PT-2017-8839

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server affected versions not specified Description The issue is related to cross-frame scripting due to insufficient HTML iframe protection. A remote attacker could exploit this by using a specially-crafted URL to...

PT-2017-9914

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server affected versions not specified Description The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the URLs...

CVE-2016-8982: Exposure of Sensitive Information to an Unauthorized Actor

IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...

CVE-2016-6059: Improper Restriction of XML External Entity Reference

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

PT-2017-8843

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server affected versions not specified Description The issue allows an authenticated user to browse any file on the engine tier and examine its contents. Recommendations At the moment, there is no information about a...

PT-2017-8292

Name of the Vulnerable Software and Affected Versions IBM Infosphere BigInsights affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a...

PT-2017-8267

Name of the Vulnerable Software and Affected Versions IBM Infosphere BigInsights affected versions not specified Description The issue is caused by improper validation of user-supplied input, leading to cross-site scripting. A remote attacker could exploit this using a specially-crafted URL to...

CVE-2016-8999: Improper Neutralization of Input During Web Page Generation

IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS...

CVE-2016-9000: Improper Neutralization of Input During Web Page Generation

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct...

CVE-2016-2924: Improper Neutralization of Input During Web Page Generation

IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,...

IBM InfoSphere DataStage Information Disclosure Vulnerability

IBM InfoSphere DataStage is a set of IBM's ETL Extract, Transform, and Load tools to provide data integration solutions in a graphical interface, and is part of the IBM suite of information platform solutions and IBM InfoSphere. An information disclosure vulnerability exists in IBM InfoSphere...

IBM InfoSphere Information Server Security Bypass Vulnerability (CNVD-2017-00452)

IBM InfoSphere Information Server is a suite of data integration platforms from IBM. A security bypass vulnerability exists in IBM InfoSphere Information Server, which can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...

Multiple IBM Product Clickjacking Vulnerabilities

IBM InfoSphere DataStage and InfoSphere Information Server on Cloud are both products of IBM USA. The former is a set of graphical interface to provide data integration solutions ETL data extraction, transformation and loading tools, the latter is a set of cloud-based data integration platform. A...

IBM InfoSphere Information Server Framework and IBM InfoSphere Information Server on Cloud Clickjacking Vulnerability

IBM InfoSphere Information Server Framework ISF and IBM InfoSphere Information Server on Cloud are products of IBM Corporation, USA. The former is a set of data integration platform framework, the latter is a set of cloud-based data integration platform. A clickjacking vulnerability exists in IBM...

IBM InfoSphere Information Server XML External Entity Injection Vulnerability

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. An XML external entity injection vulnerability exists in IBM InfoSphere Information Server that originates...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

CVE-2016-0280: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

Cross-Site Scripting Vulnerability in Multiple IBM Products

IBM InfoSphere Information Governance Catalog IGC, formerly known as InfoSphere Business Information Exchange and IBM InfoSphere Information Server Framework ISF are both products of IBM Corporation. IGC is a set of solutions that provide comprehensive information integration capabilities and IT...

IBM InfoSphere Information Governance Catalog XXE Injection Vulnerability

IBM InfoSphere Information Governance Catalog IGC, formerly known as InfoSphere Business Information Exchange is a suite of solutions from IBM that provides comprehensive information integration capabilities and IT asset management. An XXE injection vulnerability exists in IBM InfoSphere IGC...

InfoSphere Information Server Access Control Bypass

The vulnerability of the Connector Migration Tool component of the InfoSphere Information Server software platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions related to data creation and...