CVE-2016-8982: Exposure of Sensitive Information to an Unauthorized Actor

IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...

CVE-2016-6059: Improper Restriction of XML External Entity Reference

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

PT-2017-8843

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server affected versions not specified Description The issue allows an authenticated user to browse any file on the engine tier and examine its contents. Recommendations At the moment, there is no information about a...

CVE-2016-8999: Improper Neutralization of Input During Web Page Generation

IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS...

IBM InfoSphere Information Server Security Bypass Vulnerability (CNVD-2017-00452)

IBM InfoSphere Information Server is a suite of data integration platforms from IBM. A security bypass vulnerability exists in IBM InfoSphere Information Server, which can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...

Multiple IBM Product Clickjacking Vulnerabilities

IBM InfoSphere DataStage and InfoSphere Information Server on Cloud are both products of IBM USA. The former is a set of graphical interface to provide data integration solutions ETL data extraction, transformation and loading tools, the latter is a set of cloud-based data integration platform. A...

VBScript RegExpComp::PnodeParse Out-Of-Bounds Read

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the sixth entry in that series. The below information is available in more detail on my blog at http://blog.skylined.nl/20161108001.html. There you can find a repro th...

VBScript CRegExp::Execute Uninitialized Memory Use

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the fifth entry in that series. The below information is available in more detail on my blog at http://blog.skylined.nl/20161107001.html. There you can find a repro th...

CVE-2016-0280

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

CVE-2016-0280

CVE-2016-0280 is an XSS vulnerability affecting IBM InfoSphere Information Server Framework, Information Governance Catalog, and Business Glossary across multiple versions (ISF 8.5, IGC 11.3/11.5, BI Glossary 8.7/9.1, Framework 8.7/9.1/11.3/11.5). The root cause is improper validation of user-sup...

PT-2016-4125

Name of the Vulnerable Software and Affected Versions IBM Information Server Framework versions 8.5 IBM Information Server Framework and InfoSphere Information Server Business Glossary versions 8.7 before FP2 IBM Information Server Framework and InfoSphere Information Server Business Glossary...

CVE-2016-0280: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server...

InfoSphere Information Server Access Control Bypass

The vulnerability of the Connector Migration Tool component of the InfoSphere Information Server software platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions related to data creation and...

Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability

Description Apache Struts is prone to a remote code-execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts may cause a denial-of-service condition. Apache Struts 1.0 through...

CVE-2016-1343

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

CVE-2016-1343

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

CVE-2016-1343

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

CVE-2016-1343: Undefined Security Weakness

The XML parser in Cisco Information Server CIS 6.2 allows remote attackers to read arbitrary files or cause a denial of service CPU and memory consumption via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCuy39059...

PT-2016-4723

Name of the Vulnerable Software and Affected Versions Cisco Information Server CIS version 6.2 Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to an XML External Entity XXE issue. This is related to the XML parser in Cisco Information Server...