IBM Security vulnerabilities released

woozily Overview :

Multiple security vulnerabilities have been updated in IBM products

Muratpaşa Affected Product(s) :

IBM Maximo Asset Management 7.6
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5

Vulnerability Details :

CVE ID :	CVE-2019-4486
	IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070.
CVE ID :	CVE-2019-4459
	IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163656.
CVE ID :	CVE-2019-4398
	IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.
CVE ID :	CVE-2019-4397
	IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239

Solution :

For Maximo Asset Management 7.6:

VRM	Fix Pack, Feature Pack, or Interim Fix	Download
7.6.1.1	Maximo Asset Management 7.6.1.1 iFix: 7.6.1.1-TIV-MBS-IFIX001 or latest Interim Fix available	FixCentral
7.6.0.10	Maximo Asset Management 7.6.0.10 iFix: 7.6.0.10-TIV-MBS-IFIX008 or latest Interim Fix available	FixCentral

The recommended solution is to apply the fixes as soon as practical.

Principal Product and Version(s)

VRMF

Remediation/First Fix

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

2.5, 2.5.0.1, 2.5.0.2, 2.5.0.3, 2.5.0.4, 2.5.0.5, 2.5.0.6, 2.5.0.7, 2.5.0.8, 2.5.0.9

For 2.5 versions, IBM recommends upgrading to Fix Pack 10 (2.5.0.10) of IBM Cloud Orchestrator:

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

2.4, 2.4.0.1, 2.4.0.2, 2.4.0.3, 2.4.0.4, 2.4.0.5

Contact IBM Cloud Orchestrator support.

Contact us to get started

Description Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE)

Learn more

Description Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe,

Learn more

Description SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly,

Learn more