CVE-2013-0585

IBM InfoSphere Information Server contains XSS vulnerabilities (CVE-2013-0585) in the web console and repository management UIs. Affected versions include 8.1, 8.5, 8.7, and 9.1.0 (and 9.1.2 for some entries) across all platforms. The issue arises from malformed URL handling that can allow an aut...

CVE-2013-3040

IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 produces login-failure messages indicating whether the username or password is incorrect, which allows remote attackers to enumerate user accounts via a brute-force attack...

CVE-2013-0585

Multiple cross-site scripting XSS vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the 1 web console and 2 repository management user interfaces...

CVE-2013-3996

IBM InfoSphere BigInsights 1.1 through 2.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site...

CVE-2013-3995

Cross-site scripting XSS vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-3992

Cross-site request forgery CSRF vulnerability in IBM InfoSphere BigInsights 2.0 through 2.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM InfoSphere BigInsights 2.0 through 2.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

IBM InfoSphere BigInsights 1.1 through 2.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site...

CVE-2013-3992

CVE-2013-3992 is an CSRF vulnerability in IBM InfoSphere BigInsights 2.0–2.1. The IBM advisory lists affected platforms as BigInsights v1.1–2.1 (Linux shown) and provides remediation via the 2.1 Fix Pack (2.1.0.1). Other fixes include contacting support for older versions (1.1–2.0). The vulnerabi...

CVE-2013-3992

Cross-site request forgery CSRF vulnerability in IBM InfoSphere BigInsights 2.0 through 2.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-3995

Cross-site scripting XSS vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-3996

IBM InfoSphere BigInsights 1.1 through 2.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site...

CVE-2013-3995

IBM InfoSphere BigInsights (versions 1.1–2.1) contains a cross-site scripting (XSS) vulnerability (CVE-2013-3995) that could allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The IBM advisory for related CVEs notes fixes for version 2.1 (2.1.0.1 Fix ...

CVE-2013-3996

CVE-2013-3996 affects IBM InfoSphere BigInsights v1.1–v2.1. The issue is a flaw in how FRAME elements are handled, enabling phishing via a crafted web site when the user is authenticated. The IBM bulletin confirms vulnerability to phishing through frames and cross-site scripting-type risks, with ...

CVE-2013-2956

SQL injection vulnerability in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-2953

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate...

CVE-2013-2954

The login page in the Console in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 does not limit the number of incorrect authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2013-2955

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, related to a stored XSS issue...

CVE-2013-2957

Cross-site scripting XSS vulnerability in IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...