73 matches found
CVE-2016-6102
CVE-2016-6102 affects IBM Security Key Lifecycle Manager (formerly Tivoli Key Lifecycle Manager). The vulnerability arises because versions 2.5 (2.5.0.7 and earlier) and 2.6 (2.6.0.2 and earlier) store sensitive information in URL parameters, enabling possible information disclosure if URLs are c...
CVE-2017-1145
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion. IBM Reference : 1999672...
Code injection
An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expose to an attacker information passed between the server and the browser. IBM Reference : 1999960...
CVE-2016-2981
An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference : 1999965...
CVE-2016-8973
IBM Rhapsody Design Manager (RDM) versions 4.0–6.0 are affected by an undisclosed vulnerability that may allow an authenticated user to upload infected files to the server. The issue, tracked as CVE-2016-8973, has a CVSSv3 base score of 4.3 (Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). ...
CVE-2016-9696
CVE-2016-9696 pertains to IBM Rational Rhapsody DM where HTML injection is possible due to improper input handling. A remote attacker could cause malicious HTML to run in a victim’s browser within the hosting site’s context. Affected versions: 4.0.0–4.0.7, 5.0.0–5.0.2, 6.0.0–6.0.2 (per linked IBM...
CVE-2016-9697
CVE-2016-9697 is an IBM Rhapsody DM vulnerability described as enabling a JSON Hijacking attack. Public records in connected docs confirm the issue affects Rational Software Architect Design Manager 4.0.0–6.0.2 and are tied to JSON hijacking exposure between server and browser. The NVD entry list...
CVE-2016-5933
IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...
Design/Logic Flaw
IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...
CVE-2016-5894
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference : 1997408...
CVE-2017-1150
IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference : 1999515...
Sql injection
IBM Tivoli Storage Manager IBM Spectrum Protect 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these...
CVE-2016-9728
IBM Qradar 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM Reference : 1999543...
Design/Logic Flaw
IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be...
Design/Logic Flaw
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...
Cross site request forgery (csrf)
IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference : 1999549...
Xxe
IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference : 1999537...
CVE-2016-9740
CVE-2016-9740 affects IBM QRadar SIEM 7.2, where a remote attacker could exhaust server resources due to insufficiently restricted resource size/amount. The vulnerability is classified as a Denial of Service (high impact) with network access and no user interaction required. IBM’s remediation is ...
