CVE-2014-6090

CVE-2014-6090 affects IBM Cúram SPM (DataMappingEditorCommands, DatastoreEditorCommands, IEGEditorCommands) across multiple versions (5.2 SP6 before EP6; 6.0 SP2 before EP26; 6.0.3/6.0.4/6.0.5 before respective iFix/EP levels). The root cause is CSRF in these servlets, allowing remote attackers t...

CVE-2014-6092

CVE-2014-6092 affects IBM Curam SPM prior to SP6 EP6 (5.2 SP6 EP6; 6.0 SP2 EP26; 6.0.4 prior to 6.0.4.6; 6.0.5 prior to 6.0.5.6). The issue is that failed-login handling for web-service accounts does not enforce the same lockout policy as standard user accounts, enabling an attacker with knowledg...

CVE-2014-6092

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

CVE-2014-6090: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the 1 DataMappingEditorCommands, 2 DatastoreEditorCommands, and 3 IEGEditorCommands servlets in IBM Curam Social Program Management SPM 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and...

PT-2015-3810

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management SPM versions 5.2 SP6 through 5.2 SP6 before EP6 IBM Curam Social Program Management SPM versions 6.0 SP2 through 6.0 SP2 before EP26 IBM Curam Social Program Management SPM versions 6.0.3 through 6.0.3.0...

CVE-2014-6092: Undefined Security Weakness

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

PT-2015-3811

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management SPM versions 5.2 through 5.2 before SP6 EP6 IBM Curam Social Program Management SPM versions 6.0 SP2 through 6.0 SP2 before EP26 IBM Curam Social Program Management SPM versions 6.0.4 through 6.0.4 before...

IBM Curam Social Program Management Curam Universal Access Information Disclosure Vulnerability

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A security vulnerability exists in Curam Universal Access for IBM Curam SPM, which allows a remote attacker to access th...

IBM Curam Social Program Management Universal Access Component CRLF Injection Vulnerability

IBM Curam Social Program Management is a suite of social program management solutions from IBM in the United States that supports the end-to-end social program delivery process.Universal Access is one of the universal access components. A CRLF injection vulnerability exists in the implementation ...

Design/Logic Flaw

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page...

CVE-2014-4804

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page...

CVE-2014-4804

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page...

CVE-2014-4804

CVE-2014-4804 affects IBM Curam Social Program Management (Cúram SPM) – Curam Universal Access when SPI is enabled. A page with SPI included can allow a remote attacker to obtain sensitive user data. Affected versions include 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5....

PT-2015-3779

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 5.2 before SP6 EP6 IBM Curam Social Program Management versions 6.0 SP2 before EP26 IBM Curam Social Program Management versions 6.0.4.5 before iFix007 IBM Curam Social Program Management versions...

CVE-2014-4804: Exposure of Sensitive Information to an Unauthorized Actor

Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page...

CVE-2014-4803

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

Crlf injection

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

CVE-2014-4803

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

CVE-2014-4803

IBM Cúram Universal Access (part of IBM Cúram Social Program Management) is vulnerable to a CRLF injection when not deployed on WebSphere, due to improper sanitization on a page parameter. A remote authenticated attacker could inject arbitrary HTTP headers and perform HTTP response splitting, pot...

PT-2015-3778

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0 SP2 through 6.0 SP2 before EP26 IBM Curam Social Program Management version 6.0.4 through 6.0.4 before 6.0.4.5 iFix007 IBM Curam Social Program Management version 6.0.5 through 6.0.5 before...