Description

A weakness and a vulnerability have been reported in IBM DataQuant and DB2 Query Management Facility, which can be exploited by malicious people to conduct spoofing and cross-site scripting attacks.

The weakness and the vulnerability are caused due to a bundled vulnerable version of the IBM Eclipse Help System (IEHS).

For more information:
SA49438

The weakness and the vulnerability are reported in the following products:
* IBM DataQuant versions prior to 1.2.16
* IBM DB2 Query Management Facility versions 9.1 prior to Fix Pack 19 and versions 10.1 prior to Fix Pack 6.

Solution
Update to a fixed version.
Further details available to Secunia VIM customers

Original Advisory
IBM:
http://www.ibm.com/support/docview.wss?uid=swg21614445
http://www.ibm.com/support/docview.wss?uid=swg21614444

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers