Medium Severity

Security Bulletin: IBM Tivoli Monitoring Basic Services component (CVE-2019-15903)

Share this post:

Fixes a vulnerability reported in the libexpat parser that is used by IBM Tivoli Monitoring for parsing various configuration xml files as well as parsing soap requests.

Affected product(s) and affected version(s):

The basic services module, kbb for IBM Tivoli Monitoring is affected and is included in the TEMA(ax/gl), TEMS(ms), TEPS(cq) and the User Interface Extensions(ue) components.

For the various configuration xml files used by ITM, if they were to be manipulated with malicious intent by someone with access to your ITM installation, then you could be vulnerable to the CVE reported in this bulletin. Configuration files include those for the firewall gateway as well as private situations and audit logging.

For soap server enabling soap security also reduces the risk to just malicious users with ITM access.

Affected Product(s) Version(s)
IBM Tivoli Monitoring 6.3.0 – (up to Service pack 2)

Refer to the following reference URLs for remediation and additional vulnerability details:  
Source Bulletin:

More stories

Security Bulletin: Multiple cross-site scripting vulnerabilities affect IBM DOORS Next Generation

Apr 7, 2020 8:01 pm EDT | Medium Severity

There are multiple cross-site scripting defects that affect IBM DOORS Next Generation (DNG/RRC) more

Security Bulletin: IBM Security Information Queue has insufficient session expiration (CVE-2020-4284)

Apr 7, 2020 8:01 pm EDT | Medium Severity

IBM Security Information Queue (ISIQ) does not have a mechanism for terminating idle UI sessions. This leaves an unattended ISIQ session vulnerable to being compromised. As of v1.0.6, ISIQ automatically terminates a session that has been idle for 60 minutes. The timeout value is configurable. more

Security Bulletin: IBM Security Information Queue uses components with known vulnerabilities (CVE-2019-8331, CVE-2019-11358)

Apr 7, 2020 8:00 pm EDT | Medium Severity

The IBM Security Information Queue (ISIQ) web server utilizes a Node.js runtime environment. The environment includes several open source packages with known vulnerabilities. As of ISIQ v1.0.6, the open source packages have been upgraded to the recommended secure versions. more