Multiple security vulnerabilities affecting Rational Publishing Engine.
CVEID:CVE-2015-0254
**DESCRIPTION:**Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1)<x:parse> or (2)<x:transform> JSTL XML tag.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/101550 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVEID:CVE-2012-0881
**DESCRIPTION:**Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/134404 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2019-4431
**DESCRIPTION:**IBM Publishing Engine is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/162888 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
RPE | 6.0.6.1 |
RPE | 6.0.6 |
For Rational Publishing Engine 6.0.6, upgrade to ifix002 or later, which can be downloaded from:
Rational Publishing Engine 6.0.6 ifix002
For Rational Publishing Engine 6.0.6.1, upgrade to ifix001 or later, which can be downloaded from:
Rational Publishing Engine 6.0.6.1 ifix001
None