| The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them. |
|
 |
|
|
Computer vulnerabilities of SPSS Data Collection
IBM JDK: information disclosure via Memory Dump
Synthesis of the vulnerability
An attacker can bypass access restrictions to data by reading the Memory Dump of IBM JDK, in order to obtain sensitive information.
Impacted products: AIX, IRAD, SPSS Data Collection, SPSS Modeler, SPSS Statistics, Tivoli System Automation, WebSphere MQ, RHEL, SUSE Linux Enterprise Desktop, SLES.
Severity: 1/4.
Consequences: data reading.
Provenance: user shell.
Creation date: 23/07/2015.
Identifiers: 1963330, 1963331, 1966040, 1966536, 1967222, 1968485, 1972455, CVE-2015-1931, RHSA-2015:1485-01, RHSA-2015:1486-01, RHSA-2015:1488-01, RHSA-2015:1544-01, SUSE-SU-2015:1329-1, SUSE-SU-2015:1331-1, SUSE-SU-2015:1345-1, SUSE-SU-2015:1375-1, SUSE-SU-2015:1509-1, VIGILANCE-VUL-17483.
Description of the vulnerability
An attacker can bypass access restrictions to data by reading the Memory Dump of IBM JDK, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial) |
Oracle Java: several vulnerabilities of July 2015
Synthesis of the vulnerability
Several vulnerabilities of Oracle Java were announced in July 2015.
Impacted products: DCFM Enterprise, FabricOS, Brocade Network Advisor, Brocade vTM, Debian, Avamar, BIG-IP Hardware, TMOS, Fedora, AIX, DB2 UDB, Domino, Notes, IRAD, SPSS Data Collection, SPSS Modeler, SPSS Statistics, Tivoli Storage Manager, Tivoli System Automation, WebSphere MQ, Junos Space, ePO, SnapManager, Java OpenJDK, openSUSE, Java Oracle, JavaFX, Puppet, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: user access/rights, data reading, data creation/edition, data deletion, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 25.
Creation date: 15/07/2015.
Identifiers: 1963330, 1963331, 1963812, 1964236, 1966040, 1966536, 1967222, 1967498, 1967893, 1968485, 1972455, 206954, 9010041, 9010044, BSA-2016-002, CERTFR-2015-ALE-007, CERTFR-2015-AVI-305, CERTFR-2016-AVI-128, cpujul2015, CVE-2015-2590, CVE-2015-2596, CVE-2015-2597, CVE-2015-2601, CVE-2015-2613, CVE-2015-2619, CVE-2015-2621, CVE-2015-2625, CVE-2015-2627, CVE-2015-2628, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2659, CVE-2015-2664, CVE-2015-2808, CVE-2015-4000, CVE-2015-4729, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760, DSA-3316-1, DSA-3339-1, ESA-2015-134, FEDORA-2015-11859, FEDORA-2015-11860, JSA10727, NTAP-20150715-0001, NTAP-20151028-0001, openSUSE-SU-2015:1288-1, openSUSE-SU-2015:1289-1, RHSA-2015:1228-01, RHSA-2015:1229-01, RHSA-2015:1230-01, RHSA-2015:1241-01, RHSA-2015:1242-01, RHSA-2015:1243-01, RHSA-2015:1485-01, RHSA-2015:1486-01, RHSA-2015:1488-01, RHSA-2015:1526-01, RHSA-2015:1544-01, SB10139, SOL17079, SOL17169, SOL17170, SOL17171, SOL17173, SUSE-SU-2015:1319-1, SUSE-SU-2015:1320-1, SUSE-SU-2015:1329-1, SUSE-SU-2015:1331-1, SUSE-SU-2015:1345-1, SUSE-SU-2015:1375-1, SUSE-SU-2015:1509-1, SUSE-SU-2015:2166-1, SUSE-SU-2015:2192-1, USN-2696-1, USN-2706-1, VIGILANCE-VUL-17371.
Description of the vulnerability
Several vulnerabilities were announced in Oracle Java.
An attacker can use a vulnerability of 2D, in order to obtain information, to alter information, or to trigger a denial of service (VIGILANCE-VUL-17558). [severity:3/4; CVE-2015-4760]
An attacker can use a vulnerability of CORBA, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-2628]
An attacker can use a vulnerability of JMX, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-4731]
An attacker can use a vulnerability of Libraries, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-2590]
An attacker can use a vulnerability of Libraries, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-4732]
An attacker can use a vulnerability of RMI, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-4733]
An attacker can use a vulnerability of 2D, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-2638]
An attacker can use a vulnerability of Deployment, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-4736]
An attacker can use a vulnerability of Security, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-4748]
An attacker can use a vulnerability of Install, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-2597]
An attacker can use a vulnerability of Deployment, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2015-2664]
An attacker can use a vulnerability of 2D, in order to obtain information. [severity:2/4; CVE-2015-2632]
An attacker can use a vulnerability of JCE, in order to obtain information. [severity:2/4; CVE-2015-2601]
An attacker can use a vulnerability of JCE, in order to obtain information (VIGILANCE-VUL-18168). [severity:2/4; CVE-2015-2613]
An attacker can use a vulnerability of JMX, in order to obtain information. [severity:2/4; CVE-2015-2621]
An attacker can use a vulnerability of Security, in order to trigger a denial of service. [severity:2/4; CVE-2015-2659]
An attacker can use a vulnerability of 2D, in order to obtain information. [severity:2/4; CVE-2015-2619]
An attacker can bypass security features in 2D, in order to obtain sensitive information. [severity:2/4; CVE-2015-2637]
An attacker can use a vulnerability of Hotspot, in order to alter information. [severity:2/4; CVE-2015-2596]
An attacker can use a vulnerability of JNDI, in order to trigger a denial of service. [severity:2/4; CVE-2015-4749]
An attacker can use a vulnerability of Deployment, in order to obtain or alter information. [severity:2/4; CVE-2015-4729]
An attacker can use a vulnerability of JSSE, in order to obtain or alter information. [severity:2/4; CVE-2015-4000]
An attacker can use a vulnerability of JSSE, in order to obtain or alter information. [severity:2/4; CVE-2015-2808]
An attacker can use a vulnerability of Install, in order to obtain information. [severity:1/4; CVE-2015-2627]
An attacker can use a vulnerability of JSSE, in order to obtain information. [severity:1/4; CVE-2015-2625]
Full Vigil@nce bulletin... (Free trial) |
SSL 3.0: decrypting session, POODLE
Synthesis of the vulnerability
An attacker, located as a Man-in-the-Middle, can decrypt a SSL 3.0 session, in order to obtain sensitive information.
Impacted products: SES, SNS, Apache httpd, Arkoon FAST360, ArubaOS, Asterisk Open Source, BES, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, GAiA, CheckPoint IP Appliance, IPSO, SecurePlatform, CheckPoint Security Appliance, CheckPoint Security Gateway, Cisco ASR, Cisco ACE, ASA, AsyncOS, Cisco CSS, Cisco ESA, IOS by Cisco, IOS XE Cisco, IOS XR Cisco, IronPort Email, Nexus by Cisco, NX-OS, Prime Infrastructure, Cisco PRSM, Cisco Router, WebNS, Clearswift Email Gateway, Clearswift Web Gateway, CUPS, Debian, Black Diamond, ExtremeXOS, Summit, BIG-IP Hardware, TMOS, Fedora, FortiGate, FortiGate Virtual Appliance, FortiManager, FortiManager Virtual Appliance, FortiOS, FreeBSD, F-Secure AV, hMailServer, HPE BSM, HP Data Protector, HPE NNMi, HP Operations, ProCurve Switch, SiteScope, HP Switch, TippingPoint IPS, HP-UX, AIX, Domino, Notes, Security Directory Server, SPSS Data Collection, Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Traditional, WebSphere MQ, IVE OS, Juniper J-Series, Junos OS, Junos Space, Junos Space Network Management Platform, MAG Series by Juniper, NSM Central Manager, NSMXpress, Juniper SA, McAfee Email and Web Security, McAfee Email Gateway, ePO, VirusScan, McAfee Web Gateway, IE, Windows 2003, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 7, Windows 8, Windows (platform) ~ not comprehensive, Windows RT, Windows Vista, NETASQ, NetBSD, NetScreen Firewall, ScreenOS, nginx, Nodejs Core, OpenSSL, openSUSE, openSUSE Leap, Oracle DB, Oracle Fusion Middleware, Oracle Identity Management, Oracle OIT, Solaris, Tuxedo, WebLogic, Palo Alto Firewall PA***, PAN-OS, Polycom CMA, HDX, RealPresence Collaboration Server, RealPresence Distributed Media Application, Polycom VBP, Postfix, SSL protocol, Puppet, RHEL, JBoss EAP by Red Hat, RSA Authentication Manager, ROS, ROX, RuggedSwitch, Slackware, Splunk Enterprise, stunnel, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Ubuntu, Unix (platform) ~ not comprehensive, ESXi, vCenter Server, VMware vSphere, VMware vSphere Hypervisor, WinSCP.
Severity: 3/4.
Consequences: data reading, data creation/edition.
Provenance: internet client.
Creation date: 15/10/2014.
Identifiers: 10923, 1589583, 1595265, 1653364, 1657963, 1663874, 1687167, 1687173, 1687433, 1687604, 1687611, 1690160, 1690185, 1690342, 1691140, 1692551, 1695392, 1696383, 1699051, 1700706, 2977292, 3009008, 7036319, aid-10142014, AST-2014-011, bulletinapr2015, bulletinjan2015, bulletinjan2016, bulletinjul2015, bulletinjul2016, bulletinoct2015, c04486577, c04487990, c04492722, c04497114, c04506802, c04510230, c04567918, c04616259, c04626982, c04676133, c04776510, CERTFR-2014-ALE-007, CERTFR-2014-AVI-454, CERTFR-2014-AVI-509, CERTFR-2015-AVI-169, CERTFR-2016-AVI-303, cisco-sa-20141015-poodle, cpujul2017, CTX216642, CVE-2014-3566, DSA-3053-1, DSA-3253-1, DSA-3489-1, ESA-2014-178, ESA-2015-098, ESXi500-201502001, ESXi500-201502101-SG, ESXi510-201503001, ESXi510-201503001-SG, ESXi510-201503101-SG, ESXi550-201501001, ESXi550-201501101-SG, FEDORA-2014-12989, FEDORA-2014-12991, FEDORA-2014-13012, FEDORA-2014-13017, FEDORA-2014-13040, FEDORA-2014-13069, FEDORA-2014-13070, FEDORA-2014-13444, FEDORA-2014-13451, FEDORA-2014-13764, FEDORA-2014-13777, FEDORA-2014-13781, FEDORA-2014-13794, FEDORA-2014-14234, FEDORA-2014-14237, FEDORA-2014-15379, FEDORA-2014-15390, FEDORA-2014-15411, FEDORA-2014-17576, FEDORA-2014-17587, FEDORA-2015-9090, FEDORA-2015-9110, FreeBSD-SA-14:23.openssl, FSC-2014-8, HPSBGN03256, HPSBGN03305, HPSBGN03332, HPSBHF03156, HPSBHF03300, HPSBMU03152, HPSBMU03184, HPSBMU03213, HPSBMU03416, HPSBUX03162, HPSBUX03194, JSA10656, MDVSA-2014:203, MDVSA-2014:218, MDVSA-2015:062, NetBSD-SA2014-015, nettcp_advisory, openSUSE-SU-2014:1331-1, openSUSE-SU-2014:1384-1, openSUSE-SU-2014:1395-1, openSUSE-SU-2014:1426-1, openSUSE-SU-2016:0640-1, openSUSE-SU-2016:1586-1, openSUSE-SU-2017:0980-1, PAN-SA-2014-0005, POODLE, RHSA-2014:1652-01, RHSA-2014:1653-01, RHSA-2014:1692-01, RHSA-2014:1920-01, RHSA-2014:1948-01, RHSA-2015:0010-01, RHSA-2015:0011-01, RHSA-2015:0012-01, RHSA-2015:1545-01, RHSA-2015:1546-01, SA83, SB10090, SB10104, sk102989, SOL15702, SP-CAAANKE, SP-CAAANST, SPL-91947, SPL-91948, SSA:2014-288-01, SSA-396873, SSA-472334, SSRT101767, STORM-2014-02-FR, SUSE-SU-2014:1357-1, SUSE-SU-2014:1361-1, SUSE-SU-2014:1386-1, SUSE-SU-2014:1387-1, SUSE-SU-2014:1387-2, SUSE-SU-2014:1409-1, SUSE-SU-2015:0010-1, SUSE-SU-2016:1457-1, SUSE-SU-2016:1459-1, T1021439, TSB16540, USN-2839-1, VIGILANCE-VUL-15485, VMSA-2015-0001, VMSA-2015-0001.1, VMSA-2015-0001.2, VN-2014-003, VU#577193.
Description of the vulnerability
An SSL/TLS session can be established using several protocols:
- SSL 2.0 (obsolete)
- SSL 3.0
- TLS 1.0
- TLS 1.1
- TLS 1.2
An attacker can downgrade the version to SSLv3. However, with SSL 3.0, an attacker can change the padding position with a CBC encryption, in order to progressively guess clear text fragments.
This vulnerability is named POODLE (Padding Oracle On Downgraded Legacy Encryption).
An attacker, located as a Man-in-the-Middle, can therefore decrypt a SSL 3.0 session, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial) |
IBM Eclipse Help System: Cross Site Scripting via iehs.war
Synthesis of the vulnerability
An attacker can use iehs.war to generate a Cross Site Scripting in several IBM products, in order to execute JavaScript code in the context of the victim's web browser.
Impacted products: SPSS Data Collection, WebSphere AS Traditional, WebSphere MQ.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 31/05/2013.
Identifiers: 1651414, 1651880, BID-60246, CVE-2013-0464, swg21637954, VIGILANCE-VUL-12887.
Description of the vulnerability
Several IBM products uses help files, which are displayed through the IBM Eclipse Help System viewer, provided by iehs.war.
However, an attacker can use iehs.war to generate a Cross Site Scripting, in order to execute JavaScript code in the context of the victim's web browser.
Full Vigil@nce bulletin... (Free trial) |
IBM Eclipse Help System: source code reading via iehs.war
Synthesis of the vulnerability
An attacker can use iehs.war, which is used in several IBM products, in order to read the source code of web pages.
Impacted products: DB2 UDB, SPSS Data Collection, WebSphere AS Traditional, WebSphere MQ.
Severity: 2/4.
Consequences: data reading.
Provenance: document.
Creation date: 06/05/2013.
Identifiers: 1651414, 1651880, BID-58000, CVE-2013-0467, swg21612193, swg21637954, VIGILANCE-VUL-12758.
Description of the vulnerability
Several IBM products uses help files, which are displayed through the IBM Eclipse Help System viewer, provided by iehs.war.
However, an attacker can use iehs.war, in order to read the source code of web pages.
Full Vigil@nce bulletin... (Free trial) |
IBM Eclipse Help System: Cross Site Scripting via iehs.war
Synthesis of the vulnerability
An attacker can use iehs.war to generate a Cross Site Scripting in several IBM products, in order to execute JavaScript code in the context of the victim's web browser.
Impacted products: DB2 UDB, SPSS Data Collection, Tivoli Storage Manager, WebSphere AS Traditional.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Number of vulnerabilities in this bulletin: 2.
Creation date: 11/06/2012.
Revisions dates: 17/12/2012, 20/12/2012, 06/05/2013.
Identifiers: BID-54051, CERTA-2012-AVI-391, CERTA-2012-AVI-521, CERTA-2012-AVI-742, CVE-2012-2159-ERROR, CVE-2012-2161, PM62795, swg21596690, swg21612193, swg21620352, swg27022958, swg27036319, VIGILANCE-VUL-11687.
Description of the vulnerability
Several IBM products uses help files, which are displayed through the IBM Eclipse Help System viewer, provided by iehs.war.
However, an attacker can use iehs.war to generate a Cross Site Scripting, in order to execute JavaScript code in the context of the victim's web browser.
Full Vigil@nce bulletin... (Free trial) |
IBM Eclipse Help System: redirect via iehs.war
Synthesis of the vulnerability
An attacker can use iehs.war, which is used in several IBM products, in order to redirect the victim to a malicious site.
Impacted products: DB2 UDB, SPSS Data Collection.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 18/06/2012.
Revision date: 06/05/2013.
Identifiers: BID-54051, CERTA-2012-AVI-391, CERTA-2012-AVI-521, CVE-2012-2159, swg21596690, swg21612193, VIGILANCE-VUL-11718.
Description of the vulnerability
Several IBM products uses help files, which are displayed through the IBM Eclipse Help System viewer, provided by iehs.war.
However, an attacker can use iehs.war, in order to redirect the victim to a malicious site.
Full Vigil@nce bulletin... (Free trial) |
SPSS Data Collection: code execution via ActiveX
Synthesis of the vulnerability
An attacker can use two vulnerabilities of ActiveX installed with IBM SPSS Data Collection, in order to execute code on user's computers.
Impacted products: SPSS Data Collection.
Severity: 2/4.
Consequences: user access/rights, client access/rights.
Provenance: document.
Number of vulnerabilities in this bulletin: 3.
Creation date: 17/01/2012.
Identifiers: 72118, 72121, BID-51445, CVE-2012-0188, CVE-2012-0189, CVE-2012-0190, spss-mraboutb-activex-code-execution, spss-wxporthtml-activex-code-execution, VIGILANCE-VUL-11293, ZDI-12-019, ZDI-12-020, ZDI-12-026, ZDI-12-027.
Description of the vulnerability
The IBM SPSS Data Collection product installs the mraboutb.dll and ExportHTML.dll/ocx ActiveX in the web browser of users. These ActiveX can then be called when the user browses a web site which loads them. However, two vulnerabilities were announced in these ActiveX.
An attacker can generate a buffer overflow in the first parameter of the SetLicenseInfoEx() method of the mraboutb.dll ActiveX, in order to execute code. [severity:2/4; 72118, CVE-2012-0188, spss-mraboutb-activex-code-execution, ZDI-12-019]
An attacker can use the Render() method of the ExportHTML.ocx/dll ActiveX, in order to execute code. [severity:2/4; 72121, CVE-2012-0190, spss-wxporthtml-activex-code-execution, ZDI-12-026]
The ActiveX VsVIEW6 of the product IBM SPSS SamplePower can also be used to execute code. [severity:2/4; CVE-2012-0189, ZDI-12-020, ZDI-12-027]
An attacker can therefore use two vulnerabilities of ActiveX installed with IBM SPSS Data Collection, in order to execute code on user's computers.
Full Vigil@nce bulletin... (Free trial) |
Our database contains other pages. You can request a free trial to read them.
Display information about SPSS Data Collection:
|