<html><body>
<p><font size="2" face="sans-serif">Hello VIM colleagues.</font><br>
<br>
<font size="2" face="sans-serif">In mid December there was a confusing changelog issued by the IBM Financial Transaction Manager team that listed several vulnerabilities. These were picked up by several vulnerability databases.</font><br>
<br>
<font size="2" face="sans-serif">We have worked with the product team and the PSIRT team to consolidate some issues, and eliminate others that were not actual vulnerabilities.</font><br>
<br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0830"><font size="2" face="Default Sans
Serif">The actual vulnerabilities are as follows:</font></a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0830"></a><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0830"><font size="2" face="Default Sans
Serif">CVE-2014-0830</font></a><font size="2" face="Default Sans
Serif">: FTM 2.0 and 2.1 Table export function exposes a path traversal vulnerability </font><br>
<br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0831"><font size="2" face="Default Sans
Serif">CVE-2014-0831</font></a><font size="2" face="Default Sans
Serif">: FTM 2.0 OAC is not protected from cross site request forgery vulnerabilities. </font><br>
<br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0832"><font size="2" face="Default Sans
Serif">CVE-2014-0832</font></a><font size="2" face="Default Sans
Serif">: FTM 2.0 Configuration details screens are exposed to cross site scripting vulnerabilities. </font>
<ul style="padding-left: 72pt"></ul>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0833"><font size="2" face="Default Sans
Serif">CVE-2014-0833</font></a><font size="2" face="Default Sans
Serif">: FTM 2.0 OAC could accept a request to execute a resolution action where the user is not authorized. </font><br>
<br>
<font size="2" face="sans-serif">FTM Security Bulletin:</font><br>
<font size="2" face="sans-serif"><a href="http://www-01.ibm.com/support/docview.wss?uid=swg21662714">http://www-01.ibm.com/support/docview.wss?uid=swg21662714</a></font><br>
<br>
<font size="2" face="sans-serif"><br>
Thanks.<br>
<br>
-----<br>
Scott Moore<br>
Vulnerability Database - Team Lead<br>
X-Force Research and Development<br>
IBM Security Systems<br>
Office: 404-348-9288<br>
Cell: 404-643-1260</font></body></html>