Security Bulletin: Vulnerabilities affect Document Builder component in IBM Rational Publishing Engine (CVE-2016-2912, CVE-2016-2914)

Summary Vulnerabilities in the IBM Rational Publishing Engine affects the Document Builder RPENG. Vulnerability Details CVEID: CVE-2016-2912 DESCRIPTION: IBM Rational Publishing Engine is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker...

CVE-2016-2914

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine aka RPENG 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension...

CVE-2016-2912

Cross-site scripting XSS vulnerability in the Document Builder in IBM Rational Publishing Engine aka RPENG 2.0.1 before ifix002 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Unrestricted file upload

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine aka RPENG 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension...

CVE-2016-2914

CVE-2016-2914 affects IBM Rational Publishing Engine’s Document Builder in version 2.0.1 before ifix002. The issue is an unrestricted file upload caused by improper validation of file extensions, allowing a remote authenticated attacker to upload a malicious file and potentially execute code on t...

CVE-2016-2914

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine aka RPENG 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension...

CVE-2016-2912

CVE-2016-2912 is associated with IBM Rational Publishing Engine (RPENG) – Document Builder. The IBM Security Bulletin states that RPENG 2.0.1 before ifix002 is vulnerable to cross‑site scripting: a remote authenticated attacker can inject arbitrary script/HTML via a crafted URL due to insufficien...

CVE-2016-2912

Cross-site scripting XSS vulnerability in the Document Builder in IBM Rational Publishing Engine aka RPENG 2.0.1 before ifix002 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...