CVE-2014-4843

Curam Universal Access in IBM Curam Social Program Management SPM 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL...

CVE-2014-4843

Curam Universal Access in IBM Curam Social Program Management SPM 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL...

CVE-2014-4843

IBM Cúram Universal Access in Curam SPM exposes internal caseworker usernames via a URL under specific versions: 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5. Root cause is information disclosure through URL construction. Impact: partial confidentiality compromise of ...

CVE-2014-6092

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the 1 DataMappingEditorCommands, 2 DatastoreEditorCommands, and 3 IEGEditorCommands servlets in IBM Curam Social Program Management SPM 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and...

Code injection

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

CVE-2014-6090

Multiple cross-site request forgery CSRF vulnerabilities in the 1 DataMappingEditorCommands, 2 DatastoreEditorCommands, and 3 IEGEditorCommands servlets in IBM Curam Social Program Management SPM 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and...

CVE-2014-6092

CVE-2014-6092 affects IBM Curam SPM prior to SP6 EP6 (5.2 SP6 EP6; 6.0 SP2 EP26; 6.0.4 prior to 6.0.4.6; 6.0.5 prior to 6.0.5.6). The issue is that failed-login handling for web-service accounts does not enforce the same lockout policy as standard user accounts, enabling an attacker with knowledg...

CVE-2014-6092

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

CVE-2014-6091

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management SPM 6.0.4 before 6.0.4.5 iFix7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management SPM 6.0.4 before 6.0.4.5 iFix7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6091

CVE-2014-6091 is an XSS vulnerability in IBM Curam Social Program Management (SPM) 6.0.4 prior to 6.0.4.5 iFix7. It allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. The connected documents confirm the affected product/version and impact but do not provid...

Crlf injection

Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management SPM 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecifie...

CVE-2014-3069

Summary: CVE-2014-3069 affects IBM Cúram Universal Access (V6.0.5.5) when not deployed on IBM WebSphere. The root cause is improper sanitization of user-supplied data output into HTTP response header fields, enabling CRLF injection and potential session/credential exposure or HTTP Response Splitt...