CVE-2013-4056

CVE-2013-4056 affects IBM InfoSphere Information Server components Data Quality Console and Information Analyzer (IBM InfoSphere Data Quality Console 9.1 and Information Analyzer 8.7 and 9.1 on all platforms). Root cause: cross-site request forgery (CSRF) that can allow an attacker to trigger act...

CVE-2013-5028

SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to execute arbitrary SQL commands via the 1 hardwareType, 2 hardwareStatus, or 3 hardwareLocation parameter in a search command...

Sql injection

SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to execute arbitrary SQL commands via the 1 hardwareType, 2 hardwareStatus, or 3 hardwareLocation parameter in a search command...

CVE-2013-5028

SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authenticated users to execute arbitrary SQL commands via the 1 hardwareType, 2 hardwareStatus, or 3 hardwareLocation parameter in a search command...

CVE-2013-5028

Kwoksys Kwok Information Server vulnerable to SQL injection in IT/hardware-list.dll (versions before 2.8.5). Affected component is the search command handling (hardwareType, hardwareStatus, hardwareLocation) with remote-authenticated access leading to arbitrary SQL execution. Root cause is improp...

CVE-2013-4067

IBM InfoSphere Information Server 8.0, 8.1, 8.5 through FP3, 8.7, and 9.1 allows remote attackers to hijack sessions and read cookie values, or conduct phishing attacks to capture credentials, via unspecified vectors...

Design/Logic Flaw

IBM InfoSphere Information Server 8.0, 8.1, 8.5 through FP3, 8.7, and 9.1 allows remote attackers to conduct clickjacking attacks by creating an overlay interface on top of the Web Console interface...

CVE-2013-4067

IBM InfoSphere Information Server 8.0, 8.1, 8.5 through FP3, 8.7, and 9.1 allows remote attackers to hijack sessions and read cookie values, or conduct phishing attacks to capture credentials, via unspecified vectors...

CVE-2013-4066

CVE-2013-4066 affects IBM InfoSphere Information Server 8.0, 8.1, 8.5 (FP3), 8.7 and 9.1. An attacker can perform a clickjacking attack by overlaying the Web Console and tricking the user into clicking. IBM’s bulletin lists fixes per version: 8.0/8.1 fixes, 8.5 FP3, 8.7 FP2, and 9.1 upgrade to 9....

CVE-2013-4067

IBM InfoSphere Information Server affected versions: 8.0, 8.1, 8.5 (FP3), 8.7, and 9.1. Affected component: Web Console/session handling leading to possible session hijack and cookie reading; attacker could also phish credentials. Root cause cited as insufficient safeguards around session/cookie ...

Kwok Information Server 2.7.3 / 2.8.4 SQL Injection Vulnerability

Kwok Information Server versions 2.7.3 and 2.8.4 suffer from a remote blind SQL injection vulnerability. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ || || || Advisory : Kwok Information Server Blind Sql Injection || || Affected Version : 2.7.3 & 2.8.4 || || Vendor :...

Kwok Information Server 2.7.3 / 2.8.4 SQL Injection

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ || || || Advisory : Kwok Information Server Blind Sql Injection || || Affected Version : 2.7.3 & 2.8.4 || || Vendor : http://www.kwoksys.com/index.php || || Risk : Medium || || CVE-ID : 2013-5028 || || Tested on Platform : Windows...

CVE-2013-3040

IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 produces login-failure messages indicating whether the username or password is incorrect, which allows remote attackers to enumerate user accounts via a brute-force attack...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the web console...

Default credentials

IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 produces login-failure messages indicating whether the username or password is incorrect, which allows remote attackers to enumerate user accounts via a brute-force attack...

CVE-2013-3034

IBM InfoSphere Information Server contains a cross-site scripting (XSS) vulnerability (CVE-2013-3034) in the web console. The issue affects multiple versions (e.g., 8.1, 8.5, 8.7, 9.1) and can allow remote authenticated users to inject arbitrary script via the web console URLs. IBM’s bulletins sp...

CVE-2013-3040

CVE-2013-3040 affects IBM InfoSphere Information Server (versions 8.1, 8.5, 8.7, 9.1.0, 9.1.2; all platforms). The vulnerability stems from login failure messages that reveal whether a username or a password is incorrect, enabling remote attackers to enumerate valid accounts via brute-force attem...

Kwok Information Server - Multiple SQL Injections

Kwok Information Server - Multiple SQL Injections source: https://www.securityfocus.com/bid/61728/info Kwok Information Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may...

Kwok Information Server - Multiple SQL Injections

source: https://www.securityfocus.com/bid/61728/info Kwok Information Server is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application,...

IBM InfoSphere Information Server 会话固定漏洞(CVE-2013-0507)

BUGTRAQ ID: 59815 CVECAN ID: CVE-2013-0507 IBM InfoSphere Information Server是信息集成平台。 IBM InfoSphere Information Server 8.1、8.5、8.7、9.1在通过身份验证后没有更新会话标识，这可导致会话固定攻击。通过冒充合法用户的会话，攻击者利用此漏洞可在未授权的情况下访问应用。 0 IBM InfoSphere Information Server 9.x IBM InfoSphere Information Server 8.x 厂商补丁： IBM ---...