CVE-2015-0115

Cross-site request forgery CSRF vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts...

Cross site request forgery (csrf)

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified...

CVE-2015-0115

Cross-site request forgery CSRF vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts...

CVE-2014-4768

IBM Unified Extensible Firmware Interface UEFI on Flex System x880 X6, System x3850 X6, and System x3950 X6 devices allows remote authenticated users to cause an unspecified temporary denial of service by using privileged access to enable a legacy boot mode...

CVE-2015-0131

Cross-site scripting XSS vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified...

CVE-2015-0131

CVE-2015-0131 describes a Cross-site scripting (XSS) vulnerability in IBM Leads across multiple versions (7.x; 8.1.0 prior to 8.1.0.14; 8.2; 8.5.0 prior to 8.5.0.7.3; 8.6.0 prior to 8.6.0.8.1; 9.0.0 through 9.0.0.4; 9.1.0 prior to 9.1.0.6.1; 9.1.1 before 9.1.1.0.2) that allows remote authenticate...

CVE-2015-0549

Cross-site scripting XSS vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5078

SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter...

Directory traversal

Directory traversal vulnerability in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition WLE 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted...

Sql injection

SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.1 FP4, when Webmail is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH9WYPR5...

CVE-2015-1884

Directory traversal vulnerability in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition WLE 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted...

Design/Logic Flaw

Cisco Application Policy Infrastructure Controller APIC 1.01.110a and 1.01e on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485...

Sql injection

SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.11 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq46325...

CVE-2015-4222

Cisco CVE-2015-4222 affects the Cisco Unified Communications Manager IM and Presence Service, version 9.1(1). A SQL injection flaw in the service’s handling of user input allows an authenticated, remote attacker to execute arbitrary SQL commands via unspecified vectors, potentially impacting conf...

CVE-2015-1851

OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do...

CVE-2015-5061

ManagedEngine AssetExplorer is affected by cross-site scripting (XSS) vulnerabilities in version 6.1 service pack 6112 and earlier, due to improper input validation in VendorDef.do (organizationName) and an additional XSS issue in the Publisher name parameter. The Nessus entry specifies the affec...