cve.bz

ibm vulnerabilities, newest first, page 120

Filter
  1. 5.4CVE-2016-8943EPSS 0.5%

    IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disc…

  2. 3.1CVE-2016-8942EPSS 0.5%

    IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the server.

  3. 8.8CVE-2016-8941EPSS 0.6%

    IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

  4. 6.1CVE-2016-8936EPSS 0.7%

    IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading …

  5. 5.4CVE-2016-8934EPSS 0.7%

    IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  6. 6.1CVE-2016-8922EPSS 0.7%

    Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  7. 8.8CVE-2016-8921EPSS 2.2%

    IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.

  8. 5.4CVE-2016-8920EPSS 0.5%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credenti…

  9. 5.9CVE-2016-8918EPSS 1.1%

    IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials.

  10. 6.5CVE-2016-8913EPSS 1.8%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the…

  11. 4.3CVE-2016-8912EPSS 0.9%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user.

  12. 5.4CVE-2016-8911EPSS 0.6%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack th…

  13. 6.5CVE-2016-6126EPSS 1.8%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the…

  14. 5.4CVE-2016-6125EPSS 0.5%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credenti…

  15. 8.8CVE-2016-6124EPSS 2.2%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.

  16. 5.4CVE-2016-6123EPSS 0.5%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credenti…

  17. 4.3CVE-2016-6122EPSS 0.8%

    IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users.

  18. 6.1CVE-2016-6113EPSS 1.0%

    IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessi…

  19. 9.8CVE-2016-6090EPSS 2.0%

    IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and potentially causing a denial of service.

  20. 6.5CVE-2016-6085EPSS 0.5%

    IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers.

  21. 6.5CVE-2016-6084EPSS 0.5%

    IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request.

  22. 10.0CVE-2016-6082EPSS 4.7%

    IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.

  23. 5.3CVE-2016-6080EPSS 1.0%

    The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker.

  24. 5.4CVE-2016-6072EPSS 0.5%

    IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with…

  25. 7.8CVE-2016-6065EPSS 0.4%

    IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root.

  26. 5.4CVE-2016-6061EPSS 0.5%

    IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tru…

  27. 8.1CVE-2016-6059EPSS 1.5%

    IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive informat…

  28. 5.4CVE-2016-6054EPSS 0.5%

    IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tru…

  29. 5.4CVE-2016-6047EPSS 0.5%

    IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  30. 5.4CVE-2016-6046EPSS 0.5%

    IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential…

  31. 8.8CVE-2016-6045EPSS 0.6%

    IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

  32. 4.3CVE-2016-6044EPSS 0.6%

    IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy.

  33. 7.0CVE-2016-6043EPSS 0.2%

    Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced.

  34. 7.3CVE-2016-6042EPSS 2.6%

    IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit thi…

  35. 5.0CVE-2016-6040EPSS 0.5%

    IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced.

  36. 5.4CVE-2016-6039EPSS 0.5%

    IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  37. 6.8CVE-2016-6034EPSS 1.0%

    IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges.

  38. 5.4CVE-2016-6030EPSS 0.5%

    IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a tru…

  39. 4.3CVE-2016-6028EPSS 0.8%

    IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view.

  40. 6.1CVE-2016-6020EPSS 0.8%

    IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulne…

  41. 6.1CVE-2016-6000EPSS 0.7%

    IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  42. 6.5CVE-2016-5994EPSS 1.2%

    IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and examine its contents.

  43. 6.3CVE-2016-5990EPSS 0.6%

    IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the server.

  44. 6.5CVE-2016-5988EPSS 1.0%

    IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authenticated user.

  45. 7.8CVE-2016-5985EPSS 0.4%

    The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system c…

  46. 6.1CVE-2016-5984EPSS 0.9%

    IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacke…

  47. 5.4CVE-2016-5980EPSS 0.5%

    IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  48. 5.9CVE-2016-5966EPSS 1.2%

    IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability…

  49. 9.8CVE-2016-5964EPSS 1.6%

    IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.

  50. 7.5CVE-2016-5958EPSS 1.7%

    IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP sessio…