Oktawian Powazka

**Name of the Vulnerable Software and Affected Versions** IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6 IBM TRIRIGA Application Platform versions 3.4 before 3.4.2.3 IBM TRIRIGA Application Platform versions 3.5 before 3.5.0.1 **Description** The issue allows remote attackers to obtain sensitive information via vectors involving a database query. **Recommendations** For versions 3.3 before 3.3.2.6, update to version 3.3.2.6 or later. For versions 3.4 before 3.4.2.3, update to version 3.4.2.3 or later. For versions 3.5 before 3.5.0.1, update to version 3.5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6 IBM TRIRIGA Application Platform versions 3.4 before 3.4.2.3 IBM TRIRIGA Application Platform versions 3.5 before 3.5.0.1 **Description** The issue might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validation. **Recommendations** For IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6, update to version 3.3.2.6 or later. For IBM TRIRIGA Application Platform versions 3.4 before 3.4.2.3, update to version 3.4.2.3 or later. For IBM TRIRIGA Application Platform versions 3.5 before 3.5.0.1, update to version 3.5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** IBM TRIRIGA Application Platform versions prior to 3.3.2 **Description** The issue allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to Document Manager. **Recommendations** For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** IBM TRIRIGA Application Platform versions 3.3 before 3.3.2.6 IBM TRIRIGA Application Platform versions 3.4 before 3.4.2.4 IBM TRIRIGA Application Platform versions 3.5 before 3.5.0.2 **Description** The issue allows remote authenticated users to conduct server-side request forgery (SSRF) attacks. This can trigger network traffic to arbitrary intranet or Internet hosts via a crafted proxy request to a web service. **Recommendations** For versions 3.3 before 3.3.2.6, update to version 3.3.2.6 or later. For versions 3.4 before 3.4.2.4, update to version 3.4.2.4 or later. For versions 3.5 before 3.5.0.2, update to version 3.5.0.2 or later.