cve.bz

ibm vulnerabilities, newest first, page 121

Filter
  1. 8.8CVE-2016-5952EPSS 1.4%

    IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

  2. 5.4CVE-2016-5951EPSS 0.5%

    IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  3. 6.5CVE-2016-5950EPSS 1.0%

    IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user.

  4. 4.3CVE-2016-5949EPSS 1.3%

    IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request.

  5. 5.4CVE-2016-5948EPSS 0.5%

    IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  6. 6.3CVE-2016-5939EPSS 0.8%

    IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

  7. 8.8CVE-2016-5937EPSS 0.6%

    IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

  8. 5.4CVE-2016-5899EPSS 0.5%

    IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  9. 4.3CVE-2016-5898EPSS 0.9%

    IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive inf…

  10. 5.4CVE-2016-5897EPSS 0.6%

    IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

  11. 5.3CVE-2016-5896EPSS 1.0%

    IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser.

  12. 6.1CVE-2016-5884EPSS 1.0%

    IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

  13. 6.1CVE-2016-5882EPSS 1.0%

    IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

  14. 5.4CVE-2016-5880EPSS 0.7%

    IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

  15. 7.8CVE-2016-3053ExploitEPSS 2.5%

    IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.

  16. 2.7CVE-2016-3046EPSS 0.9%

    IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacker to view information in the back-end database.

  17. 3.7CVE-2016-3045EPSS 0.8%

    IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history.

  18. 5.9CVE-2016-3043EPSS 1.2%

    IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive in…

  19. 5.3CVE-2016-3035EPSS 1.0%

    IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server.

  20. 4.4CVE-2016-3034EPSS 0.2%

    IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt information more easily.

  21. 8.8CVE-2016-3029EPSS 0.5%

    IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

  22. 6.5CVE-2016-3027EPSS 1.3%

    IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive inform…

  23. 4.0CVE-2016-3024EPSS 0.3%

    IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system.

  24. 5.3CVE-2016-3023EPSS 1.1%

    IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names.

  25. 6.5CVE-2016-3022EPSS 1.7%

    IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.

  26. 2.7CVE-2016-3021EPSS 1.0%

    IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.

  27. 6.1CVE-2016-3018EPSS 0.8%

    IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclos…

  28. 7.5CVE-2016-3017EPSS 2.2%

    IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.

  29. 4.4CVE-2016-3016EPSS 0.4%

    IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code.

  30. 4.3CVE-2016-2987EPSS 0.8%

    An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker.

  31. 6.1CVE-2016-2939EPSS 1.0%

    IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

  32. 6.1CVE-2016-2938EPSS 1.0%

    IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

  33. 9.1CVE-2016-2908EPSS 3.4%

    IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to rea…

  34. 8.1CVE-2016-0396EPSS 1.4%

    IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected.

  35. 3.3CVE-2016-0394EPSS 0.3%

    IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.

  36. 3.7CVE-2016-0297EPSS 0.9%

    IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the middle techniques.

  37. 3.3CVE-2016-0296EPSS 0.3%

    IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.

  38. 5.4CVE-2016-0265EPSS 0.7%

    IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within t…

  39. 7.5CVE-2016-9879EPSS 1.5%

    An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with a…

  40. 9.1CVE-2015-5073EPSS 7.7%

    Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR pr…

  41. 7.5CVE-2015-3217EPSS 6.2%

    PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.…

  42. 8.1CVE-2016-3055EPSS 1.4%

    IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with…

  43. 6.8CVE-2016-3047EPSS 0.8%

    Open redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  44. 6.5CVE-2016-3044EPSS 0.4%

    The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors.

  45. 8.1CVE-2016-3033EPSS 1.4%

    IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity …

  46. 7.5CVE-2016-3012EPSS 1.7%

    IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, which might allow remote attackers to bypass intended access restrictions by leveraging knowledge o…

  47. 5.4CVE-2016-2994EPSS 0.6%

    Cross-site scripting (XSS) vulnerability in IBM UrbanCode Deploy 6.2.x before 6.2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  48. 5.4CVE-2016-2991EPSS 0.6%

    Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Protector for Mail Security 2.8.0.0 through 2.8.1.0 before 2.8.1.0-22115 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  49. 5.4CVE-2016-2955EPSS 0.6%

    Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  50. 7.8CVE-2016-2946EPSS 0.4%

    Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2.3 before FP5, and 6.3.0 before FP2 on Linux and UNIX allows local users to gain privileges via unspecified vectors.