CVE-2013-2956

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2954

The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2013-2957: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2953: Undefined Security Weakness

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate...

PT-2013-4059

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue allows remote attackers to gain access via a brute-force attack due to the lack of limitation on incorrect authenticatio...

PT-2013-4058

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to the use of the MD5 algorithm for signatures in X.509 certificates, which can be exploited by...

CVE-2013-2955: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue...

CVE-2013-2956: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2013-4060

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to a stored cross-site scripting XSS vulnerability, which allows remote authenticated users to inject arbitra...

PT-2013-4061

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 6.x through 9.x before 9.1.0.3,...

CVE-2013-2954: Improper Authentication

The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

PT-2013-4062

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web...

CVE-2013-2959: Undefined Security Weakness

The Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not provide an encrypted session for transmitting login credentials, which allows remote attackers to obtain sensitive information by sniffing the network...

PT-2013-4063

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue concerns the transmission of login credentials in an unencrypted manner, allowing remote attackers to intercept sensitiv...

IBM InfoSphere Information Server 会话固定漏洞(CVE-2013-0507)

BUGTRAQ ID: 59815 CVECAN ID: CVE-2013-0507 IBM InfoSphere Information Server是信息集成平台。 IBM InfoSphere Information Server 8.1、8.5、8.7、9.1在通过身份验证后没有更新会话标识，这可导致会话固定攻击。通过冒充合法用户的会话，攻击者利用此漏洞可在未授权的情况下访问应用。 0 IBM InfoSphere Information Server 9.x IBM InfoSphere Information Server 8.x 厂商补丁： IBM ---...

CVE-2013-0584

The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password, via unspecified vectors...

Design/Logic Flaw

The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password, via unspecified vectors...

CVE-2013-0584: Exposure of Sensitive Information to an Unauthorized Actor

The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password, via unspecified vectors...

PT-2013-2442

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Replication Server versions 9.7 through 10.2.0.0-b113 Description The issue allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password. Recommendations Fo...

IBM InfoSphere Data Replication Dashboard Unpassworded User Enumeration

The version of IBM InfoSphere Data Replication Dashboard hosted on the remote web server displays its list of users that can authenticate without using a password. A remote, unauthenticated attacker could use this information to gain unauthorized access to the application. %NASLMINLEVEL 70300 C...