{
"name": "CVE-2013-5879",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5879"
},
{
"name": "CVE-2013-5817",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5817"
},
{
"name": "CVE-2013-5774",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5774"
},
{
"name": "CVE-2014-0373",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0373"
},
{
"name": "CVE-2013-4041",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4041"
},
{
"name": "CVE-2014-0428",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0428"
},
{
"name": "CVE-2013-5791",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5791"
},
{
"name": "CVE-2013-5809",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5809"
},
{
"name": "CVE-2014-0076",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0076"
},
{
"name": "CVE-2013-5763",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5763"
},
{
"name": "CVE-2014-0368",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0368"
},
{
"name": "CVE-2013-5375",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5375"
},
{
"name": "CVE-2013-5825",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5825"
},
{
"name": "CVE-2013-5783",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5783"
},
{
"name": "CVE-2013-5372",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5372"
},
{
"name": "CVE-2013-5830",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5830"
}
],
"initial_release_date": "2014-04-22T00:00:00",
"last_revision_date": "2014-04-22T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 N1020038 IBM du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020038"
}
],
"reference": "CERTFR-2014-AVI-199",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-04-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eIBM\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par\nl\u0027\u00e9diteur, une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de\nservice.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1668578 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21668578"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1670738 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670738"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1670858 du 22 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670858"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM S1004599 du 16 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004599"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1664531 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21664531"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM T1020715 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1020715"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1669459 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21669459"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM N1020021 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020021"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1670750 du 17 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670750"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM N1020038 du 18 avril 2014",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 1670864 du 18 avril 2014",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21670864"
}
]
}
CERTA-2013-AVI-338
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans IBM Tivoli Directory Integrator. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Directory Integrator v7.0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Directory Integrator v7.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Directory Integrator v6.1.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Directory Integrator v7.1.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2013-0443",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0443"
},
{
"name": "CVE-2013-0169",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0169"
},
{
"name": "CVE-2013-0440",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0440"
}
],
"initial_release_date": "2013-06-03T00:00:00",
"last_revision_date": "2013-06-03T00:00:00",
"links": [],
"reference": "CERTA-2013-AVI-338",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2013-06-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli Directory Integrator\u003c/span\u003e. Elles permettent\n\u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Directory Integrator",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21638802 du 31 mai 2013",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21638802"
}
]
}
CERTA-2013-AVI-139
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits IBM . Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Service Request Manager versions 7.2, 7.1, et 6.2 | ||
| IBM | N/A | IBM Maximo Asset Management versions 7.5, 7.1, et 6.2 | ||
| IBM | Tivoli | IBM Tivoli Change and Configuration Management Database versions 7.2 et 7.1 | ||
| IBM | Tivoli | IBM Tivoli Asset Management IT versions 7.2, 7.1, et 6.2 | ||
| IBM | N/A | IBM Maximo Asset Management Essentials versions 7.5, 7.1, et 6.2 | ||
| IBM | N/A | IBM SmartCloud Control Desk version 7.5 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Service Request Manager versions 7.2, 7.1, et 6.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Maximo Asset Management versions 7.5, 7.1, et 6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Change and Configuration Management Database versions 7.2 et 7.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Asset Management IT versions 7.2, 7.1, et 6.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Maximo Asset Management Essentials versions 7.5, 7.1, et 6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM SmartCloud Control Desk version 7.5",
"product": {
"name": "N/A",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-3316",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3316"
},
{
"name": "CVE-2012-2159",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2159"
},
{
"name": "CVE-2012-3322",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3322"
},
{
"name": "CVE-2012-6355",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6355"
},
{
"name": "CVE-2012-3321",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3321"
},
{
"name": "CVE-2012-3327",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3327"
},
{
"name": "CVE-2012-2161",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2161"
},
{
"name": "CVE-2012-6356",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6356"
},
{
"name": "CVE-2013-0457",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0457"
},
{
"name": "CVE-2012-6357",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6357"
},
{
"name": "CVE-2012-3328",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3328"
}
],
"initial_release_date": "2013-02-19T00:00:00",
"last_revision_date": "2013-02-19T00:00:00",
"links": [],
"reference": "CERTA-2013-AVI-139",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2013-02-19T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e . Elles permettent \u00e0 un attaquant\nde provoquer un contournement de la politique de s\u00e9curit\u00e9, une atteinte\n\u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0\ndistance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21625624 du 15 f\u00e9vrier 2013",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21625624"
}
]
}
CERTA-2013-AVI-095
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans IBM Tivoli Storage Manager. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Tivoli | IBM Tivoli Storage Manager Client de la version 6.2.0.0 à 6.2.4.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client branche 6.3.0.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client de la version 6.1.0.0 à 6.1.5.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client de la version 5.5.0.0 à 5.5.4.x | ||
| IBM | Tivoli | IBM Tivoli Storage Manager Client version 6.4.0.0 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Storage Manager Client de la version 6.2.0.0 \u00e0 6.2.4.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client branche 6.3.0.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client de la version 6.1.0.0 \u00e0 6.1.5.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client de la version 5.5.0.0 \u00e0 5.5.4.x",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Storage Manager Client version 6.4.0.0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2013-0472",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0472"
},
{
"name": "CVE-2013-0471",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0471"
}
],
"initial_release_date": "2013-02-05T00:00:00",
"last_revision_date": "2013-02-05T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21624135 du 31 janvier 2013",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21624135"
}
],
"reference": "CERTA-2013-AVI-095",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2013-02-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli Storage Manager\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9 et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Storage Manager",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21624118 du 31 janvier 2013",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21624118"
}
]
}
CERTA-2012-AVI-763
Vulnerability from certfr_avis
Une vulnérabilité a été corrigée dans IBM Tivoli NetView. Elle concerne une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli NetView 1.4 pour z/OS",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli NetView 5.4 pour z/OS",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli NetView V6R1 pour z/OS",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli NetView 5.1 pour z/OS",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli NetView 5.3 pour z/OS",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli NetView 5.2 pour z/OS",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-5951",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-5951"
}
],
"initial_release_date": "2012-12-27T00:00:00",
"last_revision_date": "2012-12-27T00:00:00",
"links": [],
"reference": "CERTA-2012-AVI-763",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2012-12-27T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eIBM Tivoli\nNetView\u003c/span\u003e. Elle concerne une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans IBM Tivoli NetView",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21621163 du 21 d\u00e9cembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21621163"
}
]
}
CERTA-2012-AVI-757
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans IBM Tivoli. Elles concernent le contournement de politiques de sécurités des modules JAVA pouvant mener un utilisateur malintentionné à exécuter du code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Endpoint Manager version 8.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Remote Control version 5.1.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-4823",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-4823"
},
{
"name": "CVE-2012-4820",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-4820"
},
{
"name": "CVE-2012-4821",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-4821"
},
{
"name": "CVE-2012-4822",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-4822"
}
],
"initial_release_date": "2012-12-21T00:00:00",
"last_revision_date": "2012-12-21T00:00:00",
"links": [],
"reference": "CERTA-2012-AVI-757",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2012-12-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli\u003c/span\u003e. Elles concernent le contournement de\npolitiques de s\u00e9curit\u00e9s des modules JAVA pouvant mener un utilisateur\nmalintentionn\u00e9 \u00e0 ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616594 du 19 d\u00e9cembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616594"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21616584 du 19 d\u00e9cembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21616584"
}
]
}
CERTA-2012-AVI-715
Vulnerability from certfr_avis
Une vulnérabilité a été corrigée dans IBM Tivoli Directory Server. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données. Il s'agit d'une attaque du type homme du milieu sur les connections SSL.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Directory Server version 7.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Directory Server version 7.0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Directory Server version 7.1.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-5785",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-5785"
}
],
"initial_release_date": "2012-12-11T00:00:00",
"last_revision_date": "2012-12-11T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21619844 du 07 d\u00e9cembre 2012 :",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21619844"
}
],
"reference": "CERTA-2012-AVI-715",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2012-12-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eIBM Tivoli\nDirectory Server\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es. Il s\u0027agit d\u0027une attaque du\ntype homme du milieu sur les connections SSL.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans IBM Tivoli Directory Server",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21619844 du 07 decembre 2012",
"url": null
}
]
}
CERTA-2012-AVI-671
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans IBM Tivoli Access Manager. L'une d'entre elles permet à un attaquant de provoquer un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Access Manager version 6.0",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Access Manager version 6.1",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-2203",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2203"
},
{
"name": "CVE-2012-2191",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2191"
}
],
"initial_release_date": "2012-11-21T00:00:00",
"last_revision_date": "2012-11-21T00:00:00",
"links": [],
"reference": "CERTA-2012-AVI-671",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2012-11-21T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eIBM Tivoli Access Manager\u003c/span\u003e. L\u0027une d\u0027entre elles\npermet \u00e0 un attaquant de provoquer un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Access Manager",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg1IV31973 du 15 novembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV31973"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg1IV31975 du 15 novembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV31975"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg1IV31981 du 15 novembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV31981"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg1IV31980 du 15 novembre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV31980"
}
]
}
CERTA-2012-AVI-624
Vulnerability from certfr_avis
Deux vulnérabilités ont été corrigées dans IBM Tivoli Federated Identity Manager. L'une d'entre elles concerne l'implémentation du protocole OpenID dans le produit. Un attaquant peut modifier les attributs d'une assertion car les signatures ne sont pas vérifiées.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Tivoli Federated Identity Manager Business Gateway versions 6.1.1, 6.2.0, 6.2.1 et 6.2.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "IBM Tivoli Federated Identity Manager versions 6.1.1, 6.2.0, 6.2.1 et 6.2.2",
"product": {
"name": "Tivoli",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2012-3315",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3315"
},
{
"name": "CVE-2012-3313",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3313"
}
],
"initial_release_date": "2012-11-06T00:00:00",
"last_revision_date": "2012-11-06T00:00:00",
"links": [],
"reference": "CERTA-2012-AVI-624",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2012-11-06T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan class=\"textit\"\u003eIBM\nTivoli Federated Identity Manager\u003c/span\u003e. L\u0027une d\u0027entre elles concerne\nl\u0027impl\u00e9mentation du protocole \u003cspan class=\"textit\"\u003eOpenID\u003c/span\u003e dans le\nproduit. Un attaquant peut modifier les attributs d\u0027une assertion car\nles signatures ne sont pas v\u00e9rifi\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Tivoli Federated Identity Manager",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21615744 du 30 octobre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615744"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21615748 du 30 octobre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615748"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM swg21615770 du 30 octobre 2012",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21615770"
}
]
}