CVE-2016-3006

CVE-2016-3006 is a Cross-Site Scripting (XSS) vulnerability in the IBM Connections Web UI. Affected software includes IBM Connections versions 4.x up to 4.5 CR5, 5.0 up to CR4, and 5.5 up to CR1. The issue allows remote authenticated users to inject arbitrary web script or HTML via an embedded st...

CVE-2016-5974

Cross-site scripting XSS vulnerability in the Web UI in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

CVE-2016-3006: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3003...

PT-2016-5322

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006...

PT-2016-5327

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3003...

PT-2016-6742

Name of the Vulnerable Software and Affected Versions IBM Tealeaf Customer Experience versions prior to 8.7.1.8847 FP10 IBM Tealeaf Customer Experience versions prior to 8.8.0.9049 FP9 IBM Tealeaf Customer Experience version 9.0.0 IBM Tealeaf Customer Experience versions prior to 9.0.1.1117 FP5 I...

CVE-2016-3001: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006...

PT-2016-6741

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager ISPIM Virtual Appliance versions 2.0.0 through 2.0.2 before FP8 IBM Security Privileged Identity Manager ISPIM Virtual Appliance version 2.0.2 before FP8 Description A cross-site scripting XSS issue...

PT-2016-5324

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3006...

CVE-2016-5974: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

CVE-2016-5975: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.51089.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.52249.0.2A F...

CVE-2016-5944: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

CVE-2016-3003: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3006...

PT-2016-6728

Name of the Vulnerable Software and Affected Versions IBM Spectrum Control versions 5.2.x through 5.2.10 Description A cross-site scripting XSS issue exists in the Web UI, allowing remote authenticated users to inject arbitrary web script or HTML via an embedded string. This could potentially lea...

PT-2016-6745

Name of the Vulnerable Software and Affected Versions IBM Tealeaf Customer Experience versions prior to 8.7.1.8847 FP10 IBM Tealeaf Customer Experience versions 8.8 prior to 8.8.0.9049 FP9 IBM Tealeaf Customer Experience version 9.0.0 IBM Tealeaf Customer Experience version 9.0.1 prior to...

CVE-2016-5978: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.51089.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.52249.0.2A F...

Metasploit Web UI Diagnostic Console Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Metasploit Web UI Diagnostic Console Command Execution', 'Description' = %q This module exploits the "diagnostic console" featu...

Metasploit Web UI - Diagnostic Console Command Execution Exploit

Exploit for multiple platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Metasploit Web UI Diagnostic Console Command Execution', 'Description...

Metasploit Web UI - Diagnostic Console Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Metasploit Web UI Diagnostic Console Command Execution', 'Description' = %q This module exploits the "diagnostic console" featu...

Metasploit exposure remote code execution vulnerability: don't mess with me, I mad up my own all black-and-vulnerability warning-the black bar safety net

Just this week, Rapid7 community to publish two on the Metasploit framework security patches, by these two vulnerabilities, an attacker can remote unauthorized execution of arbitrary code. Currently, security researchers have issued the relevant POC attack code. ! Vulnerability: Metasploit Web...