EUVD-2016-4113

Malware in sbrugna...

CVE-2016-5957: Undefined Security Weakness

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive information by leveraging a weak algorithm...

CVE-2016-5974: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

CVE-2016-5971: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference,...

CVE-2016-5970: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a .. dot dot in a URL...

CVE-2016-5963: Improper Access Control

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2016-3040: URL Redirection to Untrusted Site

IBM WebSphere Application Server WAS Liberty, as used in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

PT-2016-6739

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager ISPIM Virtual Appliance versions 2.0.0 through 2.0.2 FP7 Description The issue allows remote authenticated users to read arbitrary files or cause a denial of service due to an XML External Entity XXE...

PT-2016-6741

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager ISPIM Virtual Appliance versions 2.0.0 through 2.0.2 before FP8 IBM Security Privileged Identity Manager ISPIM Virtual Appliance version 2.0.2 before FP8 Description A cross-site scripting XSS issue...

PT-2016-6738

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager ISPIM Virtual Appliance versions 2.0.0 through 2.0.2 FP7 Description A directory traversal issue allows remote authenticated users to read arbitrary files by including a .. dot dot in a URL...

PT-2016-6740

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager ISPIM Virtual Appliance versions 2.0.0 through 2.0.2 before FP8 Description The issue allows remote authenticated users to obtain sensitive information or modify data. This is due to weak permissions fo...

CVE-2016-5972: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors...